140 lines
No EOL
4.9 KiB
Text
140 lines
No EOL
4.9 KiB
Text
Source: http://aluigi.org/adv/msreader_2-adv.txt
|
|
|
|
#######################################################################
|
|
|
|
Luigi Auriemma
|
|
|
|
Application: Microsoft Reader
|
|
http://www.microsoft.com/reader
|
|
Versions: <= 2.1.1.3143 (PC version)
|
|
<= 2.6.1.7169 (Origami version)
|
|
the non-PC versions have not been tested
|
|
Platforms: Windows, Windows Mobile, Tablet PC and UMPC devices
|
|
Bug: heap overflow
|
|
Date: 11 Apr 2011
|
|
Author: Luigi Auriemma
|
|
e-mail: aluigi@autistici.org
|
|
web: aluigi.org
|
|
|
|
|
|
#######################################################################
|
|
|
|
|
|
1) Introduction
|
|
2) Bug
|
|
3) The Code
|
|
4) Fix
|
|
|
|
|
|
#######################################################################
|
|
|
|
===============
|
|
1) Introduction
|
|
===============
|
|
|
|
|
|
Microsoft Reader is a software needed to read and catalog the ebooks in
|
|
LIT format and the Audible audio books bought via internet, indeed the
|
|
homepage acts also as online store for these protected contents.
|
|
|
|
|
|
#######################################################################
|
|
|
|
======
|
|
2) Bug
|
|
======
|
|
|
|
|
|
Heap overflow caused by the allocation of a certain amount of memory
|
|
and the copying of arbitrary data during the decompression of the
|
|
sections.
|
|
|
|
A quick trace of the sum operations performed with the entry
|
|
size/offset values and then the function that performs the copying:
|
|
|
|
0107F517 |> 8B85 E0FDFFFF MOV EAX,DWORD PTR SS:[EBP-220] ; second 64bit number (entry->size)
|
|
0107F51D |. 0B85 E4FDFFFF OR EAX,DWORD PTR SS:[EBP-21C]
|
|
0107F523 |. 74 12 JE SHORT msreader.0107F537
|
|
0107F525 |. 8B46 60 MOV EAX,DWORD PTR DS:[ESI+60] ; 64bit total size
|
|
0107F528 |. 8B4E 64 MOV ECX,DWORD PTR DS:[ESI+64]
|
|
0107F52B |. 0185 D8FDFFFF ADD DWORD PTR SS:[EBP-228],EAX ; added to the first 64bit number (entry->offset)
|
|
0107F531 |. 118D DCFDFFFF ADC DWORD PTR SS:[EBP-224],ECX
|
|
0107F537 |> FF75 18 PUSH DWORD PTR SS:[EBP+18]
|
|
0107F53A |. 8D85 D8FDFFFF LEA EAX,DWORD PTR SS:[EBP-228]
|
|
0107F540 |. FF75 14 PUSH DWORD PTR SS:[EBP+14]
|
|
0107F543 |. 50 PUSH EAX
|
|
0107F544 |. FF76 74 PUSH DWORD PTR DS:[ESI+74]
|
|
0107F547 |. 56 PUSH ESI
|
|
0107F548 |. FF75 0C PUSH DWORD PTR SS:[EBP+C]
|
|
0107F54B |. E8 DEBEFEFF CALL msreader.0106B42E
|
|
...
|
|
0106B596 |. 8B71 48 MOV ESI,DWORD PTR DS:[ECX+48] ; second 64bit number (entry->size)
|
|
0106B599 |. 897D F0 MOV DWORD PTR SS:[EBP-10],EDI
|
|
0106B59C |. 13C2 ADC EAX,EDX
|
|
0106B59E |. 03F3 ADD ESI,EBX ; added to the 64bit total size
|
|
0106B5A0 |. 8975 0C MOV DWORD PTR SS:[EBP+C],ESI
|
|
0106B5A3 |. 8B71 4C MOV ESI,DWORD PTR DS:[ECX+4C]
|
|
0106B5A6 |. 1371 44 ADC ESI,DWORD PTR DS:[ECX+44]
|
|
0106B5A9 |. 5B POP EBX
|
|
0106B5AA |. 3BD6 CMP EDX,ESI
|
|
0106B5AC |. 72 1C JB SHORT msreader.0106B5CA
|
|
0106B5AE |. 77 08 JA SHORT msreader.0106B5B8
|
|
...
|
|
01092A02 /. 55 PUSH EBP ; copying function
|
|
...skip...
|
|
examples specific for the PoC msreader_2a.lit
|
|
LocalAlloc 000a6f68 = 01610020
|
|
ReadFile 000a6f68 (file offset 0x22f5d)
|
|
LocalAlloc 000a6f68 = 016c0020
|
|
DES decryption of the data read by the file with output in the second allocated buffer
|
|
memcpy esi is 016c0020
|
|
memcpy edi is 0022a008
|
|
...skip...
|
|
01092B50 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
|
|
01092B53 |. 8B55 F4 MOV EDX,DWORD PTR SS:[EBP-C]
|
|
01092B56 |. 8B7D 14 MOV EDI,DWORD PTR SS:[EBP+14]
|
|
01092B59 |. 8BCB MOV ECX,EBX
|
|
01092B5B |. 8D3410 LEA ESI,DWORD PTR DS:[EAX+EDX]
|
|
01092B5E |. 8BD1 MOV EDX,ECX
|
|
01092B60 |. C1E9 02 SHR ECX,2
|
|
01092B63 |. F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS>
|
|
|
|
The data copied in the heap buffer is exactly the one coming from the
|
|
file and decrypted with DES, that's why the bytes visible during the
|
|
copying can't be seen in the file.
|
|
|
|
I have provided two proof-of-concepts where the first shows the exact
|
|
location of the memcpy while the second will cause an exception during
|
|
the "call [ret+num]" instruction (could take some seconds to be
|
|
reached).
|
|
|
|
Modified bytes for msreader_2a.lit:
|
|
000005F6 84 40 ; from 0x230 to 0x40
|
|
000005F7 30 5F ; modified only to keep the size of the subsequent entry string
|
|
|
|
Modified bytes for msreader_2b.lit:
|
|
000005F7 30 00 ; from 0x230 to 0x200
|
|
|
|
|
|
#######################################################################
|
|
|
|
===========
|
|
3) The Code
|
|
===========
|
|
|
|
|
|
http://aluigi.org/poc/msreader_2.zip
|
|
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17161.zip
|
|
|
|
|
|
#######################################################################
|
|
|
|
======
|
|
4) Fix
|
|
======
|
|
|
|
|
|
No fix.
|
|
|
|
|
|
####################################################################### |