Metasploit mailing list archives

XMPlayer PLS Buffer Overflow Module

From: glinares.code at gmail.com (Greg Linares)
Date: Thu, 30 Nov 2006 13:02:13 -0700

I tried using EEReap and memdump and I couldn't find a universal jump
that didn't have restricted characters in it.  Most of the DLLs are
loaded below 0x00A00000 with the exception of one in which i could
only find the address 0x10002C12 which still wont work.

someone else should take a wack at it :)

Greg Linares


On 11/28/06, H D Moore <hdm at metasploit.com> wrote:

FYI, you can also use 'memdump.exe' in the tools directory of v2.7. This
will create a directory containing the process image broken into files
based on the virtual address. The msfpescan -d <dir> option can be used
to find return addresses in the memdump.exe output. Just cross-reference
the opcode matches with the virtual addresses to determine which ones
fall into the application's DLLs.

Really short on free time lately, or I would do it myself :-/

-HD

On Tuesday 28 November 2006 21:58, Greg Linares wrote:

hate to double post but that tool Jerome mentioned is called EEReap
from Eeye. If no one grabs a universal address by tomorrow i'll
probably dive in and try for it :)

Current thread:

XMPlayer PLS Buffer Overflow Module Greg Linares (Nov 27)
- XMPlayer PLS Buffer Overflow Module Nicob (Nov 28)
  - XMPlayer PLS Buffer Overflow Module Greg Linares (Nov 28)
    - XMPlayer PLS Buffer Overflow Module Greg Linares (Nov 28)
    - XMPlayer PLS Buffer Overflow Module H D Moore (Nov 28)
    - XMPlayer PLS Buffer Overflow Module Greg Linares (Nov 30)