Exploit-DB #17398
Description: Microsoft Windows Media Player with K-Lite Codec Pack - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2011-06-14
Author: Nicolas Krassas

Exploit:
Greetings,
  There is a DOS condition on windows media player when the klite codec pack
is installed.

# Exploit Title: Windows Media Player with klite codec pack DOS Poc
# Date: 14/06/2011
# Author: Nicolas Krassas , www.twitter.com/dinosn
# Version:Windows Media Player 12
# Tested on: Windows 7

The 3gp handling from MP4Splitter.ax filter of klite codec pack will cause
an Access violation when a specially crafted movie file is loaded on the
media player. The same crash will occur also when the file is loaded on a
playlist and the media player will try to generate thumbnail image of the
contents.

File at: http://www.deventum.com/research/Crash_WMplayer.3gp
Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17398.3gp (Crash_WMplayer.3gp)

Debug info,


Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.

*** wait with pending attach
Symbol search path is: SRV*c:\Symbols*
http://msdl.microsoft.com/download/symbols
Executable search path is:
ModLoad: 00[PII_REDACTED]c000   C:\Program Files\Windows Media
Player\wmplayer.exe
ModLoad: 773e0000 7751c000   C:\Windows\SYSTEM32\ntdll.dll
ModLoad: [PII_REDACTED]   C:\Windows\system32\kernel32.dll
ModLoad: 75[PII_REDACTED]a000   C:\Windows\system32\KERNELBASE.dll
ModLoad: 764c0[PII_REDACTED]0   C:\Windows\system32\ADVAPI32.dll
ModLoad: 76230000 762dc000   C:\Windows\system32\msvcrt.dll
ModLoad: [PII_REDACTED]   C:\Windows\SYSTEM32\sechost.dll
ModLoad: 762e0[PII_REDACTED]0   C:\Windows\system32\RPCRT4.dll
ModLoad: [PII_REDACTED]   C:\Windows\system32\USER32.dll
ModLoad: 761e0000 7622e000   C:\Windows\system32\GDI32.dll
ModLoad: 75af0000 75afa000   C:\Windows\system32\LPK.dll
ModLoad: 75bf0000 75c8d000   C:\Windows\system32\USP10.dll
ModLoad: 775d0[PII_REDACTED]0   C:\Windows\system32\WS2_32.dll
ModLoad: [PII_REDACTED]   C:\Windows\system32\NSI.dll
ModLoad: 75db0000 75dcf000   C:\Windows\system32\IMM32.DLL
ModLoad: 75[PII_REDACTED]c000   C:\Windows\system32\MSCTF.dll
ModLoad: 742a0000 742e0000   C:\Windows\system32\uxtheme.dll
ModLoad: 76790000 773da000   C:\Windows\system32\SHELL32.dll
ModLoad: 75b00000 75b57000   C:\Windows\system32\SHLWAPI.dll
ModLoad: 61cc0000 627b4000   C:\Windows\system32\wmp.dll
ModLoad: [PII_REDACTED]
C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
ModLoad: 76[PII_REDACTED]c000   C:\Windows\system32\ole32.dll
ModLoad: 75b60000 75bef000   C:\Windows\system32\OLEAUT32.dll
ModLoad: 73f10000 73f23000   C:\Windows\system32\dwmapi.dll
ModLoad: 60f70000 61b7c000   C:\Windows\system32\wmploc.dll
ModLoad: 754b0000 754bc000   C:\Windows\system32\CRYPTBASE.dll
ModLoad: 74420000 745be000
C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\COMCTL32.dll
ModLoad: 76140000 761c3000   C:\Windows\system32\CLBCatQ.DLL
