full-disclosure - Re: MS05_039 Exploitation (different languages)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri Aug 26 02:09:48 2005
From: fmourron at exaprobe.com (Fabrice MOURRON)
Subject: Re: MS05_039 Exploitation (different languages)

Hi Roman,

I assure you that the address is also different for the French language.
With the similar review with ollydbg, the base address for me is
0x76740000. I've attached the resulting exploit and Metasploit's module
for french's system.

Regards,

-- 
Fabrice MOURRON ----- Consultant en s?curit? des syst?mes d'information
fmourron@...probe.com ------[ ExaProbe ]------ http://www.exaprobe.com/

PGP KeyID: 20D22266
FingerPrint: 767E CB52 94D3 7AEF DD21  BD2F 4D5C 6E6D 20D2 2266


Le jeudi 25 ao?t 2005 ? 18:36 +0200, Roman Medina-Heigl Hernandez a
?crit :
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Hi,
> 
> I tested existing exploits for PnP bug on my W2k SP4 machine (Spanish)
> and they didn't work ("services" process is crashing but I got no
> shell). So I did a quick review with Olly and I realized that
> umpnpmgr.dll is being loaded at a different base address. In Spanish
> systems this base address is 0x76770000 but current exploits are
> assumming (I guess) 0x767a0000. Then I did a quick hack to HOD's exploit
> and it worked perfectly. I also modified Metasploit's module and
> included a target for Spanish systems. I've attached resulting exploits
> (they are trivial, though).
> 
> Is it usual that Windows DLLs have different base address across same
> Windows/SP versions (but different languages)?
> 
> 
> - --
> 
> Cheers,
> - -Roman
> 
> PGP Fingerprint:
> 09BB EFCD 21ED 4E79 25FB  29E1 E47F 8A7D EAD5 6742
> [Key ID: 0xEAD56742. Available at KeyServ]
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.0 (MingW32)
> 
> iD8DBQFDDfOr5H+KferVZ0IRAiZKAKDJ0A1RT+iyFcJipN3k56YEmzctqACePS5e
> aUJNlnMEsftew1Yn993iGJY=
> =XE3r
> -----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: ms05_039_pnp_french.pm
Type: application/x-perl
Size: 8091 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20050826/095069d4/ms05_039_pnp_french-0001.bin
-------------- next part --------------
A non-text attachment was scrubbed...
Name: HOD-ms05039-pnp-expl-french.c
Type: text/x-csrc
Size: 14542 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20050826/095069d4/HOD-ms05039-pnp-expl-french-0001.bin