SHGetPathFromIDList.txt

`-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA1  
  
Windows Api SHGetPathFromIDList Buffer Overflow  
  
To all those people who sent email to us asking for more information  
about  
the SHGetPathFromIDList Windows Api overflow.  
  
Here is a more specific description about the problem. All Structure  
lengths, or Length of string, can be a modified or altered and cause  
whatever handles the shortcuts to crash.  
  
SHGetPathFromIDList  
  
Converts an item identifier list to a file system path.  
  
BOOL SHGetPathFromIDList(  
LPCITEMIDLIST pidl,  
LPSTR pszPath  
);  
  
Parameters  
pidl  
Address of an item identifier list that specifies a file or directory  
location relative to the root of the namespace (the desktop).  
pszPath  
Address of a buffer to receive the file system path. This buffer must  
be at least MAX_PATH characters in size.  
Return Values  
Returns TRUE if successful, or FALSE otherwise.  
  
  
Disassembly of a hypothetical shortcut file  
Offset Bytes Contents  
Header  
0000 4C 00 00 00 =91L=92 Magic value  
0004 01 04 02 00 GUID of shortcut files  
00 00 00 00  
C0 00 00 00  
00 00 00 46  
0014 3F 00 00 00 Flags  
Has item id list  
Target is a file  
Has description string  
Has relative pathname  
Has a working directory  
Has a custom icon  
0018 20 00 00 00 File attibutes  
Archive  
001C C0 0E 82 D5 Time 1  
C1 20 BE 01  
0024 00 08 BF 46 Time 2  
D5 20 BE 01  
002C 00 47 AA EC Time 3  
EC 15 BE 01  
0034 A0 86 00 00 File length is 34464 bytes. 86A0h  
0038 05 00 00 00 Icon number 5  
003C 01 00 00 00 Normal window  
0040 46 06 00 00 Ctrl-Alt-F hotkey  
0044 00 00 00 00 Always zero, unknown/reserved  
0048 00 00 00 00 Always zero, unknown/reserved  
Item Id List  
004C 2A 00 Size of item id list  
First item  
004E 28 00 Length of first item  
0050 32 00 ???  
0052 A0 86 00 00 File length  
0056 76 25 71 3E ???  
005A 20 00 File attributes?  
005C 62 65 73 74 5F 37 =93best_773.mid=94 Long name  
37 33 2E 6D 69 64  
00 Null terminator  
0069 42 45 53 54 5F 37 =93BEST_773.MID=94 Short name  
37 33 2E 4D 49 44  
00 Null terminator  
Last item  
0076 00 00 Zero length value  
File location info  
0078 74 00 00 00 Structure length  
007C 1C 00 00 00 Offset past last item in structure  
0080 03 00 00 00 Flags  
Local volume  
Network volume  
0084 1C 00 00 00 Offset of local volume table  
0088 34 00 00 00 Offset of local path string  
008C 40 00 00 00 Offset of network volume table  
0090 5F 00 00 00 Offset of final path string  
Local volume table  
0094 18 00 00 00 Length of local volume table  
0098 03 00 00 00 Fixed disk  
009C D0 07 33 3A Volume serial number 3A33-07D0  
00A0 10 00 00 00 Offset to volume label  
00A4 44 52 49 56 45 20 =93DRIVE C=94,0  
43 00  
00AC 43 3A 5C 57 49 4E =93C:\ WINDOWS\=94 local path string  
44 4F 57 53 5C 00  
Network volume table  
00B8 1F 00 00 00 Length of network volume table  
00BC 02 00 00 00 ???  
00C0 14 00 00 00 Offset of share name  
00C4 00 00 00 00 ???  
00C8 00 00 02 00 ???  
00CC 5C 5C 4A 45 53 53 =93\\ JESSE\ WD=94,0 Share name  
45 5C 57 44 00  
00D7 44 65 73 6B 74 6F =93Desktop\ best_773.mid=94,0  
70 5C 62 65 73 74 Final path name  
5F 37 37 33 2E 6D  
69 64 00  
Description string  
00EC 12 00 Length of string  
00EE 42 65 73 74 20 37 =93Best 773 midi file=94  
37 33 20 6D 69 64  
69 20 66 69 6C 65  
Relative path  
0100 0E 00 Length of string  
0102 2E 5C 62 65 73 74 =93.\ best_773.mid=94  
5F 37 37 33 2E 6D  
69 64  
Working directory  
0114 12 00 Length of string  
0116 43 3A 5C 57 49 4E =93C:\ WINDOWS\ Desktop=94  
44 4F 57 53 5C 44  
65 73 6B 74 6F 70  
Command line arguments  
0128 06 00  
012A 2F 63 6C 6F 73 65 =93/close=94  
Icon file  
0130 16 00 Length of string  
0132 43 3A 5C 57 49 4E =93C:\ WINDOWS\ Mplayer.exe=94  
44 4F 57 53 5C 4D  
70 6C 61 79 65 72  
2E 65 78 65  
Ending stuff  
0148 00 00 00 00 Length 0 - no more stuff  
  
The target is located at:  
C:\ WINDOWS\ Desktop\ best_773.mid  
The windows directory is shared as:  
\\ JESSE\ WD  
  
  
Note:  
This overflow does not work under win2k  
  
u n d e r g r o u n d s e c u r i t y s y s t e m s r e s e a r c  
h  
http://www.ussrback.com  
  
  
-----BEGIN PGP SIGNATURE-----  
Version: PGPfreeware 6.5.2 for non-commercial use <http://www.pgp.com>  
  
iQA/AwUBOJsyuNybEYfHhkiVEQJHNACg58a5nakFaSPNoFVOLZ0WMPMHVYcAn0TT  
2HEPwsUBJTmD4Fzah4yZ+Zjh  
=3DBFth  
-----END PGP SIGNATURE-----  
  
  
`