Sabtu, 13 Oktober 2012

Buffer Overflow Exploit Easy RM To MP3 Converter

Now we're going to use application exploits Easy RM To MP3 Converter. because he exploitnya manual system and we have to collect the information in the application Easy RM To MP3.

Easy RM to MP3 Converter application can open / load file format real-meda (* ra,. *. Ram, *. RMJ, RMVB *,. *. Smi) and playlist file (* m3u,. *. Pls, *. WPL , * candles. *. smi, *. wvx, etc.)

well now we mngambil the only information from a variety of existing information.


we take the example m3u.
Here we have to make a manual fuzzer using m3u extension.


and a call was made ​​earlier that fuzzer uses.
root @ bt: ~ # python rmp3.py


then we attacked Easy RM To MP3 Converter uses a file called music. first run the application Easy RM To MP3 Converter and then click start and open the load on the application and select the music file in the file and change the first of Files Of Type to choose two. 

 
watch and observe what happens to the application
watch and observe what happens to the application. application crash in sight then that we do now is open the app Easy RM To MP3 Converter uses OliyDbg to know EIP Its Applications.



"Easy open applications use the RM To MP3 Converter OllyDbg, and observe that there"

run the application Easy RM To MP3 Converter is ter start first. and concomitantly also run OllyDbg application.
On the application OllyDbg select

File >> attach >>




run the application Easy RM To MP3 Converter and enter the file fuzzer application called "music" and observe the application Olly DBG.
entered on consul windows. and create as many as 26,500 files is

command: root @ bt :/ opt/framework/msf3/tools #. / pattern_create.rb 26500




  enter data into fuzzer that had as many as 26500

run the application Easy RM To MP3 Converter and enter the file fuzzer application called "music" and observe the application Olly DBG.






EIP: that has turned into 48336D48


run the application Easy RM To MP3 Converter and enter the file fuzzer application called "music" and observe the application Olly DBG.
















Tidak ada komentar:

Posting Komentar