Introduction:
=============
GOM Player (Gretech Online Movie Player) is a 32/64-bit media player for
Microsoft Windows, distributed by the Gretech Corporation of South Korea.
It is the primary client player for South Korean GOM-TV, and is more
popular in South Korea than any other media player. Key strengths inherited
from libavcodec include wide ranging ability to play media files, including
.flv - without needing to obtain an external codec, and the ability to play
some broken media files. Both of those features are present in other
projects using libavcodec like VLC and MPlayer, but are absent from some
other media software, including Windows Media Player.
Abstract:
=========
The Vulnerability Laboratory Research Team discovered a Buffer Overflow
Vulnerability on GOM Media Player v. 2.1.37
Exploitation-Technique:
=======================
Local
Severity:
=========
High
Vulnerable Module(s):
                                                [+] GomU+0x125cb7
Proof of Concept=================
The vulnerability can be exploited by local & remote attackers.
1) Download & open the software client
2) Click open ==> Url..
3) Put vulnerability code
4) now you will see result
Executable search path is:
ModLoad: 00400000 007a9000   GomU.exe
ModLoad: 77790000 778cc000   ntdll.dll
ModLoad: 76730000 76804000   C:\Windows\system32\kernel32.dll
ModLoad: 75380000 753ca000   C:\Windows\system32\KERNELBASE.dll
ModLoad: 70cf0000 70d22000   C:\Windows\system32\WINMM.dll
ModLoad: 76aa0000 76b4c000   C:\Windows\system32\msvcrt.dll
ModLoad: 765e0000 766a9000   C:\Windows\system32\USER32.dll
ModLoad: 760f0000 7613e000   C:\Windows\system32\GDI32.dll
ModLoad: 76590000 7659a000   C:\Windows\system32\LPK.dll
ModLoad: 76810000 768ad000   C:\Windows\system32\USP10.dll
ModLoad: 766b0000 7672b000   C:\Windows\system32\comdlg32.dll
ModLoad: 761a0000 761f7000   C:\Windows\system32\SHLWAPI.dll
ModLoad: 74070000 7420e000
C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\COMCTL32.dll
ModLoad: 754a0000 760ea000   C:\Windows\system32\SHELL32.dll
ModLoad: 71380000 713d1000   C:\Windows\system32\WINSPOOL.DRV
ModLoad: 76250000 762f0000   C:\Windows\system32\ADVAPI32.dll
ModLoad: 768b0000 768c9000   C:\Windows\SYSTEM32\sechost.dll
ModLoad: 76b70000 76c11000   C:\Windows\system32\RPCRT4.dll
ModLoad: 6d8e0000 6d8fc000   C:\Windows\system32\oledlg.dll
ModLoad: 762f0000 7644c000   C:\Windows\system32\ole32.dll
ModLoad: 72dc0000 72dd9000   C:\Windows\system32\OLEPRO32.DLL
ModLoad: 76c20000 76caf000   C:\Windows\system32\OLEAUT32.dll
ModLoad: 768d0000 76a6d000   C:\Windows\system32\SETUPAPI.dll
ModLoad: 752a0000 752c7000   C:\Windows\system32\CFGMGR32.dll
ModLoad: 75360000 75372000   C:\Windows\system32\DEVOBJ.dll
ModLoad: 74600000 74609000   C:\Windows\system32\VERSION.dll
ModLoad: 76f80000 77075000   C:\Windows\system32\WININET.dll
ModLoad: 76450000 76587000   C:\Windows\system32\urlmon.dll
ModLoad: 75180000 7529d000   C:\Windows\system32\CRYPT32.dll
ModLoad: 75170000 7517c000   C:\Windows\system32\MSASN1.dll
ModLoad: 76d80000 76f7e000   C:\Windows\system32\iertutil.dll
ModLoad: 765a0000 765d5000   C:\Windows\system32\WS2_32.dll
