353 lines
No EOL
9.6 KiB
Text
353 lines
No EOL
9.6 KiB
Text
Introduction:
|
|
|
|
=============
|
|
|
|
GOM Player (Gretech Online Movie Player) is a 32/64-bit media player for
|
|
Microsoft Windows, distributed by the Gretech Corporation of South Korea.
|
|
|
|
It is the primary client player for South Korean GOM-TV, and is more
|
|
popular in South Korea than any other media player. Key strengths inherited
|
|
from libavcodec include wide ranging ability to play media files, including
|
|
.flv - without needing to obtain an external codec, and the ability to play
|
|
some broken media files. Both of those features are present in other
|
|
projects using libavcodec like VLC and MPlayer, but are absent from some
|
|
other media software, including Windows Media Player.
|
|
|
|
Abstract:
|
|
|
|
=========
|
|
|
|
The Vulnerability Laboratory Research Team discovered a Buffer Overflow
|
|
Vulnerability on GOM Media Player v. 2.1.37
|
|
|
|
Exploitation-Technique:
|
|
|
|
=======================
|
|
|
|
Local
|
|
|
|
|
|
|
|
Severity:
|
|
|
|
=========
|
|
|
|
High
|
|
|
|
|
|
Vulnerable Module(s):
|
|
|
|
[+] GomU+0x125cb7
|
|
|
|
|
|
Proof of Concept=================
|
|
|
|
The vulnerability can be exploited by local & remote attackers.
|
|
|
|
1) Download & open the software client
|
|
|
|
2) Click open ==> Url..
|
|
|
|
3) Put vulnerability code
|
|
|
|
4) now you will see result
|
|
|
|
|
|
Executable search path is:
|
|
|
|
ModLoad: 00400000 007a9000 GomU.exe
|
|
|
|
ModLoad: 77790000 778cc000 ntdll.dll
|
|
|
|
ModLoad: 76730000 76804000 C:\Windows\system32\kernel32.dll
|
|
|
|
ModLoad: 75380000 753ca000 C:\Windows\system32\KERNELBASE.dll
|
|
|
|
ModLoad: 70cf0000 70d22000 C:\Windows\system32\WINMM.dll
|
|
|
|
ModLoad: 76aa0000 76b4c000 C:\Windows\system32\msvcrt.dll
|
|
|
|
ModLoad: 765e0000 766a9000 C:\Windows\system32\USER32.dll
|
|
|
|
ModLoad: 760f0000 7613e000 C:\Windows\system32\GDI32.dll
|
|
|
|
ModLoad: 76590000 7659a000 C:\Windows\system32\LPK.dll
|
|
|
|
ModLoad: 76810000 768ad000 C:\Windows\system32\USP10.dll
|
|
|
|
ModLoad: 766b0000 7672b000 C:\Windows\system32\comdlg32.dll
|
|
|
|
ModLoad: 761a0000 761f7000 C:\Windows\system32\SHLWAPI.dll
|
|
|
|
ModLoad: 74070000 7420e000
|
|
C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\COMCTL32.dll
|
|
|
|
ModLoad: 754a0000 760ea000 C:\Windows\system32\SHELL32.dll
|
|
|
|
ModLoad: 71380000 713d1000 C:\Windows\system32\WINSPOOL.DRV
|
|
|
|
ModLoad: 76250000 762f0000 C:\Windows\system32\ADVAPI32.dll
|
|
|
|
ModLoad: 768b0000 768c9000 C:\Windows\SYSTEM32\sechost.dll
|
|
|
|
ModLoad: 76b70000 76c11000 C:\Windows\system32\RPCRT4.dll
|
|
|
|
