RealPlayer 15.0.6.14(.3g2) – ‘WriteAV’ Crash (PoC)

• Exploit Database
• 14 阅读

• 作者： coolkaveh
  日期： 2012-11-01
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/22402/

• Title:RealPlayer 15.0.6.14(.3g2) WriteAV Vulnerability
  Version:15.0.6.14
  Date :2012-10-29
  Vendor :http://www.real.com/
  crash:http://img543.imageshack.us/img543/9130/pocm.jpg
  Impact :High
  Contact:coolkaveh [at] rocketmail.com
  Twitter:@coolkaveh
  tested :windows 7 x64
  Author :coolkaveh
  ###############################################################################
  Bug :
  ----
  Memory corruption during the handling of the 3g2 files context-dependent
  Successful exploits can allow attackers to execute arbitrary code
  ---- 
  ################################################################################
  (f84.8c8): Access violation - code c0000005 (first chance)
  First chance exceptions are reported before any exception handling.
  This exception may be expected and handled.
  eax=040d1370 
  ebx=7fdfe2d0 
  ecx=0a67f798 
  edx=0a67f7a8 
  esi=00000000 
  edi=00000004
  eip=66fc94df 
  esp=3c6c1a80 
  ebp=0a67f764 iopl=0 nv up ei pl nz na po nc
  cs=0023ss=002bds=002bes=002bfs=0053gs=002b efl=00010202
  *** ERROR: Symbol file could not be found.Defaulted to export symbols for C:\Program Files (x86)\Real\RealPlayer\codecs\dmp4.dll - 
  dmp4!GetGUID+0x1836f:
  66fc94df 8944241cmov dword ptr [esp+1Ch],eax ss:002b:3c6c1a9c=????????
  0:029> !exploitable -v
  HostMachine\HostUser
  Executing Processor Architecture is x86
  Debuggee is in User Mode
  Debuggee is a live user mode debugging session on the local machine
  Event Type: Exception
  Exception Faulting Address: 0x3c6c1a9c
  First Chance Exception Type: STATUS_ACCESS_VIOLATION (0xC0000005)
  Exception Sub-Type: Write Access Violation
  
  Exception Hash (Major/Minor): 0x247c7f22.0x247c7f63
  
  Stack Trace:
  dmp4!GetGUID+0x1836f
  Instruction Address: 0x0000000066fc94df
  
  Description: User Mode Write AV
  Short Description: WriteAV
  Exploitability Classification: EXPLOITABLE
  Recommended Bug Title: Exploitable - User Mode Write AV starting at dmp4!GetGUID+0x000000000001836f (Hash=0x247c7f22.0x247c7f63)
  
  User mode write access violations that are not near NULL are exploitable.
  ################################################################################
  Proof of concept included. 
  
  http://www21.zippyshare.com/v/83302158/file.html
  Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22402.rar