ModLoad: 778d0000 778d6000   C:\Windows\system32\NSI.dll
ModLoad: 76b50000 76b6f000   C:\Windows\system32\IMM32.dll
ModLoad: 76cb0000 76d7c000   C:\Windows\system32\MSCTF.dll
ModLoad: 71fa0000 71fbc000   C:\Windows\system32\iphlpapi.dll
ModLoad: 71f90000 71f97000   C:\Windows\system32\WINNSI.DLL
(668.151c): Break instruction exception - code 80000003 (first chance)
eax=00000000 ebx=00000000 ecx=0012fb08 edx=777d7094 esi=fffffffe
edi=00000000
eip=7783054e esp=0012fb24 ebp=0012fb50 iopl=0         nv up ei pl zr na pe
nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000
efl=00000246
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for
ntdll.dll -
ntdll!LdrVerifyImageMatchesChecksum+0x633:
7783054e cc              int     3
0:000> g
ModLoad: 73ef0000 73f30000   C:\Windows\system32\uxtheme.dll
ModLoad: 75080000 7508c000   C:\Windows\system32\CRYPTBASE.dll
ModLoad: 10000000 100d3000   C:\Program
Files\GRETECH\GomPlayer\lang\GomENG.dll
ModLoad: 75010000 7502b000   C:\Windows\system32\SspiCli.dll
ModLoad: 75100000 7510b000   C:\Windows\system32\profapi.dll
ModLoad: 74a30000 74a74000   C:\Windows\system32\dnsapi.DLL
ModLoad: 73780000 737d2000   C:\Windows\system32\RASAPI32.dll
ModLoad: 73760000 73775000   C:\Windows\system32\rasman.dll
ModLoad: 73750000 7375d000   C:\Windows\system32\rtutils.dll
ModLoad: 6f050000 6f056000   C:\Windows\system32\sensapi.dll
ModLoad: 75400000 75483000   C:\Windows\system32\CLBCatQ.DLL
ModLoad: 74bb0000 74bc6000   C:\Windows\system32\CRYPTSP.dll
ModLoad: 74950000 7498b000   C:\Windows\system32\rsaenh.dll
ModLoad: 750f0000 750fe000   C:\Windows\system32\RpcRtRemote.dll
ModLoad: 01fb0000 0201a000   C:\Program
Files\GRETECH\GomPlayer\GomTVStrm.dll
ModLoad: 73b30000 73b69000   C:\Windows\system32\MMDevAPI.DLL
ModLoad: 73f30000 74025000   C:\Windows\system32\PROPSYS.dll
ModLoad: 6f020000 6f050000   C:\Windows\system32\wdmaud.drv
ModLoad: 6f010000 6f014000   C:\Windows\system32\ksuser.dll
ModLoad: 739d0000 739d7000   C:\Windows\system32\AVRT.dll
ModLoad: 6f320000 6f356000   C:\Windows\system32\AUDIOSES.DLL
ModLoad: 6d9b0000 6d9b8000   C:\Windows\system32\msacm32.drv
ModLoad: 6d990000 6d9a4000   C:\Windows\system32\MSACM32.dll
ModLoad: 6d980000 6d987000   C:\Windows\system32\midimap.dll
ModLoad: 64630000 64c5f000   C:\Windows\system32\Macromed\Flash\Flash10v.ocx
ModLoad: 72c20000 72c92000   C:\Windows\system32\DSOUND.dll
ModLoad: 73b70000 73b95000   C:\Windows\system32\POWRPROF.dll
ModLoad: 72040000 720b9000   C:\Windows\system32\mscms.dll
ModLoad: 74760000 74777000   C:\Windows\system32\USERENV.dll
ModLoad: 6e1a0000 6ec20000   C:\Windows\system32\ieframe.dll
ModLoad: 778e0000 778e5000   C:\Windows\system32\PSAPI.DLL
ModLoad: 73710000 7374c000   C:\Windows\system32\OLEACC.dll
ModLoad: 6e1a0000 6ec20000   C:\Windows\system32\ieframe.dll
ModLoad: 778e0000 778e5000   C:\Windows\system32\PSAPI.DLL
ModLoad: 73710000 7374c000   C:\Windows\system32\OLEACC.dll
ModLoad: 73b10000 73b23000   C:\Windows\system32\dwmapi.dll
ModLoad: 73640000 73661000   C:\Windows\system32\ntmarta.dll
ModLoad: 76200000 76245000   C:\Windows\system32\WLDAP32.dll
ModLoad: 74ff0000 74ff8000   C:\Windows\system32\Secur32.dll
