Free CD to MP3 Converter v3.1 Stack Overflow Vulnerability Analysis and exploitation

Author:Riusksk (Quange)

Home page:Http://riusksk.blogbus.com

 

Preface

 

A few days agoExploit-dbWe can see this vulnerability announcement, and we have just downloaded the vulnerability software. So we downloaded it, analyzed it, and wrote it by ourselves.Exploit, In the Virtual MachineXp sp3. I have never written any article about overflow vulnerability analysis before. This is just a weekend, I analyzed the cause of the vulnerability myself, so I also have this article. The software analyzed in this article isFree CD to MP3 Converter v3.1, It isCDExtract and compress the audioMP3Software. The software does not verify the size of the content when reading the local file. As a result, overflow occurs when the file content is saved to a local variable, which overwrites the returned address andSEHStructure. Malicious users can execute arbitrary code by constructing a specific file.

 

Vulnerability Analysis

 

InReadFileAfter being disconnected, after multiple debugging, the vulnerability function is finally found.Sub_4AC138InIDAThe disassembly code is as follows:

 

CODE: 004AC138 sub_4AC138 proc near; code xref: sub_4AA590 + 50 p

CODE: 004AC138; sub_4AA590 + 26Bp

CODE: 004AC138

CODE: 004AC138 var_1024 = dword ptr-1024 h

CODE: 004AC138 var_1020 = dword ptr-1020 h

CODE: 004AC138 var_101C = word ptr-101Ch

CODE: 004AC138 var_1018 = dword ptr-1018 h

CODE: 004AC138 var_1014 = dword ptr-1014 h

CODE: 004AC138 var_1010 = dword ptr-1010 h;After reading the file content, it is saved from this local variable. Here we can determine that the stack space allocated by the function is1010 h, That is4112Byte. Because stack space is allocated from high to low, it must be filled to overwrite the return address.4112Bytes.

CODE: 004AC138

CODE: 004AC138 push ebx

CODE: 004AC139 push esi

CODE: 004AC13A push edi

CODE: 004AC13B push ebp

CODE: 004AC13C add esp, 0FFFFF004h;Allocate stack space

CODE: 004AC142 push eax

CODE: 004AC143 add esp, 0FFFFFFF4h;Continue stack space allocation

CODE: 004AC146 mov esi, eax

CODE: 004AC148 mov byte ptr [esi + 407Ch], 0

CODE: 004AC14F xor edi, edi

CODE: 004AC151 mov ebx, 4

CODE: 004AC156 lea edx, [esp + 101Ch + var_1010];SetEdxPoint to a local variable, which will be used later to save the content of the file to be read, that is, the content of the file we constructed will be filled in the stack space.

CODE: 004AC15A mov ecx, 4

CODE: 004AC15F mov eax, [esi + 44 h]

CODE: 004AC162 mov ebp, [eax]