ModLoad: 6d8e0000 6d8fc000 C:\Windows\system32\oledlg.dll
|
|
|
|
ModLoad: 762f0000 7644c000 C:\Windows\system32\ole32.dll
|
|
|
|
ModLoad: 72dc0000 72dd9000 C:\Windows\system32\OLEPRO32.DLL
|
|
|
|
ModLoad: 76c20000 76caf000 C:\Windows\system32\OLEAUT32.dll
|
|
|
|
ModLoad: 768d0000 76a6d000 C:\Windows\system32\SETUPAPI.dll
|
|
|
|
ModLoad: 752a0000 752c7000 C:\Windows\system32\CFGMGR32.dll
|
|
|
|
ModLoad: 75360000 75372000 C:\Windows\system32\DEVOBJ.dll
|
|
|
|
ModLoad: 74600000 74609000 C:\Windows\system32\VERSION.dll
|
|
|
|
ModLoad: 76f80000 77075000 C:\Windows\system32\WININET.dll
|
|
|
|
ModLoad: 76450000 76587000 C:\Windows\system32\urlmon.dll
|
|
|
|
ModLoad: 75180000 7529d000 C:\Windows\system32\CRYPT32.dll
|
|
|
|
ModLoad: 75170000 7517c000 C:\Windows\system32\MSASN1.dll
|
|
|
|
ModLoad: 76d80000 76f7e000 C:\Windows\system32\iertutil.dll
|
|
|
|
ModLoad: 765a0000 765d5000 C:\Windows\system32\WS2_32.dll
|
|
|
|
ModLoad: 778d0000 778d6000 C:\Windows\system32\NSI.dll
|
|
|
|
ModLoad: 76b50000 76b6f000 C:\Windows\system32\IMM32.dll
|
|
|
|
ModLoad: 76cb0000 76d7c000 C:\Windows\system32\MSCTF.dll
|
|
|
|
ModLoad: 71fa0000 71fbc000 C:\Windows\system32\iphlpapi.dll
|
|
|
|
ModLoad: 71f90000 71f97000 C:\Windows\system32\WINNSI.DLL
|
|
|
|
(668.151c): Break instruction exception - code 80000003 (first chance)
|
|
|
|
eax=00000000 ebx=00000000 ecx=0012fb08 edx=777d7094 esi=fffffffe
|
|
edi=00000000
|
|
|
|
eip=7783054e esp=0012fb24 ebp=0012fb50 iopl=0 nv up ei pl zr na pe
|
|
nc
|
|
|
|
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
|
|
efl=00000246
|
|
|
|
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
|
|
ntdll.dll -
|
|
|
|
ntdll!LdrVerifyImageMatchesChecksum+0x633:
|
|
|
|
7783054e cc int 3
|
|
|
|
0:000> g
|
|
|
|
ModLoad: 73ef0000 73f30000 C:\Windows\system32\uxtheme.dll
|
|
|
|
ModLoad: 75080000 7508c000 C:\Windows\system32\CRYPTBASE.dll
|
|
|
|
ModLoad: 10000000 100d3000 C:\Program
|
|
Files\GRETECH\GomPlayer\lang\GomENG.dll
|
|
|
|
ModLoad: 75010000 7502b000 C:\Windows\system32\SspiCli.dll
|
|
|
|
ModLoad: 75100000 7510b000 C:\Windows\system32\profapi.dll
|
|
|
|
ModLoad: 74a30000 74a74000 C:\Windows\system32\dnsapi.DLL
|
|
|
|
ModLoad: 73780000 737d2000 C:\Windows\system32\RASAPI32.dll
|
|
|
|
ModLoad: 73760000 73775000 C:\Windows\system32\rasman.dll
|
|
|
|
ModLoad: 73750000 7375d000 C:\Windows\system32\rtutils.dll
|
|
|
|
ModLoad: 6f050000 6f056000 C:\Windows\system32\sensapi.dll
|
|
|
|
ModLoad: 75400000 75483000 C:\Windows\system32\CLBCatQ.DLL
|
|
|
|
ModLoad: 74bb0000 74bc6000 C:\Windows\system32\CRYPTSP.dll
|
|
|
|
ModLoad: 74950000 7498b000 C:\Windows\system32\rsaenh.dll
|
|
|
|
ModLoad: 750f0000 750fe000 C:\Windows\system32\RpcRtRemote.dll
