SlimPDF Reader – Denial of Service (PoC)
Slimpdf Reader from investintech, http://www.investintech.com/resources/freetools/slimpdfreader/ is prone to several overflows that can lead to code execution. The crash below is triggered by simply adding 50.000 random characters in the header of a pdf file. Initial bug and directions to exploitation were given from Jason Kratzer. PoC at http://www.deventum.com/research/crash_slimpdf.pdf CommandLine: "C:\Program Files\Investintech.com Inc\SlimPDF Reader\SlimPDF Reader.exe" Executable search path is: ModLoad: 00400000 00776000 SlimPDF Reader.exe ModLoad: 779c0000 77afd000 ntdll.dll ModLoad: 76990000 76a64000 C:\Windows\system32\kernel32.dll ModLoad: 75e10000 75e5a000 C:\Windows\system32\KERNELBASE.dll ModLoad: 77920000 779c0000 C:\Windows\system32\ADVAPI32.dll ModLoad: 77870000 7791c000 C:\Windows\system32\msvcrt.dll ModLoad: 75e70000 75e89000 C:\Windows\SYSTEM32\sechost.dll ModLoad: 77760000 77801000 C:\Windows\system32\RPCRT4.dll ModLoad: 76470000 76539000 C:\Windows\system32\USER32.dll ModLoad: 767e0000 7682e000 C:\Windows\system32\GDI32.dll ModLoad: 762c0000 762ca000 C:\Windows\system32\LPK.dll ModLoad: 75f70000 7600d000 C:\Windows\system32\USP10.dll ModLoad: 75ef0000 75f6b000 C:\Windows\system32\COMDLG32.dll ModLoad: 75e90000 75ee7000 C:\Windows\system32\SHLWAPI.dll ModLoad: 74a40000 74bde000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\COMCTL32.dll ModLoad: 76a80000 776c9000 C:\Windows\system32\SHELL32.dll ModLoad: 6cbf0000 6cc41000 C:\Windows\system32\WINSPOOL.DRV ModLoad: 6ab80000 6ab9c000 C:\Windows\system32\oledlg.dll ModLoad: 76830000 7698c000 C:\Windows\system32\ole32.dll ModLoad: 776d0000 7775f000 C:\Windows\system32\OLEAUT32.dll ModLoad: 76540000 76575000 C:\Windows\system32\WS2_32.dll ModLoad: 76a70000 76a76000 C:\Windows\system32\NSI.dll ModLoad: 74730000 748c0000 C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll ModLoad: 76580000 7669a000 C:\Windows\system32\WININET.dll ModLoad: 75e60000 75e63000 C:\Windows\system32\Normaliz.dll ModLoad: 76100000 762b6000 C:\Windows\system32\iertutil.dll ModLoad: 766a0000 767b0000 C:\Windows\system32\urlmon.dll (9d8.c1c): Break instruction exception - code 80000003 (first chance) eax=00000000 ebx=00000000 ecx=0012fb0c edx=77a06344 esi=fffffffe edi=00000000 eip=77a5ebbe esp=0012fb28 ebp=0012fb54 iopl=0 nv up ei pl zr na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246 ntdll!LdrVerifyImageMatchesChecksum+0x633: 77a5ebbe cc int 3 0:000> g ModLoad: 76010000 7602f000 C:\Windows\system32\IMM32.DLL ModLoad: 76030000 760fc000 C:\Windows\system32\MSCTF.dll ModLoad: 748c0000 74900000 C:\Windows\system32\uxtheme.dll ModLoad: 73650000 7365f000 C:\Windows\system32\inetmib1.dll ModLoad: 73b90000 73bac000 C:\Windows\system32\IPHLPAPI.DLL ModLoad: 730d0000 730d7000 C:\Windows\system32\WINNSI.DLL ModLoad: 6c8d0000 6c8d9000 C:\Windows\system32\snmpapi.dll ModLoad: 75ab0000 75abc000 C:\Windows\system32\CRYPTBASE.dll ModLoad: 74480000 74493000 C:\Windows\system32\dwmapi.dll ModLoad: 77810000 77815000 