‘MP3 TAG Fuzzer’

Summary

Credit:

‘The information has been provided by Jeremy Brown.’


Details

‘The following tool will generate invalid MP3 files which in turn can be used to test different types of software for MP3 handling related vulnerabilities.

Tool:
#!/usr/bin/perl
# Jeremy Brown [0xjbrown41@gmail.com/jbrownsec.blogspot.com]
# mpTREY – MP3 Fuzzer [MP3::TAG –> INSTALL IT FROM CPAN]
# ROFFLES SUPERCALIMP3OWNAGE =)

use MP3::Tag;
use Getopt::Std;

@overflow = (‘A’ x 8200, ‘A’ x 11000, ‘A’ x 110000, ‘A’ x 550000, ‘A’ x 1100000, ‘A’ x 2200000, ‘A’ x 12000000, ‘x99’ x 1200);

@fmtstring = (‘%n%n%n%n%n’, ‘%p%p%p%p%p’, ‘%s%s%s%s%s’, ‘%d%d%d%d%d’, ‘%x%x%x%x%x’,
              ‘%s%p%x%d’, ‘%.1024d’, ‘%.1025d’, ‘%.2048d’, ‘%.2049d’, ‘%.4096d’, ‘%.4097d’,
              ‘%99999999999s’, ‘%08x’, ‘%%20n’, ‘%%20p’, ‘%%20s’, ‘%%20d’, ‘%%20x’,
              ‘%#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%’, ‘xCD’ x 50, ‘xCB’ x 50);

@numbers = (‘0’, ‘-0’, ‘1’, ‘-1’, ‘32767’, ‘-32768’, ‘2147483647’, ‘-2147483647’, ‘2147483648’, ‘-2147483648’,
            ‘4294967294’, ‘4294967295’, ‘4294967296’, ‘357913942’, ‘-357913942’, ‘536870912’, ‘-536870912’,
            ‘1.79769313486231E+308’, ‘3.39519326559384E-313’, ‘99999999999’, ‘-99999999999’, ‘0x100’, ‘0x1000’,
            ‘0x3fffffff’, ‘0x7ffffffe’, ‘0x7fffffff’, ‘0x80000000’, ‘0xffff’, ‘0xfffffffe’, ‘0xfffffff’, ‘0xffffffff’,
            ‘0x10000’, ‘0x100000’, ‘0x99999999’, ‘65535’, ‘65536’, ‘65537’, ‘16777215’, ‘16777216’, ‘16777217’, ‘-268435455’);

@miscbugs = (‘test|touch /tmp/ZfZ-PWNED|test’, ‘test`touch /tmp/ZfZ-PWNED`test’, ‘test’touch /tmp/ZfZ-PWNED’test’, ‘test;touch /tmp/ZfZ-PWNED;test’,
             ‘test&&touch /tmp/ZfZ-PWNED&&test’, ‘test|C:/WINDOWS/system32/calc.exe|test’, ‘test`C:/WINDOWS/system32/calc.exe`test’,
             ‘test’C:/WINDOWS/system32/calc.exe’test’, ‘test;C:/WINDOWS/system32/calc.exe;test’, ‘/bin/sh’, ‘C:/WINDOWS/system32/calc.exe’,
             ‘%0xa’, ‘%u000’, ‘//AAAA’ x 250, ‘\AAAA’ x 250);

getopts(‘t:f:’, %opts);
$target = $opts{‘t’};
$mp3file = $opts{‘f’};

if(!defined($target) || !defined($mp3file))
{
     print ‘n mpTREY – mp3 fuZZer’;
     print ‘nJeremy Brown [0xjbrown41@gmail.com/http://jbrownsec.blogspot.com]’;
     print ‘n Usage: $0 -t <targetapp> -f <file.mp3>nn’;
     exit(0);

}

     print ‘n mpTREY – mp3 fuZZer’;
     print ‘nJeremy Brown [0xjbrown41@gmail.com/http://jbrownsec.blogspot.com]n’;

print ‘nmpTREY: FUZZING ‘$target’ with ‘$mp3file’ [STAGE->1(title)]’;

print ‘n’;
foreach(@overflow) { $fuzz = $_;
$mp3 = MP3::Tag->new($mp3file);
$mp3->title_set($fuzz);
$mp3->update_tags();
$mp3->close();
system $target $mp3file;
}
foreach(@fmtstring) { $fuzz = $_;
$mp3 = MP3::Tag->new($mp3file);
$mp3->title_set($fuzz);
$mp3->update_tags();
$mp3->close();
system $target $mp3file;
}
foreach(@miscbugs) { $fuzz = $_;
$mp3 = MP3::Tag->new($mp3file);
$mp3->title_set($fuzz);
$mp3->update_tags();
$mp3->close();
system $target $mp3file;
}

print ‘mpTREY: FUZZING ‘$target’ with ‘$mp3file’ [STAGE->2(artist)]’;

