Berend-Jan Wever
09/11/04, 18:15
> As far as I can tell, this is not exploitable to run a shellcode =
because=20
> of the fact that NULL's are inserted between charactors. But besides=20
This is not a problem, read phrack: unicode shellcodes are real.
In fact you can create your own unicode alphanumeric uppercase shellcode =
using ALPHA2:
http://www.edup.tudelft.nl/~bjwever/alpha2/alpha2.php
Cheers,
SkyLined
----- Original Message -----=20
From: "Jack C" <jack@crepinc.com>
To: <bugtraq@securityfocus.com>
Sent: Tuesday, November 09, 2004 03:24
Subject: BoF in Windows 2000: ddeshare.exe
> Hello all,
>=20
> I found a static buffer overflow in ddeshare.exe on my Windows 2000,=20
> latest updates/service packs box tonight. It appears as though no =
bounds=20
> checking is performed on the share name before it is copied to the =
variable.
>=20
> Exploiting:
> Start up c:\winnt\system32\ddeshare.exe. Click shares --> trusted=20
> shares. Pick any of the shares already there (at least there are some =
on=20
> my box, if not you can make one), and select Properties. Replace the=20
> data in the "Share Name" text box with something like this:
>=20
> =
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAABB
>=20
> When you click OK, you get an error stating that ddeshare.exe has=20
> "generated errors". Yay.
>=20
> Run in OllyDbg, we find that the above string makes the program =
attempt=20
> to JMP to 0x00420042. It just so happens that Hex 42 is a "B". So the=20
> two B's at the end of the exploit string change the instrucation =
pointer.
>=20
> As far as I can tell, this is not exploitable to run a shellcode =
because=20
> of the fact that NULL's are inserted between charactors. But besides=20
> that, it would only give the same privliges that you already have to =
run=20
> the program in the first place. It simply points out bad coding.
>=20
> Again, this isn't another of Microsoft's giant end-of-the-world =
security=20
> blunders, but still, it's a BoF.
>=20
> Thanks,
>=20
> -Jack C ("crEp")
> jack [at] crepinc.com
> http://www.crepinc.com
>
because=20
> of the fact that NULL's are inserted between charactors. But besides=20
This is not a problem, read phrack: unicode shellcodes are real.
In fact you can create your own unicode alphanumeric uppercase shellcode =
using ALPHA2:
http://www.edup.tudelft.nl/~bjwever/alpha2/alpha2.php
Cheers,
SkyLined
----- Original Message -----=20
From: "Jack C" <jack@crepinc.com>
To: <bugtraq@securityfocus.com>
Sent: Tuesday, November 09, 2004 03:24
Subject: BoF in Windows 2000: ddeshare.exe
> Hello all,
>=20
> I found a static buffer overflow in ddeshare.exe on my Windows 2000,=20
> latest updates/service packs box tonight. It appears as though no =
bounds=20
> checking is performed on the share name before it is copied to the =
variable.
>=20
> Exploiting:
> Start up c:\winnt\system32\ddeshare.exe. Click shares --> trusted=20
> shares. Pick any of the shares already there (at least there are some =
on=20
> my box, if not you can make one), and select Properties. Replace the=20
> data in the "Share Name" text box with something like this:
>=20
> =
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAABB
>=20
> When you click OK, you get an error stating that ddeshare.exe has=20
> "generated errors". Yay.
>=20
> Run in OllyDbg, we find that the above string makes the program =
attempt=20
> to JMP to 0x00420042. It just so happens that Hex 42 is a "B". So the=20
> two B's at the end of the exploit string change the instrucation =
pointer.
>=20
> As far as I can tell, this is not exploitable to run a shellcode =
because=20
> of the fact that NULL's are inserted between charactors. But besides=20
> that, it would only give the same privliges that you already have to =
run=20
> the program in the first place. It simply points out bad coding.
>=20
> Again, this isn't another of Microsoft's giant end-of-the-world =
security=20
> blunders, but still, it's a BoF.
>=20
> Thanks,
>=20
> -Jack C ("crEp")
> jack [at] crepinc.com
> http://www.crepinc.com
>