47 lines
No EOL
2.2 KiB
Text
47 lines
No EOL
2.2 KiB
Text
Source: https://code.google.com/p/google-security-research/issues/detail?id=528
|
|
|
|
The attached testcase was found by fuzzing packed PE files, I suspect it was packed using "Yoda's protector". This vulnerability is obviously exploitable for remote code execution as NT AUTHORITY\SYSTEM on all systems using Kaspersky Antivirus.
|
|
|
|
(bb8.ff0): Access violation - code c0000005 (first chance)
|
|
First chance exceptions are reported before any exception handling.
|
|
This exception may be expected and handled.
|
|
eax=b5118b71 ebx=0000f8f0 ecx=0515f124 edx=b5118b71 esi=0bfe0e38 edi=0bfe005c
|
|
eip=71db9229 esp=0515f0f0 ebp=0515f0f4 iopl=0 nv up ei pl nz na po nc
|
|
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010202
|
|
kavbase_kdl!KLAV_Engine_Create+0x78227:
|
|
71db9229 8b4230 mov eax,dword ptr [edx+30h] ds:002b:b5118ba1=????????
|
|
|
|
What does it do with that value once it's loaded?
|
|
|
|
0:029> u
|
|
kavbase_kdl!KLAV_Engine_Create+0x78227:
|
|
71db9229 8b4230 mov eax,dword ptr [edx+30h] <-- dereference bad pointer
|
|
71db922c 57 push edi
|
|
71db922d 8b38 mov edi,dword ptr [eax] <-- dereference again
|
|
71db922f 51 push ecx
|
|
71db9230 8b0a mov ecx,dword ptr [edx]
|
|
71db9232 8b5730 mov edx,dword ptr [edi+30h] <-- dererence again
|
|
71db9235 56 push esi
|
|
71db9236 51 push ecx
|
|
0:029> u
|
|
kavbase_kdl!KLAV_Engine_Create+0x78235:
|
|
71db9237 50 push eax
|
|
71db9238 ffd2 call edx <-- attacker gets control of execution and parameters
|
|
71db923a 83c410 add esp,10h
|
|
71db923d 5f pop edi
|
|
71db923e 5e pop esi
|
|
71db923f 5d pop ebp
|
|
71db9240 c3 ret
|
|
|
|
Where does that pointer come from?
|
|
|
|
3C 03 6C 9E 8C 7D A5 C5 F9 22 6E F9 71 8B 11 B5 <--- *
|
|
B0 4D 5B 5C A8 19 09 FE 36 1A B6 92 3A 92 96 78
|
|
95 BD 55 64 76 C5 87 7C 00 C4 C7 36 6E 24 87 9F
|
|
5F 12 AB 96 75 ED 11 CC D1 B1 0C 4C B8 88 9A 5D
|
|
07 A5 C0 C7 5E 19 04 44 FC 4C 0F 69 20 2E 70 7A
|
|
|
|
Directly from the input file, so this is obviously exploitable for remote code execution as NT AUTHORITY\SYSTEM.
|
|
|
|
Proof of Concept:
|
|
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38288.zip |