ed0e1e4d44
1979 changes to exploits/shellcodes Couchdb 1.5.0 - 'uuids' Denial of Service Apache CouchDB 1.5.0 - 'uuids' Denial of Service Beyond Remote 2.2.5.3 - Denial of Service (PoC) udisks2 2.8.0 - Denial of Service (PoC) Termite 3.4 - Denial of Service (PoC) SoftX FTP Client 3.3 - Denial of Service (PoC) Silverstripe 2.3.5 - Cross-Site Request Forgery / Open redirection SilverStripe CMS 2.3.5 - Cross-Site Request Forgery / Open Redirection Silverstripe CMS 3.0.2 - Multiple Vulnerabilities SilverStripe CMS 3.0.2 - Multiple Vulnerabilities Silverstripe CMS 2.4 - File Renaming Security Bypass SilverStripe CMS 2.4 - File Renaming Security Bypass Silverstripe CMS 2.4.5 - Multiple Cross-Site Scripting Vulnerabilities SilverStripe CMS 2.4.5 - Multiple Cross-Site Scripting Vulnerabilities Silverstripe CMS 2.4.7 - 'install.php' PHP Code Injection SilverStripe CMS 2.4.7 - 'install.php' PHP Code Injection Silverstripe Pixlr Image Editor - 'upload.php' Arbitrary File Upload SilverStripe CMS Pixlr Image Editor - 'upload.php' Arbitrary File Upload Silverstripe CMS 2.4.x - 'BackURL' Open Redirection SilverStripe CMS 2.4.x - 'BackURL' Open Redirection Silverstripe CMS - 'MemberLoginForm.php' Information Disclosure SilverStripe CMS - 'MemberLoginForm.php' Information Disclosure Silverstripe CMS - Multiple HTML Injection Vulnerabilities SilverStripe CMS - Multiple HTML Injection Vulnerabilities Apache CouchDB 1.7.0 and 2.x before 2.1.1 - Remote Privilege Escalation Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation Monstra CMS before 3.0.4 - Cross-Site Scripting Monstra CMS < 3.0.4 - Cross-Site Scripting (2) Monstra CMS < 3.0.4 - Cross-Site Scripting Monstra CMS < 3.0.4 - Cross-Site Scripting (1) Navigate CMS 2.8 - Cross-Site Scripting Collectric CMU 1.0 - 'lang' SQL injection Joomla! Component CW Article Attachments 1.0.6 - 'id' SQL Injection LG SuperSign EZ CMS 2.5 - Remote Code Execution MyBB Visual Editor 1.8.18 - Cross-Site Scripting Joomla! Component AMGallery 1.2.3 - 'filter_category_id' SQL Injection Joomla! Component Micro Deal Factory 2.4.0 - 'id' SQL Injection RICOH Aficio MP 301 Printer - Cross-Site Scripting Joomla! Component Auction Factory 4.5.5 - 'filter_order' SQL Injection RICOH MP C6003 Printer - Cross-Site Scripting Linux/ARM - Egghunter (PWN!) + execve(_/bin/sh__ NULL_ NULL) Shellcode (28 Bytes) Linux/ARM - sigaction() Based Egghunter (PWN!) + execve(_/bin/sh__ NULL_ NULL) Shellcode (52 Bytes)
118 lines
No EOL
6.1 KiB
Text
118 lines
No EOL
6.1 KiB
Text
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=820
|
|
|
|
When parsing executables packed by an early version of aspack, a buffer overflow can occur in the core Symantec Antivirus Engine used in most Symantec and Norton branded Antivirus products. The problem occurs when section data is truncated, that is, when SizeOfRawData is greater than SizeOfImage.
|
|
|
|
This is a remote code execution vulnerability. Because Symantec use a filter driver to intercept all system I/O, just emailing a file to a victim or sending them a link is enough to exploit it.
|
|
|
|
On Linux, Mac and other UNIX platforms, this results in a remote heap overflow as root in the Symantec or Norton process. On Windows, this results in kernel memory corruption, as the scan engine is loaded into the kernel (wtf!!!), making this a remote ring0 memory corruption vulnerability - this is about as bad as it can possibly get.
|
|
|
|
The obvious way to exploit this flaw is either via email or a web browser. The attached testcase contains the source code to build a PoC, which should BugCheck (i.e. BSOD) a system with Norton Antivirus installed, or crash Symantec Enterprise Endpoint service.
|
|
|
|
The file testcase.txt is a prebuilt binary (note that file extension is irrelevant here). Just clicking download should be enough to trigger a kernel panic on a vulnerable system (!!!).
|
|
|
|
When this file touches disk, Symantec will allocate SizeOfImage bytes and then memcpy all available data into the buffer from the truncated section resulting in heap or pool corruption. Effectively, we can get Symantec to execute a sequence like this:
|
|
|
|
char *buf = malloc(SizeOfImage);
|
|
|
|
memcpy(&buf[DataSection->VirtualAddress],
|
|
DataSection->PointerToRawData,
|
|
SectionSizeOnDisk);
|
|
|
|
All of these values, and all the data is under attacker control, making this a very clean overflow. Because this vulnerability exists in the core scan engine, the majority of Symantec products are vulnerable, this includes:
|
|
|
|
* Symantec Endpoint Antivirus (All platforms)
|
|
* Norton Antivirus (All platforms)
|
|
* Symantec Scan Engine (All platforms)
|
|
* Symantec Email Security (All platforms)
|
|
* ..and probably all other Symantec Antivirus products.
