-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Windows Api SHGetPathFromIDList Buffer Overflow

To all those people who sent email to us asking for more information
about
the SHGetPathFromIDList Windows Api overflow.

Here is a more specific description about the problem. All Structure
lengths, or Length of string, can be a modified or altered and cause
whatever handles the shortcuts to crash.

SHGetPathFromIDList

Converts an item identifier list to a file system path.

BOOL SHGetPathFromIDList(
    LPCITEMIDLIST pidl,
    LPSTR pszPath
);

Parameters
pidl
Address of an item identifier list that specifies a file or directory
location relative to the root of the namespace (the desktop).
pszPath
Address of a buffer to receive the file system path. This buffer must
be at least MAX_PATH characters in size.
Return Values
Returns TRUE if successful, or FALSE otherwise.


Disassembly of a hypothetical shortcut file
Offset Bytes Contents
Header
0000   4C 00 00 00   =91L=92 Magic value
0004   01 04 02 00   GUID of shortcut files
  00 00 00 00
  C0 00 00 00
  00 00 00 46
0014   3F 00 00 00 Flags
      Has item id list
      Target is a file
      Has description string
      Has relative pathname
      Has a working directory
      Has a custom icon
0018   20 00 00 00   File attibutes
      Archive
001C   C0 0E 82 D5   Time 1
  C1 20 BE 01
0024   00 08 BF 46   Time 2
  D5 20 BE 01
002C   00 47 AA EC   Time 3
  EC 15 BE 01
0034   A0 86 00 00   File length is 34464 bytes. 86A0h
0038   05 00 00 00   Icon number 5
003C   01 00 00 00   Normal window
0040   46 06 00 00   Ctrl-Alt-F hotkey
0044   00 00 00 00   Always zero, unknown/reserved
0048   00 00 00 00   Always zero, unknown/reserved
      Item Id List
004C   2A 00     Size of item id list
      First item
004E   28 00     Length of first item
0050   32 00     ???
0052   A0 86 00 00   File length
0056   76 25 71 3E   ???
005A   20 00     File attributes?
005C   62 65 73 74 5F 37   =93best_773.mid=94 Long name
  37 33 2E 6D 69 64
  00     Null terminator
0069   42 45 53 54 5F 37   =93BEST_773.MID=94 Short name
  37 33 2E 4D 49 44
  00     Null terminator
      Last item
0076   00 00     Zero length value
File location info
0078   74 00 00 00   Structure length
007C   1C 00 00 00   Offset past last item in structure
0080   03 00 00 00   Flags
      Local volume
      Network volume
0084   1C 00 00 00   Offset of local volume table
0088   34 00 00 00   Offset of local path string
008C   40 00 00 00   Offset of network volume table
0090   5F 00 00 00   Offset of final path string
Local volume table
0094   18 00 00 00   Length of local volume table
0098   03 00 00 00   Fixed disk
009C   D0 07 33 3A   Volume serial number 3A33-07D0
00A0   10 00 00 00   Offset to volume label
00A4   44 52 49 56 45 20   =93DRIVE C=94,0
  43 00
00AC   43 3A 5C 57 49 4E   =93C:\ WINDOWS\=94 local path string
  44 4F 57 53 5C 00
Network volume table
00B8   1F 00 00 00   Length of network volume table
00BC   02 00 00 00   ???
00C0   14 00 00 00   Offset of share name
00C4   00 00 00 00   ???
00C8   00 00 02 00   ???
00CC   5C 5C 4A 45 53 53   =93\\ JESSE\ WD=94,0 Share name
  45 5C 57 44 00
00D7   44 65 73 6B 74 6F   =93Desktop\ best_773.mid=94,0
  70 5C 62 65 73 74   Final path name
  5F 37 37 33 2E 6D
  69 64 00
Description string
00EC   12 00     Length of string
00EE   42 65 73 74 20 37   =93Best 773 midi file=94
  37 33 20 6D 69 64
  69 20 66 69 6C 65
Relative path
0100   0E 00 Length of string
0102   2E 5C 62 65 73 74 =93.\ best_773.mid=94
  5F 37 37 33 2E 6D
  69 64
Working directory
0114   12 00 Length of string
0116   43 3A 5C 57 49 4E =93C:\ WINDOWS\ Desktop=94
  44 4F 57 53 5C 44
  65 73 6B 74 6F 70
Command line arguments
0128   06 00
012A   2F 63 6C 6F 73 65 =93/close=94
Icon file
0130   16 00   Length of string
0132   43 3A 5C 57 49 4E =93C:\ WINDOWS\ Mplayer.exe=94
  44 4F 57 53 5C 4D
  70 6C 61 79 65 72
  2E 65 78 65
Ending stuff
0148   00 00 00 00   Length 0 - no more stuff

The target is located at:
C:\ WINDOWS\ Desktop\ best_773.mid
The windows directory is shared as:
\\ JESSE\ WD


Note:
 This overflow does not work under win2k

u n d e r g r o u n d  s e c u r i t y  s y s t e m s  r e s e a r c
h
http://www.ussrback.com


-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 6.5.2 for non-commercial use <http://www.pgp.com>

iQA/AwUBOJsyuNybEYfHhkiVEQJHNACg58a5nakFaSPNoFVOLZ0WMPMHVYcAn0TT
2HEPwsUBJTmD4Fzah4yZ+Zjh
=3DBFth
-----END PGP SIGNATURE-----