138 lines
No EOL
4.6 KiB
Text
138 lines
No EOL
4.6 KiB
Text
#######################################################################
|
|
|
|
Luigi Auriemma
|
|
|
|
Application: GenStat
|
|
http://www.vsni.co.uk/software/genstat/
|
|
Versions: <= 14.1.0.5943
|
|
Platforms: Windows
|
|
Bugs: A] array overflow with write2
|
|
B] heap overflow
|
|
Exploitation: file
|
|
Date: 01 Oct 2011
|
|
Author: Luigi Auriemma
|
|
e-mail: aluigi@autistici.org
|
|
web: aluigi.org
|
|
|
|
|
|
#######################################################################
|
|
|
|
|
|
1) Introduction
|
|
2) Bugs
|
|
3) The Code
|
|
4) Fix
|
|
|
|
|
|
#######################################################################
|
|
|
|
===============
|
|
1) Introduction
|
|
===============
|
|
|
|
|
|
From vendor's homepage:
|
|
"all embracing data analysis tool, offering ease of use via our
|
|
comprehensive menu system reinforced with the flexibility of a
|
|
sophisticated programming language."
|
|
"For over 30 years we have employed, and continue to work with, leading
|
|
statisticians and scientists who help to create a package that succeeds
|
|
for both novice and expert users in academia, research and industry."
|
|
|
|
|
|
#######################################################################
|
|
|
|
=======
|
|
2) Bugs
|
|
=======
|
|
|
|
-----------------------------
|
|
A] array overflow with write2
|
|
-----------------------------
|
|
|
|
Array overflow during the handling of the GWB (GenStat book) files with
|
|
possibility of placing a NULL word in an arbitrary memory location:
|
|
|
|
00630399 |> 8B46 24 MOV EAX,DWORD PTR DS:[ESI+24] ; EAX controlled
|
|
0063039C |. 8B4E 08 MOV ECX,DWORD PTR DS:[ESI+8]
|
|
0063039F |. 8D0481 LEA EAX,DWORD PTR DS:[ECX+EAX*4]
|
|
006303A2 |. 3938 CMP DWORD PTR DS:[EAX],EDI
|
|
006303A4 |. 74 12 JE SHORT GenStat.006303B8
|
|
006303A6 |. 8B00 MOV EAX,DWORD PTR DS:[EAX]
|
|
006303A8 |. 05 A4040000 ADD EAX,4A4
|
|
006303AD |. 0FB708 MOVZX ECX,WORD PTR DS:[EAX]
|
|
006303B0 |. 894D FC MOV DWORD PTR SS:[EBP-4],ECX
|
|
006303B3 |. 33C9 XOR ECX,ECX
|
|
006303B5 |. 66:8908 MOV WORD PTR DS:[EAX],CX ; write2
|
|
|
|
|
|
----------------
|
|
B] heap overflow
|
|
----------------
|
|
|
|
Through the text strings in the final part of the GSH (GenStat
|
|
SpreadSheet) files it's possible to cause a heap overflow with
|
|
consequent freeing of arbitrary memory (write4):
|
|
|
|
0064D1C7 |> 3BBE 78040000 /CMP EDI,DWORD PTR DS:[ESI+478]
|
|
0064D1CD |. 7F 74 |JG SHORT GenStat.0064D243
|
|
0064D1CF |. FF75 08 |PUSH DWORD PTR SS:[EBP+8]
|
|
0064D1D2 |. 8D45 F4 |LEA EAX,DWORD PTR SS:[EBP-C]
|
|
0064D1D5 |. 6A 01 |PUSH 1
|
|
0064D1D7 |. 6A 04 |PUSH 4
|
|
0064D1D9 |. 50 |PUSH EAX
|
|
0064D1DA |. E8 2F3B2600 |CALL GenStat.008B0D0E ; read 32bit
|
|
0064D1DF |. 83C4 10 |ADD ESP,10
|
|
0064D1E2 |. 85C0 |TEST EAX,EAX
|
|
0064D1E4 |.^0F84 06FFFFFF |JE GenStat.0064D0F0
|
|
0064D1EA |. 66:837D 0C 00 |CMP WORD PTR SS:[EBP+C],0
|
|
0064D1EF |. 74 0A |JE SHORT GenStat.0064D1FB
|
|
0064D1F1 |. 8D45 F4 |LEA EAX,DWORD PTR SS:[EBP-C]
|
|
0064D1F4 |. 50 |PUSH EAX
|
|
0064D1F5 |. E8 DD6AFFFF |CALL GenStat.00643CD7
|
|
0064D1FA |. 59 |POP ECX
|
|
0064D1FB |> 837D F4 00 |CMP DWORD PTR SS:[EBP-C],0
|
|
0064D1FF |. 7E 1E |JLE SHORT GenStat.0064D21F ; I use the first one equal to -1
|
|
0064D201 |. FF75 08 |PUSH DWORD PTR SS:[EBP+8]
|
|
0064D204 |. 8B46 58 |MOV EAX,DWORD PTR DS:[ESI+58]
|
|
0064D207 |. 6A 01 |PUSH 1
|
|
0064D209 |. FF75 F4 |PUSH DWORD PTR SS:[EBP-C] ; 0x61616161
|
|
0064D20C |. 03C7 |ADD EAX,EDI
|
|
0064D20E |. 50 |PUSH EAX
|
|
0064D20F |. E8 FA3A2600 |CALL GenStat.008B0D0E ; overflow/corruption
|
|
0064D214 |. 83C4 10 |ADD ESP,10
|
|
0064D217 |. 85C0 |TEST EAX,EAX
|
|
0064D219 |.^0F84 D1FEFFFF |JE GenStat.0064D0F0
|
|
0064D21F |> FF86 74040000 |INC DWORD PTR DS:[ESI+474]
|
|
0064D225 |. 8B45 F4 |MOV EAX,DWORD PTR SS:[EBP-C]
|
|
0064D228 |. 43 |INC EBX
|
|
0064D229 |. 3B5D F8 |CMP EBX,DWORD PTR SS:[EBP-8]
|
|
0064D22C |. 8D7C07 01 |LEA EDI,DWORD PTR DS:[EDI+EAX+1] ; 0 + -1 + 1 = 0
|
|
0064D230 |.^7C 95 \JL SHORT GenStat.0064D1C7
|
|
|
|
|
|
#######################################################################
|
|
|
|
===========
|
|
3) The Code
|
|
===========
|
|
|
|
|
|
http://aluigi.org/poc/genstat_1.zip
|
|
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17931.zip
|
|
|
|
A] modified 32bit field at offset 0x46
|
|
B] modified 32bit field at offset 0x302 and added 'a's
|
|
|
|
|
|
#######################################################################
|
|
|
|
======
|
|
4) Fix
|
|
======
|
|
|
|
|
|
No fix.
|
|
|
|
|
|
####################################################################### |