Free Audio Video Pack 2.22.0.0 - Binary Planting

2020.01.27
Risk: Medium
Local: Yes
Remote: No
CVE: N/A
CWE: N/A

Title: Free Audio Video Pack 2.22.0.0 - Binary Planting Date: 2020-1-27 Author: Nir Yehoshua Product: http://www.pazera-software.com/files/FreeAudioVideoPack.7z Tested on: Microsoft Windows 10 x64 [eng] The Loading: 0x776B4C80 - FreeAudioVideoPack.exe used "LdrLoadDll" function to load binary with the following parameters: # Type Name Value 1 PWSTR SearchPath 16385 2 PULONG DllCharacteristics 0x0019eda0 = 0 3 PUNICODE_STRING Name 0x0019edb0 = { Length = 24, MaximumLength = 26, Buffer = 0x75a25d60 } 4 PVOID* BaseAddress 0x0019eda4 = 0x72e40000 "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.18362.418_none_2e73e95e27897f63\comctl32.dll" NTSTATUS Return STATUS_SUCCESS The Vulnerability: The intresting function starts at 0x760A4BC2, FreeAudioVideoPack.exe didn't verifing the binaries in "C:\Users\%user%\Desktop\FreeAudioVideoPack\apps\". A potential attacker can replace the legitimate binaries in with malicious binaries and run it under FreeAudioVideoPack.exe virtual memory space: 760A4BC2 | 55 | push ebp | 760A4BC3 | 8BEC | mov ebp,esp | 760A4BC5 | 6A FF | push FFFFFFFF | 760A4BC7 | 68 D0741976 | push windows.storage.761974D0 | 760A4BCC | 64:A1 00000 | mov eax,dword ptr fs:[0] | 760A4BD2 | 50 | push eax | 760A4BD3 | 83EC 64 | sub esp,64 | 760A4BD6 | A1 541A4B76 | mov eax,dword ptr ds:[764B1A54] | 760A4BDB | 33C5 | xor eax,ebp | 760A4BDD | 8945 F0 | mov dword ptr ss:[ebp-10],eax | 760A4BE0 | 53 | push ebx | 760A4BE1 | 56 | push esi | 760A4BE2 | 57 | push edi | 760A4BE3 | 50 | push eax | 760A4BE4 | 8D45 F4 | lea eax,dword ptr ss:[ebp-C] | 760A4BE7 | 64:A3 00000 | mov dword ptr fs:[0],eax | 760A4BED | 8BD9 | mov ebx,ecx | 760A4BEF | 8B45 0C | mov eax,dword ptr ss:[ebp+C] | 760A4BF2 | 8B55 20 | mov edx,dword ptr ss:[ebp+20] | 760A4BF5 | 8B4D 18 | mov ecx,dword ptr ss:[ebp+18] | 760A4BF8 | 8B75 1C | mov esi,dword ptr ss:[ebp+1C] | 760A4BFB | 8B7D 08 | mov edi,dword ptr ss:[ebp+8] | 760A4BFE | 8945 A0 | mov dword ptr ss:[ebp-60],eax | 760A4C01 | 837D A0 00 | cmp dword ptr ss:[ebp-60],0 | 760A4C05 | 8B45 10 | mov eax,dword ptr ss:[ebp+10] | 760A4C08 | 8945 9C | mov dword ptr ss:[ebp-64],eax | 760A4C0B | 8B45 14 | mov eax,dword ptr ss:[ebp+14] | 760A4C0E | 8955 98 | mov dword ptr ss:[ebp-68],edx | 760A4C11 | 8B55 24 | mov edx,dword ptr ss:[ebp+24] | 760A4C14 | 8945 94 | mov dword ptr ss:[ebp-6C],eax | 760A4C17 | 894D 90 | mov dword ptr ss:[ebp-70],ecx | 760A4C1A | 8975 D8 | mov dword ptr ss:[ebp-28],esi | 760A4C1D | 8955 A4 | mov dword ptr ss:[ebp-5C],edx | 760A4C20 | 0F85 AA0300 | jne windows.storage.760A4FD0 | 760A4C26 | 837D 9C 00 | cmp dword ptr ss:[ebp-64],0 | 760A4C2A | 0F85 CF0300 | jne windows.storage.760A4FFF | 760A4C30 | 85C0 | test eax,eax | 760A4C32 | 0F85 B10300 | jne windows.storage.760A4FE9 | 760A4C38 | 85C9 | test ecx,ecx | 760A4C3A | 0F85 B40300 | jne windows.storage.760A4FF4 | 760A4C40 | 85F6 | test esi,esi | 760A4C42 | 0F85 90D713 | jne windows.storage.761E23D8 | 760A4C48 | 8B45 98 | mov eax,dword ptr ss:[ebp-68] | 760A4C4B | 85C0 | test eax,eax | 760A4C4D | 0F85 90D713 | jne windows.storage.761E23E3 | 760A4C53 | 85D2 | test edx,edx | 760A4C55 | 0F85 93D713 | jne windows.storage.761E23EE | 760A4C5B | E8 75070C00 | call windows.storage.761653D5 | 760A4C60 | 84C0 | test al,al | 760A4C62 | 0F84 380100 | je windows.storage.760A4DA0 | 760A4C68 | C645 AB 00 | mov byte ptr ss:[ebp-55],0 | 760A4C6C | C745 FC 000 | mov dword ptr ss:[ebp-4],0 | 760A4C73 | 8D8B 9C0000 | lea ecx,dword ptr ds:[ebx+9C] | 760A4C79 | 8B01 | mov eax,dword ptr ds:[ecx] | 760A4C7B | C745 EC 000 | mov dword ptr ss:[ebp-14],0 | [ebp-14]:L"C:\\Users\\nir\\Desktop\\FreeAudioVideoPack\\apps\\3GP_to_AVI\\3gptoavi.exe" 760A4C82 | 8B70 38 | mov esi,dword ptr ds:[eax+38] | 760A4C85 | 8D45 EC | lea eax,dword ptr ss:[ebp-14] | [ebp-14]:L"C:\\Users\\nir\\Desktop\\FreeAudioVideoPack\\apps\\3GP_to_AVI\\3gptoavi.exe"


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2021, cxsecurity.com

 

Back to Top