C:\Windows\system32\psapi.dll ModLoad: 77b00000 77b83000 C:\Windows\system32\CLBCatQ.DLL ModLoad: 6afe0000 6b038000 C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll ModLoad: 74270000 7436b000 C:\Windows\system32\WindowsCodecs.dll ModLoad: 75a60000 75aab000 C:\Windows\system32\apphelp.dll ModLoad: 6bdc0000 6bdf1000 C:\Windows\system32\EhStorShell.dll ModLoad: 762d0000 7646d000 C:\Windows\system32\SETUPAPI.dll ModLoad: 75d20000 75d47000 C:\Windows\system32\CFGMGR32.dll ModLoad: 75d00000 75d12000 C:\Windows\system32\DEVOBJ.dll ModLoad: 74900000 749f5000 C:\Windows\system32\PROPSYS.dll ModLoad: 6bd50000 6bdba000 C:\Windows\System32\cscui.dll ModLoad: 6bd40000 6bd49000 C:\Windows\System32\CSCDLL.dll ModLoad: 714e0000 714eb000 C:\Windows\system32\CSCAPI.dll ModLoad: 6bcd0000 6bd3f000 C:\Windows\system32\ntshrui.dll ModLoad: 757f0000 75809000 C:\Windows\system32\srvcli.dll ModLoad: 73cf0000 73cfa000 C:\Windows\system32\slc.dll ModLoad: 74ea0000 74ec1000 C:\Windows\system32\ntmarta.dll ModLoad: 77820000 77865000 C:\Windows\system32\WLDAP32.dll ModLoad: 75b60000 75b6b000 C:\Windows\system32\profapi.dll ModLoad: 755e0000 755f6000 C:\Windows\system32\CRYPTSP.dll ModLoad: 75380000 753bb000 C:\Windows\system32\rsaenh.dll ModLoad: 75b20000 75b2e000 C:\Windows\system32\RpcRtRemote.dll ModLoad: 66030000 6608c000 C:\Windows\System32\StructuredQuery.dll ModLoad: 75900000 75908000 C:\Windows\System32\Secur32.dll ModLoad: 75a40000 75a5a000 C:\Windows\system32\SSPICLI.DLL ModLoad: 6b450000 6b49e000 C:\Windows\system32\actxprxy.dll ModLoad: 665e0000 66612000 C:\Program Files\Internet Explorer\ieproxy.dll ModLoad: 67620000 67636000 C:\Windows\system32\thumbcache.dll ModLoad: 6b3f0000 6b41e000 C:\Windows\system32\SHDOCVW.dll ModLoad: 69f80000 6a8c5000 C:\Windows\system32\ieframe.DLL ModLoad: 72bb0000 72bec000 C:\Windows\system32\OLEACC.dll ModLoad: 73440000 734df000 C:\Windows\system32\SearchFolder.dll ModLoad: 6a9e0000 6ab78000 C:\Windows\system32\NetworkExplorer.dll ModLoad: 6b4d0000 6b4d9000 C:\Windows\system32\LINKINFO.dll ModLoad: 74120000 7412f000 C:\Windows\system32\samcli.dll ModLoad: 74a00000 74a12000 C:\Windows\system32\SAMLIB.dll ModLoad: 74140000 74149000 C:\Windows\system32\netutils.dll (9d8.c1c): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=01d32eb0 ebx=01d1fdc8 ecx=01d2fd68 edx=00000150 esi=01d32e08 edi=01d2fde8 eip=004419c4 esp=0012ebcc ebp=0012ebe8 iopl=0 nv up ei pl zr na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246 *** WARNING: Unable to verify checksum for SlimPDF Reader.exe *** ERROR: Module load completed but symbols could not be loaded for SlimPDF Reader.exe SlimPDF_Reader+0x419c4: 004419c4 880c02 mov byte ptr [edx+eax],cl ds:0023:01d33000=?? 0:000> !exploitable Exploitability Classification: EXPLOITABLE Recommended Bug Title: Exploitable - User Mode Write AV starting at SlimPDF_Reader+0x00000000000419c4 (Hash=0x566e1f14.0x18331e13) User mode write access violations that are not near NULL are exploitable. POC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17274.poc.tar.gz |