ModLoad: 68320000 683d2000   C:\Windows\System32\jscript.dll
ModLoad: 74a30000 74a39000   C:\Windows\System32\VERSION.dll
ModLoad: 74fe0000 74ff6000   C:\Windows\system32\CRYPTSP.dll
ModLoad: 74ce0000 74d1b000   C:\Windows\system32\rsaenh.dll
ModLoad: 75[PII_REDACTED]e000   C:\Windows\system32\RpcRtRemote.dll
ModLoad: 75[PII_REDACTED]f000   C:\Windows\system32\SXS.DLL
ModLoad: 73d30000 73e2b000   C:\Windows\system32\WindowsCodecs.dll
ModLoad: [PII_REDACTED]   C:\Windows\system32\MSIMG32.dll
ModLoad: 75[PII_REDACTED]b000   C:\Windows\system32\profapi.dll
ModLoad: 75950000 75aed000   C:\Windows\system32\SETUPAPI.dll
ModLoad: [PII_REDACTED]   C:\Windows\system32\CFGMGR32.dll
ModLoad: [PII_REDACTED]   C:\Windows\system32\DEVOBJ.dll
ModLoad: 742e0000 743d5000   C:\Windows\system32\propsys.dll
ModLoad: 74a00000 74a21000   C:\Windows\system32\ntmarta.dll
ModLoad: 76470000 764b5000   C:\Windows\system32\WLDAP32.dll
ModLoad: 73e60000 73e99000   C:\Windows\System32\MMDevApi.dll
ModLoad: [PII_REDACTED]   C:\Windows\system32\MFPlat.DLL
ModLoad: 73c70000 73c77000   C:\Windows\system32\AVRT.dll
ModLoad: 64e60000 64e96000   C:\Windows\system32\AUDIOSES.DLL
ModLoad: 6fd30000 6fd8a000   C:\Windows\System32\netprofm.dll
ModLoad: [PII_REDACTED]   C:\Windows\System32\nlaapi.dll
ModLoad: 6f460000 6f468000   C:\Windows\System32\npmproxy.dll
ModLoad: 70b90000 70bd4000   C:\Windows\system32\upnphost.dll
ModLoad: 70[PII_REDACTED]d000   C:\Windows\system32\SSDPAPI.dll
ModLoad: 72670000 726a2000   C:\Windows\system32\WINMM.dll
ModLoad: 74b40000 74b4d000   C:\Windows\system32\WTSAPI32.dll
ModLoad: 751a0000 751c9000   C:\Windows\system32\WINSTA.dll
ModLoad: 75c90000 75daa000   C:\Windows\system32\WININET.dll
ModLoad: [PII_REDACTED]   C:\Windows\system32\Normaliz.dll
ModLoad: 75e30000 75fe6000   C:\Windows\system32\iertutil.dll
ModLoad: 75ff0[PII_REDACTED]0   C:\Windows\system32\urlmon.dll
ModLoad: [PII_REDACTED]   C:\Windows\system32\Secur32.dll
ModLoad: 75490000 754ab000   C:\Windows\system32\SSPICLI.DLL
ModLoad: 73[PII_REDACTED]a000   C:\Windows\system32\slc.dll
ModLoad: [PII_REDACTED]   C:\Windows\system32\imapi2.dll
ModLoad: 74b50000 74b5b000   C:\Windows\system32\pcwum.DLL
ModLoad: 75[PII_REDACTED]d000   C:\Windows\system32\WINTRUST.dll
ModLoad: 756f0000 7580d000   C:\Windows\system32\CRYPT32.dll
ModLoad: 755f0000 755fc000   C:\Windows\system32\MSASN1.dll
ModLoad: 6a4c0000 6a50c000   C:\Windows\System32\mswmdm.dll
ModLoad: 74e40000 74e84000   C:\Windows\system32\dnsapi.DLL
ModLoad: 72e40000 72e5c000   C:\Windows\system32\iphlpapi.DLL
ModLoad: 72e30000 72e37000   C:\Windows\system32\WINNSI.DLL
ModLoad: [PII_REDACTED]   C:\Program Files\Common Files\Microsoft
Shared\Windows Live\WLIDNSP.DLL
ModLoad: 761d0000 761d5000   C:\Windows\system32\PSAPI.DLL
ModLoad: 74fa0000 74fdc000   C:\Windows\System32\mswsock.dll
ModLoad: 706d0000 706f5000   C:\Program Files\Bonjour\mdnsNSP.dll
ModLoad: 65fc0000 65ff6000   C:\Windows\system32\upnp.dl