Vulnerable Systems:
* Aladdin Knowledge System Ltd. PrivAgent ActiveX Control 2.0
Below there's a list of stack-based buffer overflow, insecure file download and a proof of concept which exploits a good old fashioned (or trivial, if you like) stack based buffer overflow, triggered simply passing to the "ChooseFilePath" method a string longer than 268 bytes. In this case, after a memory reading exception, we are in full control of EIP.
Here it is the list of vulnerable methods, guess which ones are vulnerable to arbitrary file download? :)
#1
Function DownloadLicense (
ByVal sURL As String ,
ByVal sPath As String ,
ByVal bInstall As Boolean
) As Long
#2
Function ChooseFilePath (
ByVal sFileName As String
) As String
#3
Function InstallLicense (
ByVal szLicensePath As String
) As Long
#4
Function InstallPrivilege (
ByVal szInstFilePath As String
) As Long
#4
Function DownloadPrivilege (
ByVal szURL As String ,
ByVal szTargetDir As String ,
ByVal bInstall As Boolean
) As Long
#4
Function InstallDevExt (
ByVal szDevExtPath As String
) As Long
#5
Function DownloadDevExt (
ByVal szURL As String ,
ByVal szTargetPath As String ,
ByVal bInstall As Boolean
) As Long
0:005> g
WARNING: Continuing a non-continuable exception
(1138.1304): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000000 ebx=076886d8 ecx=00385f70 edx=086dc628 esi=0253cfa4 edi=0253cd24
eip=62626262 esp=0253cce4 ebp=41414141 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246
62626262 ?? ???
