ASX to MP3 Converter 1.82.50 SOF exploit
Software: https://www.exploit-db.com/apps/b7c8c2a232e1d4a959c43970a877a799-ASXtoMP3Converter.exe
Date: 02 Oct 2022
Thanks to codingo for the reference (https://github.com/codingo/OSCP-2/blob/master/Exploits/ATMC_v1.82.50.py)
Author: Dylan Jenkins
Based on PoC by the totally real person: Ivan Ivanovic Ivanov
Reference: https://www.exploit-db.com/exploits/38382/
Tested on: Windows 2k3
EIP Offset: 249, note that the EIP seems to change depending on the logged in user or some other factors I couldn't work out
Bad Chars: x00\x09\x0a\x1a
Return Address | dll: 0x1003789d ("\xFF\xEF", JMP ESP) | MSA2Multility03.dll
Usage: Open ASX to MP3 Converter application > load evil asx file
- asxmp3_EIPoffset.py > determine required EIP offset
- asxmp3_controlEIP.py > prove that EIP offset is correct
- asxmp3_calcexploit.py > prove exploit works by launching calc.exe
- ASXtoMP3ConverterSOFexploit.py > Full exploit to execute reverse shell