Exploitation Summary
EIP tracks 10 public exploits for CVE-2009-0476.
PoCs published by sanjeev gupta, Metasploit, Sébastien Duquette, including Metasploit module exploits/windows/fileformat/audio_wkstn_pls.
AI-analyzed exploit summary This exploit targets a SEH-based buffer overflow in MP3 Workstation 9.2.1.1.2 by crafting a malicious .pls file. It uses a NOP sled, SEH overwrite, and shellcode to achieve remote code execution.
Description
Stack-based buffer overflow in MultiMedia Soft AdjMmsEng.dll 7.11.1.0 and 7.11.2.7, as distributed in multiple MultiMedia Soft audio components for .NET, allows remote attackers to execute arbitrary code via a long string in a playlist (.pls) file, as originally reported for Euphonics Audio Player 1.0. NOTE: some of these details are obtained from third party information.
Exploits (10)
This exploit targets a SEH-based buffer overflow in MP3 Workstation 9.2.1.1.2 by crafting a malicious .pls file. It uses a NOP sled, SEH overwrite, and shellcode to achieve remote code execution.
This Metasploit module exploits a stack-based buffer overflow in Audiotran 1.4.1 via a maliciously crafted PLS file. It generates a payload with SEH overwrite to achieve remote code execution when the victim opens the file.
This exploit targets a stack overflow vulnerability in Audiotran 1.4.1 via a malformed .pls file. It leverages SEH overwrite and shellcode execution to achieve remote code execution on Windows XP SP2/SP3.
This exploit targets a local buffer overflow vulnerability in Audio Workstation 6.4.2.4.0 via a malformed .pls file, leveraging SEH overwrite to execute shellcode. The payload is crafted to trigger a reverse shell or arbitrary code execution.
This exploit targets a local buffer overflow in Euphonics Audio Player v1.0 via a maliciously crafted .pls file. It uses a universal return address and shellcode to execute arbitrary commands (e.g., calc.exe).
This exploit generates a malicious .pls file containing a buffer overflow payload targeting a vulnerability in Winamp. The shellcode is designed to execute arbitrary code when the file is opened.
This exploit targets a local buffer overflow in Euphonics Audio Player v1.0 via a malformed .pls file. It uses a JMP ESP address from kernel32.dll and executes a Metasploit-generated shellcode to spawn calc.exe.
This Metasploit module exploits a buffer overflow in Audio Workstation 6.4.2.4.3 by crafting a malicious .pls file. It leverages SEH overwrites and alphanumeric shellcode to achieve remote code execution on Windows systems.
This Metasploit module exploits a stack-based buffer overflow in Audiotran 1.4.2.4 via a maliciously crafted PLS file. It leverages SEH overwrite to achieve remote code execution when the victim opens the file.
This Metasploit module exploits a stack-based buffer overflow in Audiotran 1.4.1 via a maliciously crafted PLS file. It leverages SEH overwrites to achieve remote code execution on Windows systems.