|
|
|
|
On Windows with Symantec Endpoint Antivirus, this vulnerability permits code execution as NT AUTHORITY\SYSTEM in the ccSvcHost.exe process. On Norton Antivirus for Windows, this code is loaded into the kernel and results kernel pool corruption.
|
|
|
|
1: kd> !analyze -v
|
|
*******************************************************************************
|
|
* *
|
|
* Bugcheck Analysis *
|
|
* *
|
|
*******************************************************************************
|
|
|
|
PAGE_FAULT_IN_NONPAGED_AREA (50)
|
|
Invalid system memory was referenced. This cannot be protected by try-except,
|
|
it must be protected by a Probe. Typically the address is just plain bad or it
|
|
is pointing at freed memory.
|
|
Arguments:
|
|
Arg1: 9e45c000, memory referenced.
|
|
Arg2: 00000001, value 0 = read operation, 1 = write operation.
|
|
Arg3: 82a81ff3, If non-zero, the instruction address which referenced the bad memory
|
|
address.
|
|
Arg4: 00000000, (reserved)
|
|
|
|
Debugging Details:
|
|
------------------
|
|
|
|
|
|
WRITE_ADDRESS: 9e45c000 Paged pool
|
|
|
|
FAULTING_IP:
|
|
nt!memcpy+33
|
|
82a81ff3 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
|
|
|
|
MM_INTERNAL_CODE: 0
|
|
|
|
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
|
|
|
|
BUGCHECK_STR: 0x50
|
|
|
|
PROCESS_NAME: NS.exe
|
|
|
|
CURRENT_IRQL: 2
|
|
|
|
ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) x86fre
|
|
|
|
TRAP_FRAME: 9abd2094 -- (.trap 0xffffffff9abd2094)
|
|
ErrCode = 00000002
|
|
eax=b0849800 ebx=00010000 ecx=00001201 edx=00000000 esi=b0844ffc edi=9e45c000
|
|
eip=82a81ff3 esp=9abd2108 ebp=9abd2110 iopl=0 nv up ei pl nz ac po nc
|
|
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010212
|
|
nt!memcpy+0x33:
|
|
82a81ff3 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
|
|
Resetting default scope
|
|
|
|
LAST_CONTROL_TRANSFER: from 82b28ce7 to 82ac4308
|
|
1: kd> .trap 0xffffffff9abd2094
|
|
ErrCode = 00000002
|
|
eax=b0849800 ebx=00010000 ecx=00001201 edx=00000000 esi=b0844ffc edi=9e45c000
|
|
eip=82a81ff3 esp=9abd2108 ebp=9abd2110 iopl=0 nv up ei pl nz ac po nc
|
|
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010212
|
|
nt!memcpy+0x33:
|
|
82a81ff3 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
|
|
1: kd> db esi
|
|
b0844ffc 54 65 73 74 69 6e 67 53-79 6d 61 6e 74 65 63 45 TestingSymantecE
|
|
b084500c 78 70 6c 6f 69 74 54 65-73 74 69 6e 67 53 79 6d xploitTestingSym
|
|
b084501c 61 6e 74 65 63 45 78 70-6c 6f 69 74 54 65 73 74 antecExploitTest
|
|
b084502c 69 6e 67 53 79 6d 61 6e-74 65 63 45 78 70 6c 6f ingSymantecExplo
|
|
b084503c 69 74 54 65 73 74 69 6e-67 53 79 6d 61 6e 74 65 itTestingSymante
|
|
b084504c 63 45 78 70 6c 6f 69 74-54 65 73 74 69 6e 67 53 cExploitTestingS
|
|
b084505c 79 6d 61 6e 74 65 63 45-78 70 6c 6f 69 74 54 65 ymantecExploitTe
|
|
b084506c 73 74 69 6e 67 53 79 6d-61 6e 74 65 63 45 78 70 stingSymantecExp
|
|
1: kd> lmv mNAVEX15
|
|
start end module name
|
|
a1a1f000 a1bad180 NAVEX15 (no symbols)
|
|
Loaded symbol image file: NAVEX15.SYS
|
|
Image path: \??\C:\Program Files\Norton Security\NortonData\22.6.0.142\Definitions\VirusDefs\20160506.004\NAVEX15.SYS
|
|
Image name: NAVEX15.SYS
|
|
Timestamp: Tue Oct 13 17:32:30 2015 (561DA29E)
|
|
CheckSum: 00195B98
|
|
ImageSize: 0018E180
|
|
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
|
|
|
|
The testcase attached produces an executable like this:
|
|
|
|
NAME RVA VSZ RAW_SZ RAW_PTR nREL REL_PTR nLINE LINE_PTR FLAGS
|
|
.data fff8 0 ffffffff 2000 0 0 0 0 0 ---
|
|
.text fff8 0 1000 1000 0 0 0 0 0 ---
|
|
|
|
Source code is included.
|
|
|
|
|
|
Proof of Concept:
|
|
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/39835.zip |