Immunity Debugger 1.85 – Crash (PoC)

• Exploit Database
• 19 阅读

• 作者： Arsyntex
  日期： 2015-07-08
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/37526/

• # Title: Immunity Debugger - Crash
  # Date: 08/07/2015
  # Author: Arsyntex
  # Vendor Homepage: http://www.immunityinc.com/products/debugger/
  # Version: v1.85
  # Tested on: Windows 8.1 Pro
  
  Incorrect path/file EXtEnsion parsing.
  
  -Create folder with the name: .exe.exe and put any program inside and try debug it.
  -Try to debug an executable with the name: test.exe.exe or lib.exe.dll
  
  The "OpenEXEfile" function does not check if the return value of strchr() is zero.
  ----------------------------------------------------------------------------------
   loc_4B8182:
  
  mov [esp+10h+var_10], edi
  add edi, 4
  mov [esp+10h+var_C], 20h
  mov [esp+10h+arg_24], eax
  callstrchr ; return EAX= 0
  mov [esp+10h+var_10], eax
  mov [esp+10h+arg_28], eax; (!)
  callstrlen ; ntdll.strlen(s)
  
  ---------------------------------------------------------------------
  ntdll.strlen(s) - NULL parameter
  ---------------------------------------------------------------------
  ntdll_strlen:
  
  mov ecx, [esp+4] ; [esp+4] = 0NULL pointer
  testecx, 3 ; ...
  jzshort loc_77C77510 ; jump
  ...
  
   loc_77C77510:
  
  mov eax, [ecx] ; Access Violation
  ---------------------------------------------------------------------