Microsoft Reader 2.1.1.3143 – Null Byte Write

• Exploit Database
• 13 阅读

• 作者： Luigi Auriemma
  日期： 2011-04-12
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/17164/

• #######################################################################
  
   Luigi Auriemma
  
  Application:Microsoft Reader
  http://www.microsoft.com/reader
  Versions: <= 2.1.1.3143 (PC version)
  the Origami 2.6.1.7169 version doesn't seem vulnerable
  the non-PC versions have not been tested
  Platforms:Windows, Windows Mobile, Tablet PC and UMPC devices
  Bug:writing of NULL byte in arbitrary location
  Date: 11 Apr 2011
  Author: Luigi Auriemma
  e-mail: aluigi@autistici.org
  web:aluigi.org
  
  
  #######################################################################
  
  
  1) Introduction
  2) Bug
  3) The Code
  4) Fix
  
  
  #######################################################################
  
  ===============
  1) Introduction
  ===============
  
  
  Microsoft Reader is a software needed to read and catalog the ebooks in
  LIT format and the Audible audio books bought via internet, indeed the
  homepage acts also as online store for these protected contents.
  
  
  #######################################################################
  
  ======
  2) Bug
  ======
  
  
  Possibility to write a 0x00 byte in an arbitrary memory location.
  From aud_file.dll (base address 5fff0000):
  
  5FFF634A >|> 8D47 01|LEA EAX,DWORD PTR DS:[EDI+1] ; size at offset 0xbd of the PoC
  5FFF634D|. 50 |PUSH EAX
  5FFF634E|. E8 2B470000|CALL <JMP.&MSVCRT.??2@YAPAXI@Z>; malloc
  5FFF6353|. 57 |PUSH EDI
  5FFF6354|. 50 |PUSH EAX
  5FFF6355|. FF75 08|PUSH DWORD PTR SS:[EBP+8]
  5FFF6358|. 8945 F8|MOV DWORD PTR SS:[EBP-8],EAX
  5FFF635B|. E8 58460000|CALL <JMP.&utils.?read_bytes@TypeIO@@SA> ; read
  5FFF6360|. 8B45 F8|MOV EAX,DWORD PTR SS:[EBP-8]
  5FFF6363|. 83C4 10|ADD ESP,10
  5FFF6366|. 802438 00|AND BYTE PTR DS:[EAX+EDI],0; place the delimiter (all ok)
  5FFF636A|. 807D FF 00 |CMP BYTE PTR SS:[EBP-1],0
  5FFF636E|. 75 5B|JNZ SHORT aud_file.5FFF63CB
  5FFF6370|. 8D46 01|LEA EAX,DWORD PTR DS:[ESI+1] ; size at offset 0xc1 of the PoC
  5FFF6373|. 50 |PUSH EAX
  5FFF6374|. E8 05470000|CALL <JMP.&MSVCRT.??2@YAPAXI@Z>; now malloc will return NULL
  5FFF6379|. 8BD8 |MOV EBX,EAX
  5FFF637B|. 56 |PUSH ESI
  5FFF637C|. 53 |PUSH EBX
  5FFF637D|. FF75 08|PUSH DWORD PTR SS:[EBP+8]
  5FFF6380|. E8 33460000|CALL <JMP.&utils.?read_bytes@TypeIO@@SA> ; read
  5FFF6385|. 802433 00|AND BYTE PTR DS:[EBX+ESI],0; exploitation
  
  The first allocation must succeed to avoid problems during the
  reading operations (like memcpy on 0x00000000).
  
  Note that is not possible to exploit the visible integer overflow
  caused by malloc(size + 1) because the function that reads the data
  goes in endless loop, yeah bad.
  
  The provided proof-of-concept first tries to allocate 0x44000000 bytes
  and it should succeed without problems and then will try to allocate
  the second size that MUST fail so that is possible to use the size
  value as an arbitrary memory offset.
  
  Modified bytes in the proof-of-concept:
  000000BD 00 43; first size needed to steal memory to the next size
  000000BE 00 FF
  000000BF 00 FF
  000000C0 0A FF
  000000C1 00 61; second size, will try to write 0x00 at address 0x61616161
  000000C2 00 61
  000000C3 00 61
  000000C4 16 61
  
  
  #######################################################################
  
  ===========
  3) The Code
  ===========
  
  
  http://aluigi.org/poc/msreader_5.zip
  https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17164.zip
  
  
  #######################################################################
  
  ======
  4) Fix
  ======
  
  
  No fix.
  
  
  #######################################################################