Bug Hunter Diary

Stack beforethe overflowStack afterthe overflow“…\Install”savedreturnaddressuser-controlleddataSubKey(260 bytes)writing directionSubKey (260 bytes)“SOFTWARE\Webex\UCF\Components\Authoring\...”Figure 5-10: Diagram of the stack buffer overflow that occurs when an overly long stringis passed to NewObject()5.2 ExploitationAfter I found the vulnerability, exploitation was easy. All I had to dowas tweak the length of the string argument supplied to NewObject() tooverflow the stack buffer and gain control of the return address of thecurrent stack frame.As illustrated in Figure 5-9, the distance from the SubKey bufferto the saved return address on the stack is 272 bytes (the offset of thesaved return address (+00000004) minus the offset of SubKey (-0000010C):0x4 - -0x10c = 0x110 (272)). I also had to account for the fact thatthe string “Authoring” and part of the format string will be copiedinto SubKey right before the user-controlled data (see Figure 5-10).All in all I had to subtract 40 bytes (“SOFTWARE\Webex\UCF\Components\Authoring\”) from the distance between SubKey and the saved returnaddress (272 – 40 = 232). So I had to provide 232 bytes of dummydata to fill the stack and reach the saved return address. The following4 bytes of the user-controlled data should then overwrite thevalue of the saved return address on the stack.So I changed the number of supplied characters in line 6of webex_poc1.html and named the new file webex_poc2.html (seeListing 5-5):01 02 WebEx PoC 203 04 82 Chapter 5