|
|
|
|
ModLoad: 01fb0000 0201a000 C:\Program
|
|
Files\GRETECH\GomPlayer\GomTVStrm.dll
|
|
|
|
ModLoad: 73b30000 73b69000 C:\Windows\system32\MMDevAPI.DLL
|
|
|
|
ModLoad: 73f30000 74025000 C:\Windows\system32\PROPSYS.dll
|
|
|
|
ModLoad: 6f020000 6f050000 C:\Windows\system32\wdmaud.drv
|
|
|
|
ModLoad: 6f010000 6f014000 C:\Windows\system32\ksuser.dll
|
|
|
|
ModLoad: 739d0000 739d7000 C:\Windows\system32\AVRT.dll
|
|
|
|
ModLoad: 6f320000 6f356000 C:\Windows\system32\AUDIOSES.DLL
|
|
|
|
ModLoad: 6d9b0000 6d9b8000 C:\Windows\system32\msacm32.drv
|
|
|
|
ModLoad: 6d990000 6d9a4000 C:\Windows\system32\MSACM32.dll
|
|
|
|
ModLoad: 6d980000 6d987000 C:\Windows\system32\midimap.dll
|
|
|
|
ModLoad: 64630000 64c5f000 C:\Windows\system32\Macromed\Flash\Flash10v.ocx
|
|
|
|
ModLoad: 72c20000 72c92000 C:\Windows\system32\DSOUND.dll
|
|
|
|
ModLoad: 73b70000 73b95000 C:\Windows\system32\POWRPROF.dll
|
|
|
|
ModLoad: 72040000 720b9000 C:\Windows\system32\mscms.dll
|
|
|
|
ModLoad: 74760000 74777000 C:\Windows\system32\USERENV.dll
|
|
|
|
ModLoad: 6e1a0000 6ec20000 C:\Windows\system32\ieframe.dll
|
|
|
|
ModLoad: 778e0000 778e5000 C:\Windows\system32\PSAPI.DLL
|
|
|
|
ModLoad: 73710000 7374c000 C:\Windows\system32\OLEACC.dll
|
|
|
|
ModLoad: 6e1a0000 6ec20000 C:\Windows\system32\ieframe.dll
|
|
|
|
ModLoad: 778e0000 778e5000 C:\Windows\system32\PSAPI.DLL
|
|
|
|
ModLoad: 73710000 7374c000 C:\Windows\system32\OLEACC.dll
|
|
|
|
ModLoad: 73b10000 73b23000 C:\Windows\system32\dwmapi.dll
|
|
|
|
ModLoad: 73640000 73661000 C:\Windows\system32\ntmarta.dll
|
|
|
|
ModLoad: 76200000 76245000 C:\Windows\system32\WLDAP32.dll
|
|
|
|
ModLoad: 74ff0000 74ff8000 C:\Windows\system32\Secur32.dll
|
|
|
|
ModLoad: 74880000 74888000 C:\Windows\system32\credssp.dll
|
|
|
|
ModLoad: 749c0000 749fa000 C:\Windows\system32\schannel.DLL
|
|
|
|
ModLoad: 734d0000 734e0000 C:\Windows\system32\NLAapi.dll
|
|
|
|
ModLoad: 739c0000 739d0000 C:\Windows\system32\napinsp.dll
|
|
|
|
ModLoad: 73990000 739a2000 C:\Windows\system32\pnrpnsp.dll
|
|
|
|
ModLoad: 738f0000 738fd000 C:\Windows\system32\wshbth.dll
|
|
|
|
ModLoad: 74b70000 74bac000 C:\Windows\System32\mswsock.dll
|
|
|
|
ModLoad: 738e0000 738e8000 C:\Windows\System32\winrnr.dll
|
|
|
|
ModLoad: 718d0000 71908000 C:\Windows\System32\fwpuclnt.dll
|
|
|
|
ModLoad: 714b0000 714b6000 C:\Windows\system32\rasadhlp.dll
|
|
|
|
ModLoad: 75490000 75493000 C:\Windows\system32\Normaliz.dll
|
|
|
|
ModLoad: 75030000 7507c000 C:\Windows\system32\apphelp.dll
|
|
|
|
ModLoad: 74690000 74695000 C:\Windows\System32\wshtcpip.dll
|
|
|
|
ModLoad: 74b60000 74b66000 C:\Windows\System32\wship6.dll
|
|
|
|
