Digital Music Pad v8.2.3.4.8 (.pls) SEH Overflow!

http://www.exploit-db.com/exploits/15855/

Video Workstation Version 5.3.9.4 dll hijacking (iacenc.dll, ir50_lcs.dll)!!

http://inj3ct0r.com/exploits/14314

iworkstation Version 9.3.2.1.4 dll hijacking exploit

http://inj3ct0r.com/exploits/14286

Quick Player 1.3 Unicode SEH Exploit.

http://www.exploit-db.com/exploits/15156

http://inj3ct0r.com/exploits/14339

http://packetstormsecurity.org/1009-exploits/quickplayer-sehoverwrite.txt

Digital Music Pad Version 8.2.3.3.4 SEH overflow Metasploit Module

http://www.metasploit.com/svn/framework3/trunk/modules/exploits/windows/fileformat/digital_music_pad_pls.rb

http://www.exploit-db.com/exploits/15134

http://inj3ct0r.com/exploits/14339

http://packetstormsecurity.org/1009-exploits/digital_music_pad_pls.rb.txt

DJ Studio Pro Version 8.1.3.2.1 SEH Exploit!

http://www.exploit-db.com/exploits/15031

http://inj3ct0r.com/exploits/14098

Audiotran 1.4.2.4 SEH Overflow Exploit!

http://www.exploit-db.com/exploits/14961

http://inj3ct0r.com/exploits/14059

http://packetstormsecurity.org/1009-exploits/audiotran1424-overflow.txt

Virtual DJ Trial 6.1.2 SEH Buffer Overflow Crash Proof of Concept!

http://www.exploit-db.com/exploits/14909

http://inj3ct0r.com/exploits/13990

http://packetstormsecurity.org/1009-exploits/virtualdjtrial-overflow.txt

Recreating exploits from malware samples found in the Wild!!!

This time we are releasing analysis of a malicious OLE document. This Malware exploits vulnerability in MS Word 2003. CVE-2006-6456


The malware sample for analysis is available at Mila’s blog (Greets Mila :)
http://contagiodump.blogspot.com/2010/09/cve-2009-4324-pdf-cmsisixthannualconfer.html


When we analyze with Offviz we see that there in invalid value for sprm.sgc

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
When we parse the document with OfficeMalScanner from http://www.reconstructer.org/code.html we find embedded OLE file at offset 0xdc00 and embedded executable at 0x4c00 encoded with XOR key 0x95
 
 
 

 
 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
We remove the malicious executable and the OLE file from the exploits file. Now we are left with the exploit file along with shellcode. We analyze the remaining (clean.doc) exploit file in Hex Workshop we find another XOR’ed section encoded with same key 0x95. This might be the encoded shellcode.
 
 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
So we extract this section and convert it into exe from http://sandsprite.com/shellcode_2_exe.php to analyze it in debugger. Here we see the shellcode IS actually XOR’ed with 0x95 key
 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
We Decode the shellcode and analyze in HEX again. We see that shellcode writes the exe to disk as SUCHOST.EXE.
 
 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
So now we got the location of shellcode also. Here we can remove the shellcode of malware and replace it with our shellcode.




The original malware, extracted executable, extracted OLE document, shellcode, decoded shellcode and a reconstructed POC file which calc.exe can be downloaded from::: http://www.mediafire.com/download.php?u55xgb1jpasp8na



There are 2 POC files one executes CMD.exe and other one executed CLAC.exe. Tested on XP SP 2 Office 2003.....



Greetz:: Mila, Villy, Puneet Jain, WEBDevil, ASL IT Sec Team



References::
http://contagiodump.blogspot.com/


http://www.reconstructer.org/


http://sandsprite.com/products.html

Microsoft Office Property Code Execution exploit (CVE-2006-2389) Analysis!!

The Sample is from http://contagiodump.blogspot.com/ Thanks Mila =)

All Files and recreated exploit code are uploaded at http://www.mediafire.com/download.php?t1ks9dexkxaku87 for analysis...



Exploit added at :::

http://inj3ct0r.com/exploits/13903

http://packetstormsecurity.org/1008-exploits/mop-exec.txt
 
This file exploits the vulnerability CVE-2006-2389.The Document size is 292864 bytes. There is an executable and real doc file embedded in this file.




Upon executing this file an executable is dropped which is embedded at offset 0x18200. This executable is XOR’ed with 32 bit key 0x58E5F269 and also the first 512 bytes are flipped using 16 bit byte flip operation. The size of this exe is 90112 bytes.

Additionally This dropped executable also drops an exe named “NAVPInst.exe” of size 28672 bytes



From offset 0x2e200 an genuine DOC file is embedded. Its size is 103936 bytes. The first 4 bytes of doc file which are 0xD0CF11E0 are replaced by 0xCFD0E011.

The shellcode starts from offset 0x16738 and 0x16a08 which writes the executable and the genuine doc file to the disc and executes it.