ModLoad: 74880000 74888000   C:\Windows\system32\credssp.dll
ModLoad: 749c0000 749fa000   C:\Windows\system32\schannel.DLL
ModLoad: 734d0000 734e0000   C:\Windows\system32\NLAapi.dll
ModLoad: 739c0000 739d0000   C:\Windows\system32\napinsp.dll
ModLoad: 73990000 739a2000   C:\Windows\system32\pnrpnsp.dll
ModLoad: 738f0000 738fd000   C:\Windows\system32\wshbth.dll
ModLoad: 74b70000 74bac000   C:\Windows\System32\mswsock.dll
ModLoad: 738e0000 738e8000   C:\Windows\System32\winrnr.dll
ModLoad: 718d0000 71908000   C:\Windows\System32\fwpuclnt.dll
ModLoad: 714b0000 714b6000   C:\Windows\system32\rasadhlp.dll
ModLoad: 75490000 75493000   C:\Windows\system32\Normaliz.dll
ModLoad: 75030000 7507c000   C:\Windows\system32\apphelp.dll
ModLoad: 74690000 74695000   C:\Windows\System32\wshtcpip.dll
ModLoad: 74b60000 74b66000   C:\Windows\System32\wship6.dll
ModLoad: 6b140000 6b16e000   C:\Windows\system32\MLANG.dll
ModLoad: 72390000 7294c000   C:\Windows\System32\mshtml.dll
ModLoad: 70fe0000 7100a000   C:\Windows\System32\msls31.dll
ModLoad: 72ec0000 72ecb000   C:\Windows\system32\ImgUtil.dll
ModLoad: 6b9d0000 6ba82000   C:\Windows\system32\jscript.dll
ModLoad: 72d70000 72d7e000   C:\Windows\System32\pngfilt.dll
ModLoad: 72f80000 72f8b000   C:\Windows\system32\msimtf.dll
ModLoad: 73670000 73675000   C:\Windows\system32\msimg32.dll
ModLoad: 69340000 694b7000   C:\Windows\system32\quartz.dll
ModLoad: 04700000 0472f000   C:\Program Files\GRETECH\GomPlayer\GRFU.ax
ModLoad: 6a450000 6a613000   C:\Windows\system32\d3d9.dll
ModLoad: 71360000 71366000   C:\Windows\system32\d3d8thk.dll
ModLoad: 68dc0000 68ea7000   C:\Windows\system32\DDRAW.dll
ModLoad: 712f0000 712f6000   C:\Windows\system32\DCIMAN32.dll
ModLoad: 04c80000 04d11000   C:\Windows\system32\igdumdx32.dll
ModLoad: 07e40000 08311000   C:\Windows\system32\igdumd32.dll
ModLoad: 04c80000 04d11000   C:\Windows\system32\igdumdx32.dll
ModLoad: 07e40000 08311000   C:\Windows\system32\igdumd32.dll
ModLoad: 6c770000 6c788000   C:\Windows\system32\DXVA2.DLL
ModLoad: 685c0000 68678000   C:\Program Files\GRETECH\GomPlayer\GVF.ax
ModLoad: 0a340000 0a4ac000   C:\Program Files\GRETECH\GomPlayer\GAF.ax
ModLoad: 04c80000 04d11000   C:\Windows\system32\igdumdx32.dll
ModLoad: 07e40000 08311000   C:\Windows\system32\igdumd32.dll
ModLoad: 04c80000 04d11000   C:\Windows\system32\igdumdx32.dll
ModLoad: 07e40000 08311000   C:\Windows\system32\igdumd32.dll
ModLoad: 6c770000 6c788000   C:\Windows\system32\DXVA2.DLL
(668.151c): Stack overflow - code c00000fd (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=0075747c ebx=0085447a ecx=00032608 edx=0656002e esi=0012f650
edi=0656002c
eip=00525cb7 esp=0012f600 ebp=0012f618 iopl=0         nv up ei pl nz na po
nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000
efl=00210202
*** ERROR: Module load completed but symbols could not be loaded for
GomU.exe
GomU+0x125cb7:
00525cb7 8501            test    dword ptr [ecx],eax
 ds:0023:00032608=00000000
Risk:
=====
The security risk of the buffer overflow vulnerability is estimated as
high(-).
Credits:
========
Ucha Gobejishvili ( longrifle0x)
Video Demonstration: http://www.youtube.com/watch?v=uN87KAm53Zg