Good evening, my friends.
Well, today we are going to talk about a new exploit, found in WinMUGEN.

Information provided by ydccdy, a Chinese MUGEN author, has revealed the existence of an exploit found in the CMD processor, the command expressions to be exact., whose main function is to trigger determined actions from the commands written in StateDef -1.

After having taken a look at the exploit, I have noticed the command name length is fixed to 64 bytes, giving the chance to execute arbitrary code from a CMD expression by surpassing this length, basically a buffer overflow.

What M.U.G.E.N authors put in their state controllers to make use of the commands, either it can be used to execute arbitrary code, for example, these 2 pictures:




Command = "Insert all your shellcode here, it is less versatile, but well. 1234"
Note: The 1234 characters are used as a return address for the exploit.

I have made this character after spending a few hours to program its arbitrary code, but the results were worth, so...
As a conclusion, I can say this method is really less versatile than the SuperNull one, but if you manage to put all your shellcode into command slices, the execution may be interesting to see...

Preview: