PornoSecurity

All you can spray

Posted on 2009-08-13 12:49:25 in PornoSecurity

Since I'm tired of reinventing the wheel, I decided to write a couple of lines of code an to wrap it in a easy-to-use, single php file.

Just put it in your DocumentRoot and you get ActionScript(flash) heap spraying and/or a wonderful .NET assembly loaded at the address you choose.

 

The script accepts different parameters:

- t: 'd' if you want a .NET assembly, 'f' for SWF

- s: shellcode

- n: nop

- c: number of chunks to spray (for SWF)

- b: base address (for .NET assembly)

 

For example, to request a .NET assembly with base address of 0x41410000, a nopsled of 0x0a and an INT 3 as shellcode:

/spray.php?t=d&s=%cc&n=0x0a&b=4141

if you want to spray the heap with flash instead:

/spray.php?t=f&s=%cc&n=0x0a&c=0x500

 

Here you can find a .tar.gz with the script, an html example and the flash spray sources(to be compiled with haxe).

No, there's no source for the .NET control in the .tar.gz(it's 1Mb, too heavy). To make one, just create a class and put in there a huge static string, it will be loaded in +rx area.

Have fun :)

Nick