ModLoad: 6b140000 6b16e000 C:\Windows\system32\MLANG.dll
|
|
|
|
ModLoad: 72390000 7294c000 C:\Windows\System32\mshtml.dll
|
|
|
|
ModLoad: 70fe0000 7100a000 C:\Windows\System32\msls31.dll
|
|
|
|
ModLoad: 72ec0000 72ecb000 C:\Windows\system32\ImgUtil.dll
|
|
|
|
ModLoad: 6b9d0000 6ba82000 C:\Windows\system32\jscript.dll
|
|
|
|
ModLoad: 72d70000 72d7e000 C:\Windows\System32\pngfilt.dll
|
|
|
|
ModLoad: 72f80000 72f8b000 C:\Windows\system32\msimtf.dll
|
|
|
|
ModLoad: 73670000 73675000 C:\Windows\system32\msimg32.dll
|
|
|
|
ModLoad: 69340000 694b7000 C:\Windows\system32\quartz.dll
|
|
|
|
ModLoad: 04700000 0472f000 C:\Program Files\GRETECH\GomPlayer\GRFU.ax
|
|
|
|
ModLoad: 6a450000 6a613000 C:\Windows\system32\d3d9.dll
|
|
|
|
ModLoad: 71360000 71366000 C:\Windows\system32\d3d8thk.dll
|
|
|
|
ModLoad: 68dc0000 68ea7000 C:\Windows\system32\DDRAW.dll
|
|
|
|
ModLoad: 712f0000 712f6000 C:\Windows\system32\DCIMAN32.dll
|
|
|
|
ModLoad: 04c80000 04d11000 C:\Windows\system32\igdumdx32.dll
|
|
|
|
ModLoad: 07e40000 08311000 C:\Windows\system32\igdumd32.dll
|
|
|
|
ModLoad: 04c80000 04d11000 C:\Windows\system32\igdumdx32.dll
|
|
|
|
ModLoad: 07e40000 08311000 C:\Windows\system32\igdumd32.dll
|
|
|
|
ModLoad: 6c770000 6c788000 C:\Windows\system32\DXVA2.DLL
|
|
|
|
ModLoad: 685c0000 68678000 C:\Program Files\GRETECH\GomPlayer\GVF.ax
|
|
|
|
ModLoad: 0a340000 0a4ac000 C:\Program Files\GRETECH\GomPlayer\GAF.ax
|
|
|
|
ModLoad: 04c80000 04d11000 C:\Windows\system32\igdumdx32.dll
|
|
|
|
ModLoad: 07e40000 08311000 C:\Windows\system32\igdumd32.dll
|
|
|
|
ModLoad: 04c80000 04d11000 C:\Windows\system32\igdumdx32.dll
|
|
|
|
ModLoad: 07e40000 08311000 C:\Windows\system32\igdumd32.dll
|
|
|
|
ModLoad: 6c770000 6c788000 C:\Windows\system32\DXVA2.DLL
|
|
|
|
(668.151c): Stack overflow - code c00000fd (first chance)
|
|
|
|
First chance exceptions are reported before any exception handling.
|
|
|
|
This exception may be expected and handled.
|
|
|
|
eax=0075747c ebx=0085447a ecx=00032608 edx=0656002e esi=0012f650
|
|
edi=0656002c
|
|
|
|
eip=00525cb7 esp=0012f600 ebp=0012f618 iopl=0 nv up ei pl nz na po
|
|
nc
|
|
|
|
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
|
|
efl=00210202
|
|
|
|
*** ERROR: Module load completed but symbols could not be loaded for
|
|
GomU.exe
|
|
|
|
GomU+0x125cb7:
|
|
|
|
00525cb7 8501 test dword ptr [ecx],eax
|
|
ds:0023:00032608=00000000
|
|
|
|
|
|
Risk:
|
|
|
|
=====
|
|
|
|
The security risk of the buffer overflow vulnerability is estimated as
|
|
high(-).
|
|
|
|
|
|
|
|
Credits:
|
|
|
|
========
|
|
|
|
Ucha Gobejishvili ( longrifle0x)
|
|
|
|
|
|
Video Demonstration: http://www.youtube.com/watch?v=uN87KAm53Zg |