print ‘n’;
foreach(@overflow) { $fuzz = $_;
$mp3 = MP3::Tag->new($mp3file);
$mp3->title_set(‘normal’); # set normal currenttag-1
$mp3->artist_set($fuzz);
$mp3->update_tags();
$mp3->close();
system $target $mp3file;
}
foreach(@fmtstring) { $fuzz = $_;
$mp3 = MP3::Tag->new($mp3file);
$mp3->artist_set($fuzz);
$mp3->update_tags();
$mp3->close();
system $target $mp3file;
}
foreach(@miscbugs) { $fuzz = $_;
$mp3 = MP3::Tag->new($mp3file);
$mp3->artist_set($fuzz);
$mp3->update_tags();
$mp3->close();
system $target $mp3file;
}

print ‘mpTREY: FUZZING ‘$target’ with ‘$mp3file’ [STAGE->3(album)]’;

print ‘n’;
foreach(@overflow) { $fuzz = $_;
$mp3 = MP3::Tag->new($mp3file);
$mp3->artist_set(‘normal’); # set currenttag-1 back to ‘normal’
$mp3->album_set($fuzz);
$mp3->update_tags();
$mp3->close();
system $target $mp3file;
}
foreach(@fmtstring) { $fuzz = $_;
$mp3 = MP3::Tag->new($mp3file);
$mp3->album_set($fuzz);
$mp3->update_tags();
$mp3->close();
system $target $mp3file;
}
foreach(@miscbugs) { $fuzz = $_;
$mp3 = MP3::Tag->new($mp3file);
$mp3->album_set($fuzz);
$mp3->update_tags();
$mp3->close();
system $target $mp3file;
}

print ‘mpTREY: FUZZING ‘$target’ with ‘$mp3file’ [STAGE->4(year)]’;

print ‘n’;
foreach(@fmtstring) { $fuzz = $_;
$mp3 = MP3::Tag->new($mp3file);
$mp3->album_set(‘normal’); # set currenttag-1 back to ‘normal’
$mp3->year_set($fuzz);
$mp3->update_tags();
$mp3->close();
system $target $mp3file;
}
foreach(@numbers) { $fuzz = $_;
$mp3 = MP3::Tag->new($mp3file);
$mp3->year_set($fuzz);
$mp3->update_tags();
$mp3->close();
system $target $mp3file;
}

print ‘mpTREY: FUZZING ‘$target’ with ‘$mp3file’ [STAGE->5(comment)]’;

print ‘n’;
foreach(@overflow) { $fuzz = $_;
$mp3 = MP3::Tag->new($mp3file);
$mp3->year_set(‘1’); # set currenttag-1 back to ‘normal’
$mp3->comment_set($fuzz);
$mp3->update_tags();
$mp3->close();
system $target $mp3file;
}
foreach(@fmtstring) { $fuzz = $_;
$mp3 = MP3::Tag->new($mp3file);
$mp3->comment_set($fuzz);
$mp3->update_tags();
$mp3->close();
system $target $mp3file;
}
foreach(@miscbugs) { $fuzz = $_;
$mp3 = MP3::Tag->new($mp3file);
$mp3->comment_set($fuzz);
$mp3->update_tags();
$mp3->close();
system $target $mp3file;
}

print ‘mpTREY: FUZZING ‘$target’ with ‘$mp3file’ [STAGE->6(track)]’;

print ‘n’;
foreach(@overflow) { $fuzz = $_;
$mp3 = MP3::Tag->new($mp3file);
$mp3->comment_set(‘normal’); # set currenttag-1 back to ‘normal’
$mp3->track_set($fuzz);
$mp3->update_tags();
$mp3->close();
system $target $mp3file;
}
foreach(@fmtstring) { $fuzz = $_;
$mp3 = MP3::Tag->new($mp3file);
$mp3->track_set($fuzz);
$mp3->update_tags();
$mp3->close();
system $target $mp3file;
}
foreach(@numbers) { $fuzz = $_;
$mp3 = MP3::Tag->new($mp3file);
$mp3->track_set($fuzz);
$mp3->update_tags();
$mp3->close();
system $target $mp3file;
}
foreach(@miscbugs) { $fuzz = $_;
$mp3 = MP3::Tag->new($mp3file);
$mp3->track_set($fuzz);
$mp3->update_tags();
$mp3->close();
system $target $mp3file;
}

print ‘mpTREY: FUZZING ‘$target’ with ‘$mp3file’ [STAGE->7(genre)]’;

print ‘n’;
foreach(@overflow) { $fuzz = $_;
$mp3 = MP3::Tag->new($mp3file);
$mp3->track_set(‘1’); # set currenttag-1 back to ‘normal’
$mp3->genre_set($fuzz);
$mp3->update_tags();
$mp3->close();
system $target $mp3file;
}
foreach(@fmtstring) { $fuzz = $_;
$mp3 = MP3::Tag->new($mp3file);
$mp3->genre_set($fuzz);
$mp3->update_tags();
$mp3->close();
system $target $mp3file;
}
foreach(@miscbugs) { $fuzz = $_;
$mp3 = MP3::Tag->new($mp3file);
$mp3->genre_set($fuzz);
$mp3->update_tags();
$mp3->close();
system $target $mp3file;
}
print ‘n’;

exit;’

Categories: Tools