full-disclosure - Re: BoF in Windows 2000: ddeshare.exe

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <001101c4c676$d63bcb60$0100a8c0@grotedoos>
From: skylined at edup.tudelft.nl (Berend-Jan Wever)
Subject: Re: BoF in Windows 2000: ddeshare.exe

> As far as I can tell, this is not exploitable to run a shellcode because 
> of the fact that NULL's are inserted between charactors. But besides 
This is not a problem, read phrack: unicode shellcodes are real.
In fact you can create your own unicode alphanumeric uppercase shellcode using ALPHA2:
http://www.edup.tudelft.nl/~bjwever/alpha2/alpha2.php

Cheers,
SkyLined


----- Original Message ----- 
From: "Jack C" <jack@...pinc.com>
To: <bugtraq@...urityfocus.com>
Sent: Tuesday, November 09, 2004 03:24
Subject: BoF in Windows 2000: ddeshare.exe


> Hello all,
> 
> I found a static buffer overflow in ddeshare.exe on my Windows 2000, 
> latest updates/service packs box tonight. It appears as though no bounds 
> checking is performed on the share name before it is copied to the variable.
> 
> Exploiting:
> Start up c:\winnt\system32\ddeshare.exe. Click shares --> trusted 
> shares. Pick any of the shares already there (at least there are some on 
> my box, if not you can make one), and select Properties. Replace the 
> data in the "Share Name" text box with something like this:
> 
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABB
> 
> When you click OK, you get an error stating that ddeshare.exe has 
> "generated errors". Yay.
> 
> Run in OllyDbg, we find that the above string makes the program attempt 
> to JMP to 0x00420042. It just so happens that Hex 42 is a "B". So the 
> two B's at the end of the exploit string change the instrucation pointer.
> 
> As far as I can tell, this is not exploitable to run a shellcode because 
> of the fact that NULL's are inserted between charactors. But besides 
> that, it would only give the same privliges that you already have to run 
> the program in the first place. It simply points out bad coding.
> 
> Again, this isn't another of Microsoft's giant end-of-the-world security 
> blunders, but still, it's a BoF.
> 
> Thanks,
> 
> -Jack C ("crEp")
> jack [at] crepinc.com
> http://www.crepinc.com
>