CVE-2017-8869

This repository contains a single Metasploit module (modules/exploits/windows/fileformat/mediacoder_m3u.rb) that exploits a buffer overflow vulnerability (CVE-2017-8869) in MediaCoder versions 0.8.21 to 0.8.22 on Windows XP SP3 and Windows 7 SP0. The exploit works by generating a specially crafted .m3u playlist file containing a payload and a ROP chain to bypass DEP on Windows 7. When a user opens this file in a vulnerable version of MediaCoder, arbitrary code execution is achieved under the context of the user. The module allows for customizable payloads (up to 1200 bytes) and leverages a series of ROP gadgets from various DLLs to achieve code execution. The attack vector is local, requiring user interaction to open the malicious file. No network endpoints are involved; the main fingerprintable artifact is the malicious .m3u file. The code is operational and ready for use within the Metasploit framework.

This repository contains an exploit for CVE-2017-8869, targeting MediaCoder version 0.8.48.5888 on Windows. The exploit is implemented in Python (mediacoder-exploit.py) and generates a malicious .m3u playlist file (final.m3u) designed to trigger a local buffer overflow via SEH (Structured Exception Handler) overwrite when opened in the vulnerable application. The exploit includes a reverse shell payload (generated with msfvenom) that connects back to a specified attacker's IP and port. The README provides a brief description of the exploit and its capabilities. The repository is structured simply, with one code file and a README, and is operational, providing a working exploit with a functional payload.